Chatbot terms for a website

A chatbot on a website makes statements in the business's name to anyone who asks, collects whatever they type, and cannot tell when the person on the other end is in difficulty. The terms say that the chatbot is automated, what it can and cannot commit the business to, that its answers are information rather than advice, what happens to the conversation, how a person reaches a human, and how the terms sit with the website terms and the privacy notice; the supplier agreement behind the chatbot has to match. For £595, fixed, with delivery in five working days, I draft or review the agreement's AI provisions.

Who this is for

Businesses in England and Wales with a chatbot or AI assistant on their website or in their app, whether a support bot, a sales assistant or a tool that answers questions about the business's services.

What matters in chatbot terms

The chatbot as part of the website terms and the notice it must give

The chatbot terms sit within the website terms (or are presented at the start of the first conversation) and begin with the notice the law expects: that the user is interacting with an automated tool, who operates it, what it is for, that a person can be reached and how, and where the privacy notice is; the Digital Markets, Competition and Consumers Act 2024 treats misleading a consumer about the nature of a service as an unfair practice, the UK GDPR requires transparency about the processing of what the user types, and a chatbot with a human name and a photograph that denies being a bot is the complaint the notice prevents.

What the chatbot can and cannot commit the business to

The terms state that the chatbot provides information from the business's published materials, that it cannot enter into contracts, vary the business's terms, agree refunds, discounts or exceptions, or make commitments on the business's behalf, that any order or booking made through the chatbot is subject to the business's ordinary terms and confirmation, and that the business's published terms prevail over anything the chatbot says; the statements help but do not undo a representation a consumer relied on (a court abroad held an airline to a refund policy its chatbot invented), so the chatbot is also configured to answer only from the approved knowledge base and to escalate anything it is not permitted to decide.

The no-advice statement and the chatbot that answers anyway

The terms state that the chatbot's answers are general information and not advice (legal, financial, medical, technical, or professional advice of any kind), that they may be inaccurate or out of date, that the user should verify anything they intend to rely on and obtain advice where their situation needs it, and that the business does not accept liability for reliance on the chatbot's answers to the extent the law allows; for consumers the Consumer Rights Act 2015 prevents excluding the statutory rights and the courts will not enforce an unfair term, so the statement is drafted to be accurate about what the chatbot is rather than a blanket exclusion, and where the business is regulated the chatbot is kept away from regulated advice altogether.

Data, conversations and the privacy notice the chatbot links to

the UK GDPR treats personal data entered into an AI tool as processing, requiring a lawful basis, a notice to the people concerned, a data processing agreement with the provider under Article 28 and an impact assessment under Article 35 where the use affects individuals, and everything a user types into the chatbot is collected, sent to the chatbot provider, stored and often reviewed; the terms link to the privacy notice (which describes the chatbot, the provider, the retention and the transfers), tell the user not to enter payment card details, passwords or special category data unless the chatbot is designed for them, state that conversations may be reviewed to improve the service, and where the chatbot stores information on the device, the cookie consent under regulation 6 of the Privacy and Electronic Communications (EC Directive) Regulations 2003 applies to it.

Vulnerable users, complaints and the route to a person

The terms state how a user reaches a person (the channel, the hours, the response time), that complaints are handled by a person under the business's complaints procedure rather than by the chatbot, and that the chatbot will hand over or direct the user elsewhere where it detects distress, an emergency or a matter it is not designed for; the sector regulators expect businesses to identify and respond to vulnerability, which a chatbot cannot do, and the terms and the configuration together make sure the chatbot is the front door and not the only door; the Data (Use and Access) Act 2025 amended Article 22 of the UK GDPR so that a solely automated decision with legal or similarly significant effects is lawful outside special category data only with the safeguards of information, representations, human intervention and the right to contest, and the chatbot is not permitted to take such decisions.

The supplier, the knowledge base and the terms behind the chatbot

The chatbot provider's agreement with the business must match what the terms promise: the knowledge base the chatbot answers from and the controls that keep it there, the exclusion of training on the business's and its users' data, the retention and deletion of conversations, the data processing agreement and the transfers, the testing and monitoring the provider supports, the provider's liability for the chatbot's failures, and the business's right to switch it off; the provider's terms govern whether inputs feed the training or improvement of its models and for how long they are retained, business tiers generally excluding training and consumer tiers generally permitting it, and the AI supplier review service in this series covers the provider's terms where the business wants them checked.

What it costs

AI provisions in a contract, £595. Review or draft AI-specific terms in a supply or customer agreement. Five working days.

AI use policy, £995. Internal policy plus the accompanying contract provisions. Five working days.

Email me at geoffrey@caesar.co.uk with what you need and any documents, and I will confirm the scope and the fee in writing, usually the same working day.

What you get

• An internal AI use policy your staff will follow, rather than a document that bans everything and is quietly ignored
• Contract provisions covering output ownership, training data, confidentiality and liability
• A defensible position to give customers who ask what your AI governance looks like
• Review of your AI suppliers' terms, including what they reserve the right to change
• Practical guidance on what to permit, what to restrict and what to prohibit outright
• One round of amendments

What is not included

• Technical AI assurance, model testing or bias auditing
• Sector-specific regulatory approval
• Advice on non-UK regulatory regimes beyond flagging where they apply
• Ongoing regulatory monitoring

Questions I am often asked

Does our chatbot have to say it is a bot?

It does, at the start of the conversation and on request, with the operator named and a route to a person given. Misleading a consumer about the nature of a service is an unfair practice.

Are we bound by what the chatbot tells customers?

Possibly, if a customer relied on it. The terms say the chatbot cannot commit the business and that the published terms prevail, and the chatbot is configured to answer only from the approved knowledge base and to escalate what it may not decide. Both are needed.

What should the terms say about the data people type in?

Link to the privacy notice describing the chatbot, the provider, retention and transfers; tell users not to enter card details, passwords or sensitive data; say conversations may be reviewed. The provider's agreement must match.

Related guidance and services

• AI contracts and AI use policies, £595, the service this page describes
• SaaS and technology contracts, £995
• Data protection agreements and privacy terms, £795
• AI use policy for a customer service team
• Reviewing an AI vendor's terms for a customer service tool

This page is general guidance for businesses in England and Wales, not advice on your own circumstances. Last reviewed: October 2026. Email geoffrey@caesar.co.uk.