AI Chatbot for Your Website: Benefits, Limits, Rules

An AI chatbot or voice assistant answers questions about your business around the clock, based on your own content. It’s worth it when the same questions keep coming in and your answers are properly written down. To run it responsibly, you need three things: a clear AI notice, a sound data protection setup and hard cost limits.

This guide looks at the rules through an EU lens. If your visitors are in the EU, they apply to you too, wherever your company sits.

What an AI chatbot does well today

Modern language models understand everyday questions, typos and all. On a website, they’re mainly good for:

• Answering frequent questions: opening hours, directions, parking, how things work, what to bring.
• Guiding people through your offer: “Which package suits me?” followed by a link to the right page.
• Speaking several languages: a guest asks in English, Italian or Turkish and gets an answer in that language.
• Triaging enquiries: capturing what someone needs and passing it on, including contact details if they agree.

Beyond text chat, there are now live voice models you can talk to almost like on the phone. To see what an AI assistant feels like in a chat, try ours right here: use the “Questions?” button in the bottom right.

What it can’t do, and shouldn’t

A chatbot isn’t a member of staff. It shouldn’t:

• make binding promises, negotiate prices or close contracts
• book appointments unless it’s actually connected to your calendar
• give individual medical, legal or tax advice
• handle complaints where a human should be listening

And it only knows what you give it. If the new price isn’t in its material, it doesn’t know it. A good bot says so plainly and points to your phone number or contact form.

“Trained on your content”: how that actually works

In most cases nobody trains a new model. Instead, an existing language model receives the relevant passages from your material along with each question, and writes its answer from those. The technical term is retrieval-augmented generation, or RAG.

How an answer is built from your content

1. 1QuestionA visitor asks, for example about opening hours.
2. 2Find the right passagesThe system looks up the relevant sections of your material.
3. 3Write the answerThe language model answers only from those passages.
4. 4Answer with a sourceThe answer can be traced – or the bot hands over to your team.

Your material: website copy, FAQs, service descriptions, price lists, terms and processes – no internal documents or customer data.

That has two upsides. You can change your opening hours in a text file without retraining anything. And you can trace which source an answer came from.

What belongs in there:

• your website copy, FAQ, service descriptions
• price lists, terms, processes
• answers to the questions your team hears on the phone every day

What doesn’t: internal documents, customer data, anything you wouldn’t say in public. The rule of thumb is simple: the answers will only be as good as your material.

Keeping it from making things up

Language models can produce answers that sound convincing and are still wrong. You can’t get that to zero, but you can rein it in hard:

1. Answer from sources only: the bot gets a firm instruction to answer exclusively from your material.
2. Allow “I don’t know”: if information is missing, it says so and offers a way to reach you. That beats any guess.
3. Keep the scope narrow: a bakery’s bot doesn’t need opinions on the stock market.
4. Show sources: a link to the relevant page lets visitors check for themselves.
5. Test before launch: we collect real questions, including awkward ones, and check every answer. Again after every major change.
6. Spot-check in production: review conversations in a privacy-friendly way and fill the gaps in your material.

A Canadian case shows why this matters. In 2024, Air Canada was held responsible for wrong fare information its website chatbot gave a customer (Moffatt v. Air Canada, 2024 BCCRT 149). Different country, different law, but the lesson travels well: what your bot says will be treated as what you said.

GDPR: who processes what?

What people type or say into a chat often includes personal data: names, phone numbers, sometimes health details. That brings in the GDPR. The key points:

• Data processors: the AI model provider and your host process data on your behalf. You need a data processing agreement under Article 28 GDPR. The major AI providers offer these to business customers.
• Transfers outside the EU: if the provider is in the US, the transfer needs a legal basis. Since July 2023 there’s the adequacy decision for the EU-US Data Privacy Framework; you can check whether a company is certified at dataprivacyframework.gov. An appeal against the decision is pending before the EU Court of Justice (Case C-703/25 P), so keep an eye on it and use EU data centres where the provider offers them.
• Training on your data: check the contract and settings to see whether the provider uses conversations to train its own models, and switch that off.
• Store little, briefly: keep conversations only as long as you actually need them. Ideally, don’t store voice recordings at all.
• Avoid sensitive data: health data is a special category under Article 9 GDPR. A bot for a medical practice shouldn’t ask about symptoms and should tell people not to send it test results.
• Start on click: the chat only connects to the AI provider when someone deliberately opens it. No data flows before that.
• Update your privacy policy: provider, purpose, retention period, transfers.

In Austria, the Data Protection Authority (Datenschutzbehörde) is the body in charge; elsewhere in the EU, it’s your national authority. This article isn’t legal advice.

The AI notice under Article 50 of the AI Act

The EU’s AI regulation, the AI Act, has largely applied since 2 August 2026 under Article 113, and that includes the transparency duties in Article 50. The “Digital Omnibus” package mainly pushed back deadlines for high-risk systems (European Commission); the disclosure duty for chatbots has applied since August 2026.

Article 50(1) says AI systems that interact directly with people must be designed so that those people are informed they’re dealing with AI, unless that’s obvious from the context. Article 50(5) adds that the information must be clear and distinguishable and come at the latest at the first interaction.

Strictly speaking, paragraph 1 is addressed to the provider of the AI system. Under Article 3, that includes anyone who has a system developed and puts it into service under their own name. So a business that commissions a chatbot for its own website should assume the duty applies. Luckily, meeting it is easy:

• one short line before the first conversation, e.g. “You’re talking to an AI. It can make mistakes.”
• no human name and photo that suggest a real person
• for voice assistants, a spoken notice or a text notice before the start that screen readers can read

On our example site, the notice appears before the microphone even switches on. We do it that way on every project.

Keeping costs under control: limits per conversation and per day

AI providers bill by usage, meaning volume of text or minutes of audio. Voice is usually pricier than text. Without limits, a single automated attacker could run up a nasty bill overnight. So we build in several safeguards:

Lever	What it does
Maximum length per conversation	voice sessions end after a set time, text chats after a set number of messages
Conversations per visitor per day	stops one person from using up the quota; recognised via salted, hashed IP addresses rather than plain IPs
Overall daily cap	a hard ceiling for all conversations, then a friendly pointer to the contact form
Budget alerts at the provider	an email before a monthly limit is reached
Lean context	send only the passages needed, not the whole website
Right-sized model	simple questions don’t need the most expensive model

The assistant on our example site runs with limits like these per conversation, per visitor and per day.

When an AI assistant is worth it

Probably yes if

• your team answers the same questions every day
• many enquiries arrive outside opening hours
• your customers speak several languages
• your offer needs explaining and visitors need help finding their way
• you want to show that your business uses new technology sensibly

Probably not if

• hardly anyone contacts you through your website
• your information isn’t written down anywhere in a usable form yet
• almost every question needs individual advice

In that second case, a well-made FAQ page is often the better first step. It helps visitors immediately, it’s good for search, and it can become the foundation for a bot later.

If you’re wondering whether a chatbot or voice assistant fits your business, have a look at our AI chatbots page. Or use the contact form to tell us which questions keep coming up. We’ll tell you honestly whether a bot makes sense.