An AI chatbot for your website: when it helps and when it hurts

What an AI chatbot on your website can do

Modern website chatbots run on large language models and answer from your own content: website, FAQ, price list, manuals. The method is called RAG (retrieval-augmented generation): the bot first looks up relevant passages in your documents, then writes an answer from them.

Is a chatbot worth it for you?

A good test before you buy: collect every question that comes in by email, phone and form for a week. If most can be answered from your website, a bot can help. If not, fix the website first.

Tools and costs

As of Nov 11, 2026 per vendor pricing pages, excluding tax. Expect usage limits (messages, conversations, outcomes): costs rise with success.

“Try” links are affiliate links (advertising): I earn a commission at no extra cost to you.

How to work out the cost

Divide the monthly cost by the conversations the bot actually resolves without a person stepping in. Compare that with what an email reply costs you in time. Include upkeep: someone has to keep content current and read conversation logs, or quality slowly drops.

How to build a bot that doesn’t get it wrong

The bot’s instructions

• Only from your sources: if the answer isn’t in the content, the bot says so and offers contact.
• No commitments: no prices, discounts, deadlines or legal advice that isn’t verbatim in the sources.
• Show the source: the bot links the page the answer comes from.
• Handover: complaints, contract questions and uncertainty go to a person.
• Tone: your voice, short, friendly, no marketing speak.

My rule of thumb: a person signs off on what the AI says to the outside world. For a chatbot that means test questions before launch, spot checks every week and a clear rule for when the bot hands over.

The rules: AI Act, GDPR and liability

EU AI Act: tell people they’re talking to an AI

Article 50(1) of the AI Act requires that people who interact directly with an AI system are informed of it, unless that’s obvious to a reasonably informed person. It applies from August 2, 2026. The duty sits with the provider of the system; as the operator on your website, the simplest route is a visible notice in the chat window yourself.

GDPR: data in the chat

• Processor agreement: the chatbot vendor processes data on your behalf; you need a contract under Art. 28 GDPR.
• Data location: ask the vendor where conversations are processed and stored. Transfers outside the EEA fall under Chapter V of the GDPR.
• Notice: the chatbot belongs in your privacy policy (Art. 13 GDPR): what’s stored, for how long, for what.
• Cookies and tracking: if the widget sets cookies or reads device data that isn’t strictly necessary, EU ePrivacy rules (in Germany § 25 TDDDG) require consent before it loads.
• Data minimisation: ask only for what you need. Don’t collect health or financial data in chat.

Liability for wrong answers

In Moffatt v. Air Canada (2024), the airline’s website chatbot told a customer about a refund rule that didn’t apply as stated. Air Canada argued the chatbot was a separate legal entity responsible for its own actions. The British Columbia tribunal rejected that: the bot is part of the website, and the company is responsible for what it says. The case is Canadian; the lesson applies everywhere: what your bot says, you say.

Winning leads with a chatbot without being annoying

• Help first, then ask: request contact details only once the person has a reason to give them (quote, callback, appointment).
• Few fields: name, email, request. More only if really needed.
• No marketing without consent: asking a question in chat isn’t newsletter consent. Marketing email needs its own consent, ideally with double opt-in.
• Fast handover: a lead who waits two days for a reply has gone cold.
• No forced pop-ups: a chat window that opens on every page view annoys more than it helps.

Typical failure modes

Checklist before launch

• Content checked and maintained in one place
• Instructions: sources only, no commitments, source links, handover
• 30 test questions passed with expected answers
• Visible notice in the chat window that an AI is answering
• Processor agreement signed, privacy policy updated
• Widget loads only after consent if it sets non-essential cookies
• Handover to people tested, response time agreed
• Weekly review of conversation logs in the calendar

Metrics

Off-the-shelf tool or build your own?

For most websites, an off-the-shelf tool is the right start. Building your own only pays once you know exactly what the bot should do and have someone to look after it long-term.

Good and bad answers compared

The good answers share three things: they rely on a source, they promise nothing that isn’t there, and they hand over when money, contracts or complaints are involved.

The first 30 days

A gradual start protects you from the most common problem: a bot on every page before anyone knows what it answers. After 30 days you have enough real conversations to decide whether it stays. Switching it off is a legitimate outcome: if the bot creates more rework than it saves, the contact form is the better solution.

12 prompts for planning, building and checking

Here are the enquiries from the last few weeks by email, phone and form: [list]. Group them by topic, count frequency and mark which can be answered from my website and which can’t.

Here’s the text of my website: [texts]. Find contradictions, outdated information and gaps a chatbot would answer wrongly. List them with location.

From this content [texts], write 20 FAQ entries with short, unambiguous answers. Nothing that isn’t in the texts; mark gaps as [missing].

Write system instructions for a website chatbot for [company]: tone [formal/informal], answer only from the provided sources, link the source, make no commitments on prices, deadlines or goodwill, hand over complaints and uncertainty to [contact route].

Write 30 test questions for my chatbot: 20 typical questions, 5 trick questions whose answer isn’t in the sources, and 5 where the bot must hand over to a person. Include the expected behaviour.

Write a short notice for the chat window saying an AI is answering and can make mistakes, with a link to the privacy policy and a route to a person. Max 2 sentences.

Draft a privacy-policy section for the chatbot: vendor [name], which data, purpose, legal basis, retention, recipients, transfers outside the EEA [yes/no]. As a draft for my privacy adviser.

Design a conversation flow where the bot first answers the question and only then offers to arrange a callback or quote. Max three questions, only name, email and request.

Here are 50 chat logs from last week: [logs]. Find wrong or shaky answers, frequent questions without a good answer, and conversations that should have been handed over sooner.

The bot didn’t answer these well: [list]. For each, suggest a short text for my website that closes the gap. I’ll mark facts as [check] myself.

Work it out: the tool costs [amount] a month at [limit], I expect [number] conversations, of which [share] resolved without a person. An email reply costs me [minutes]. Is it worth it? Show conservative, realistic and optimistic.

Compare these chatbot vendors for [company, size, sector]: [vendors]. Criteria: price at my volume, human handover, source links, processor agreement available, data location per the vendor. List what I must ask the vendor directly.

The most common mistakes

1. Bot before content. Without clean sources, even the best bot answers wrongly.
2. No AI notice. Required in the EU since August 2, 2026 under Article 50 of the AI Act, unless it’s obvious.
3. Allowing commitments. What the bot promises, you may have to honour.
4. No handover. Visitors who get stuck leave.
5. Loading the widget without consent. If it sets non-essential cookies, consent is needed first.
6. Set and forget. Without weekly spot checks, quality drops without you noticing.