Adding an AI Chatbot to a Business Website: What to Check

Decide what the chatbot is for

Start with a short list of jobs: answering questions about opening hours, delivery or services, finding the right page, or collecting the details of an enquiry. Write down what it must not do too, such as quoting prices that are not on the site, giving legal, medical or financial advice, or promising refunds. A narrow scope is easier to test and safer.

Most website chatbots use a large language model from a vendor, your own content and a set of instructions called a system prompt. If one connects to your booking, order or CRM system, it does so through APIs; see our guide to APIs and integrations.

Accuracy: you answer for what it says

Language models can produce fluent answers that are wrong. The OWASP Top 10 for LLM applications lists this as misinformation (LLM09). The legal question is who is responsible when a customer relies on a wrong answer.

In Moffatt v. Air Canada, 2024 BCCRT 149 (14 February 2024), a customer asked the airline's website chatbot about bereavement fares and was given incorrect information about claiming a refund later. Air Canada argued the chatbot was responsible for its own actions. The British Columbia Civil Resolution Tribunal called that "a remarkable submission" and said "It makes no difference whether the information comes from a static page or a chatbot." It found the airline had not taken reasonable care to make sure the chatbot was accurate and ordered it to pay the customer. It is one Canadian small claims decision, but a sensible principle to plan around.

Be careful about how you describe the bot as well. In September 2024 the FTC announced Operation AI Comply, a set of actions against companies making deceptive AI claims. One case concerned a service promoted as "the world's first robot lawyer". The FTC's complaint alleged the company had not tested whether its chatbot's output matched the level of a human lawyer. Its chair said "there is no AI exemption from the laws on the books."

• Base answers on your own approved content, and keep that content up to date.
• Do not describe the bot as an expert, or claim abilities you have not tested.
• For prices, terms and policies, have the bot link to the page that states them.

Personal data and privacy

People type names, email addresses, order numbers and sometimes health or money worries into chat boxes. That is personal data, and the usual rules apply. The ICO's guidance on AI and data protection (last updated 15 March 2023, and currently under review after the Data (Use and Access) Act) covers the main points:

• Assess the risk first. The ICO says that "in the vast majority of cases" using AI will involve processing likely to result in a high risk to individuals, which triggers the legal requirement for a data protection impact assessment (DPIA). If you decide yours is not high risk, you still need to document how you reached that conclusion.
• Tell people. The transparency chapter says your privacy information must cover your purposes, retention periods and who you share the data with, and must be given when you collect the data. For a chatbot, that means your privacy policy should cover the chat and the vendor that processes it.
• Keep personal data accurate. The accuracy chapter explains that data protection accuracy means taking reasonable steps so that personal data is not "incorrect or misleading as to any matter of fact".

Ask the chatbot vendor where conversations are stored, for how long, whether they are used to train its models, and what its data processing terms say. Do not ask for sensitive details in the chat. Our privacy policy and cookie consent guide covers the wider website rules, including cookies that a chat widget may set.

Telling people they are talking to AI

The EU AI Act (Regulation (EU) 2024/1689) includes a specific duty for chatbots. Article 50(1) says providers must ensure that AI systems intended to interact directly with people are designed so that those people are informed they are interacting with an AI system, unless that is obvious from the context. Article 50(5) says the information must be given "in a clear and distinguishable manner at the latest at the time of the first interaction". Under Article 113, these rules apply from 2 August 2026. The "Digital Omnibus on AI" (Regulation (EU) 2026/1744, published on 24 July 2026) amended the AI Act but did not move that date; it gave providers whose systems were already on the market until 2 December 2026 only for the separate duty to mark AI-generated content (Article 50(2)), and moved several high-risk system dates to 2027 and 2028.

The duty in Article 50(1) falls on the provider of the system, but a business that buys a chatbot should check that the product it puts on its site does this. A short line at the start of the chat ("You are chatting with an AI assistant. It can make mistakes; ask for a person at any time.") covers it and sets expectations.

