An AI chatbot for business website visitors works best as a narrow, well-tested assistant: it answers questions from your own policies, product pages and help articles, shows where each answer came from, and passes the conversation to a person when it is not sure. It goes wrong when it is allowed to improvise about prices, refunds or anything with legal weight. Before building one, check whether a better FAQ page or site search would solve the same problem for less.
What kinds of website chatbot are there?
There are four common types, and they carry very different risks. Only two of them can invent an answer.
| Type | How it answers | Can it make things up? | Good for |
|---|---|---|---|
| Rules-based (buttons, decision tree) | Scripted paths you write | No | Routing, booking requests, lead qualification |
| FAQ search | Matches the question to answers you wrote | No, it returns your text | Sites with a stable set of common questions |
| Language model with retrieval (RAG) | Writes an answer from passages retrieved from your content | Yes, less often and in a checkable way | Large help centers, catalogs, policy questions |
| Language model agent with tools | Also calls your systems: order status, bookings, account changes | Yes, and it can act on its mistakes | Support with clear, limited actions |
The third type is what most people now mean by an AI customer support chatbot. It relies on retrieval-augmented generation, which our guide to RAG for business leaders explains in plain terms.
When is an AI chatbot worth it, and when is FAQ or search enough?
An AI chatbot is worth it when questions are varied, the answers already exist in your content, and enough people ask that they are waiting for replies. It is not worth it when a handful of questions make up most of your enquiries.
A quick test: export three months of contact-form messages, emails and chat transcripts, and tag each by question. If 15-20 questions cover most of them, write those answers clearly on the site, improve site search, and add a button menu to the chat widget. That approach never invents anything and costs little to run.
An AI chatbot earns its place when:
- there is a long tail of questions that no FAQ page could list;
- answers are spread across many documents, such as manuals, spec sheets and policies;
- demand arrives outside office hours or across time zones;
- visitors ask in several languages.
What can go wrong with an AI chatbot?
It can state wrong information confidently, be manipulated by users, and reveal data it should never have seen. Your business is accountable for all three.
- Hallucination. Language models produce plausible text; without grounding, they will happily invent a refund policy or a discount. In Moffatt v. Air Canada (2024), British Columbia's Civil Resolution Tribunal held the airline responsible for incorrect bereavement-fare information its website chatbot gave a customer, and rejected the argument that the chatbot was responsible for its own statements.
- Prompt injection. Users, or text hidden in pages the bot reads, can instruct the model to ignore its rules. OWASP's Top 10 for Large Language Model Applications puts prompt injection first. Assume someone will try to make your bot say something embarrassing or promise something free.
- Over-permissioned tools. A bot that can issue refunds or change bookings needs the limits you would give a new employee: maximum amounts, confirmation steps and logs.
- Data leakage. If internal documents sit in the bot's knowledge base, it can quote them to the public.
How do you test a chatbot before launch?
With a written test set of real questions and expected answers, scored before launch and again after every change to the prompt, the documents or the model.
- Collect 100-200 real questions from your inbox and chat logs, including the awkward ones.
- For each, write the correct answer and its source document, or mark it "should hand off to a person".
- Add hostile cases: demands for discounts, questions about competitors, requests for medical or legal advice, attempts to override instructions, abuse, other languages.
- Score each response as correct with source, safely declined, or wrong. On prices and policies, the target for wrong answers is zero.
- Re-run the whole set whenever the model, prompt or content changes. Providers update models, and behavior drifts.
- After launch, review a sample of real conversations every week and add each failure to the test set.
The test set is the most valuable part of the project. It tells you whether the bot is ready, and it lets you change models later without guessing.
How do you handle data privacy and security?
Treat the chatbot as a new supplier that processes customer data: know what it collects, where it goes, how long it is kept, and tell visitors.
- Read the AI provider's API data terms. Major providers' business and API terms generally say inputs are not used to train models by default, but retention periods, abuse-monitoring logs and processing regions differ. Azure OpenAI, Amazon Bedrock and Google Vertex AI let you choose where models run.
- Update your privacy notice, and put a data processing agreement in place where GDPR, UK GDPR or similar laws apply. If you serve UK customers, our UK page covers the wider rules on data and consent.
- Do not invite card numbers, passwords or health details in chat, and mask them if someone types them anyway.
- Say clearly that visitors are talking to an AI, and show a route to a person. The EU AI Act includes transparency duties for AI systems that interact with people, and customers everywhere react badly to finding out afterwards.
- Keep transcripts for quality review, with a set retention period.
The chat widget is also part of your site's attack surface, so it belongs in the same review as the rest of the website security checklist.
What does an AI chatbot for business website support cost?
There are two costs: building it, and running it every month. Neither is fixed, so ask for both.
Off-the-shelf AI agents inside help desk software, such as Intercom Fin, Zendesk's AI agents, Freshdesk's Freddy AI or Tidio's Lyro, are usually priced per resolution, per conversation or per seat. They are quick to switch on if your help center is already good, and a weak option if it is not.
A custom build makes sense when answers depend on your own systems (order status, stock, bookings), when you need control over where data is processed, or when the same assistant must work on the website, WhatsApp and inside a customer portal. Running costs are mainly model usage, billed per token, and grow with traffic and the amount of retrieved text sent with each question. Set a monthly cap and alerts from day one.
What should a launch checklist include?
- Scope: the topics it handles; everything else hands off.
- Sources: the documents it may use, an owner for each, and a review date.
- Handoff: live chat, WhatsApp, email or a callback form, with the transcript passed along so the customer does not repeat themselves.
- Opening message: states that it is an AI assistant and what it can help with.
- Limits: no prices, promises or exceptions unless they appear in the sources; no actions without confirmation.
- Monitoring: weekly transcript review, a feedback button and cost alerts.
- Off switch: one setting that disables the bot and shows a contact form instead.
How Meritbyte Technologies builds website chatbots
Meritbyte Technologies is a Nepal-based web and software development company with an AI development practice. When a client asks for a chatbot, our first question is what their inbox says. Sometimes the right answer is a rewritten FAQ and better search, and we say so.
When a chatbot is the right tool, we write the test set with your team before building the bot, ground it in content you approve, and put it on a staging URL your staff can try before any customer sees it. The first milestone is fixed price, model and API accounts are in your name, and the widget sits inside the site our web development team maintains, not in a separate system nobody owns.
Frequently asked questions
Will an AI chatbot replace my customer support staff?
Usually not. A well-built chatbot can take repetitive questions such as opening hours, delivery times or password resets, which frees staff for conversations that need judgment. It cannot own complaints, exceptions or anything that requires authority to bend a rule. Plan for fewer routine messages and faster replies, not an empty support inbox.
Can an AI chatbot give customers wrong answers?
Yes. Even grounded in your documents, a language model can misread a passage, merge two policies, or answer when it should decline. Reduce the risk by limiting it to approved content, requiring citations, instructing it to hand off when unsure, testing it against real questions and reviewing transcripts. Your business remains responsible for what it says.
Do I have to tell visitors they are talking to an AI?
In the EU, the AI Act includes transparency duties for systems that interact with people, and consumer protection laws in many countries penalize misleading customers. Beyond the law, it is simply good practice: label the assistant clearly in its first message and give an obvious way to reach a person. Check current guidance for each market you serve.
How long does it take to build a custom website chatbot?
A focused chatbot grounded in an existing help center can reach a tested pilot in a few weeks. Most of that time goes into cleaning source content and building the test set, not writing code. Each connection to an order, booking or CRM system adds time, plus the permission rules and confirmation steps that every action needs.