Using AI safely
What to check before putting an AI chatbot on your website
An AI chatbot can answer common questions at any hour and take load off a small team. It can also confidently tell a customer something untrue about your prices, refunds or services, and you may be held to it. A little planning keeps the benefits without the embarrassing screenshots.
The short version
Before you launch
- Limit it to your own approved content.
- Decide what it must never promise.
- Make it easy to reach a person.
- Test it with tricky questions, and keep testing.
You’re responsible for what it says
Businesses are generally responsible for statements made on their website, including by a chatbot. In a widely reported 2024 Canadian case, a tribunal held an airline responsible for incorrect refund information its chatbot gave a customer. In Australia, misleading statements about prices, refunds or consumer guarantees can raise issues under the Australian Consumer Law. Plan on the basis that the chatbot speaks for you.
The questions to answer
What will it know?
The safest chatbots answer from your own approved content, like your FAQs, service pages and policies, rather than the open internet. Ask your provider how to restrict it, and keep that content up to date.
What must it never do?
Write a short list. For example:
- Promise discounts, refunds, timeframes or outcomes
- Give legal, financial, medical or safety advice
- Make claims about certifications, awards or guarantees
- Collect payment details
When does it hand over to a person?
Make it easy to reach a human for complaints, complex questions, or when the customer asks. Tell customers clearly how and when they’ll hear back.
Is it clear it’s AI?
Label it so customers know they’re talking to an automated assistant.
Privacy
- Customers may type personal information into a chatbot. Know where conversations are stored, for how long, and whether the provider uses them to train models.
- Update your privacy policy to mention the chatbot.
- Don’t ask for more personal information than you need.
- The OAIC’s guidance on commercially available AI products applies here.
Security
- Prompt injection: people may try to make the chatbot ignore its instructions or reveal information. Don’t connect it to systems or data it doesn’t need.
- Keep admin access to the chatbot platform protected with MFA.
- Review what integrations it has, like your CRM, booking system or email, and limit their permissions.
Test it like a difficult customer
Before launch, ask it about refunds, prices, competitors, complaints, things you don’t sell, and attempts to make it misbehave. Note every wrong or risky answer and fix the content or settings. Then repeat after every change.
After launch
- Read a sample of conversations every week at first.
- Track questions it can’t answer, and add good content for them.
- Keep a quick way to switch it off if something goes wrong.
Common questions
Will a chatbot replace our customer service team?
For simple, repetitive questions it can help a lot. Complaints, judgement calls and relationships still need people.
Can it book appointments or take orders?
Many can, through integrations. Start simple, and add actions once you trust its answers.
What if it gives a wrong answer to a customer?
Correct it with the customer promptly, honour reasonable expectations it created, and fix the underlying content so it doesn’t happen again.
Sources
This guide is general information, not legal or financial advice. If you think you’ve lost money or personal information, contact your bank and the services named above straight away.
Keep reading
Related help
Talk to NovaSoft
Want a hand with this at work?
These guides are free to use. If your business wants help putting the checks, accounts and devices in place, our team can do it with you.