Handing over to a person

A chatbot should never be a dead end. Decide when it hands over to a person and how:

• When the customer asks for a person.
• For complaints, refunds, cancellations, account changes or anything involving money.
• When the bot does not find an answer in your content, rather than guessing.
• Outside staffed hours, by collecting contact details for a reply and saying when to expect one.

Pass the conversation to whoever takes over, and keep other contact options visible on the site.

Security and prompt injection

The first item in the OWASP Top 10 for LLM applications is prompt injection (LLM01): input that changes the model's behaviour in ways you did not intend. It can be direct, typed by a user, or indirect, hidden in a web page or file the bot reads. OWASP's own example is an attacker telling a customer support chatbot to ignore its guidelines, query private data stores and send emails. OWASP says "it is unclear if there are fool-proof methods of prevention", so the aim is to limit the damage:

• Give the bot access only to what it needs. OWASP lists least privilege, handling API tokens in code rather than giving them to the model, and human approval for high-risk actions.
• Do not put secrets or private data in the system prompt; OWASP lists system prompt leakage (LLM07) separately.
• Treat the bot's output as untrusted before it is shown on a page or passed to another system (improper output handling, LLM05).
• Avoid giving it more power than it needs to act on its own, such as sending emails or changing orders (excessive agency, LLM06).

The chat widget is also third-party code on your site; our website security basics guide covers keeping that kind of add-on in check.

Logging, monitoring and costs

Keep conversation logs for long enough to review them, and say so in your privacy information. Read a sample regularly: logs show wrong answers, gaps in your content and attempts at misuse.

Most model vendors charge by usage. OWASP lists unbounded consumption (LLM10) as a risk, because heavy or abusive use can push costs up. Set rate limits per visitor and spending limits or alerts in the vendor account.

Pre-launch checklist

• Written scope: what the bot does and must not do.
• Answers come from approved, current content; prices and policies link to their pages.
• Tested with real questions, edge cases and attempts to break it.
• DPIA done or the decision documented; privacy policy updated; vendor data terms checked.
• AI disclosure shown at the start of the chat.
• Clear handover to a person, with contact details always visible.
• Least-privilege access, no secrets in prompts, human approval for risky actions.
• Logs reviewed, rate and spending limits set.

Launching a whole site at the same time? Use our general website launch checklist as well.

Frequently asked questions

Is a business responsible for what its website chatbot says?

It is safest to assume so. In Moffatt v. Air Canada (2024), a British Columbia tribunal rejected the argument that the chatbot was responsible for its own actions, said it makes no difference whether information comes from a static page or a chatbot, and found the airline had not taken reasonable care to make sure its chatbot was accurate.

Do I have to tell visitors they are chatting with AI?

In the EU, Article 50 of the AI Act requires AI systems that interact directly with people to be designed so that people are informed they are interacting with AI, unless it is obvious, at the latest at the first interaction. This applies from 2 August 2026; the 2026 Digital Omnibus on AI amendments did not move that date. Showing a short notice at the start of the chat is simple anywhere.

Do I need a DPIA for a website chatbot?

The ICO says that in the vast majority of cases, using AI will involve processing likely to result in a high risk to individuals, which requires a data protection impact assessment. If you conclude your use is not high risk, you still need to document how you made that assessment.

What is prompt injection?

Input that makes a language model behave in ways you did not intend, either typed directly by a user or hidden in content the model reads. OWASP ranks it first in its Top 10 for LLM applications and says there may be no fool-proof prevention, so limit what the chatbot can access and require human approval for risky actions.

When should a chatbot hand over to a person?

When the customer asks for one, for complaints, refunds, cancellations and anything involving money or account changes, and when the bot cannot find an answer in your content. Pass the conversation to the person taking over and keep other contact options visible on the site.

Planning a chatbot or another feature that connects to your systems? See how we approach web app development, see all our services, or email info@creahive.com.