An AI chatbot for your website: how to do it right
What it takes to put an assistant on your site that genuinely answers customers: content, model, costs, key security, transparency duties and privacy. Using Lumen's chatbot as the example.
Mattia PanattaUpdated 14 October 202612 minIntermediate
In short
- A good chatbot answers only from what you know (your pages, price lists, FAQs) and cites where answers come from.
- The technical part is the easy part; the real work is content, rules and testing.
- The API key must stay on the server, never in browser code.
- Since 2 August 2026 the chatbot must disclose it’s an AI (AI Act, Art. 50).
What it can (and can’t) do
A site assistant can: answer FAQs, explain services and prices, guide to the right page, collect a contact request, book. It must not: give personalised professional advice, promise what isn’t in your documents, collect sensitive data.
How Lumen’s chatbot is built
I use it as the example because you can try it on this page:
- Site knowledge: all pages are split into sections and indexed when the site is published. When you ask, the model calls a search tool and reads only the relevant passages (RAG, explained in the RAG and embeddings guide).
- Controlled external sources: for fresh news it can search the web, but only four chosen sites.
- Model: a fast, affordable language model from a major provider, with light reasoning to answer quickly.
- Server: a small function (on Vercel or Netlify) receives the question, adds instructions, calls the model and streams the answer word by word. The key stays there.
- Rules: it introduces itself as AI, cites links, doesn’t ask for personal data, refers to a person for specific cases.
The choices to make
The model
A chatbot doesn’t need the most powerful model. What matters is good-enough quality, speed and cost:
| Model | Price per million tokens (in / out) | When |
|---|---|---|
| Claude Haiku 5.5 | $0.10 / $0.50 | Simple questions, high volume |
| Gemini 3.8 Flash | $0.75 / $3.75 | Multimodal, PDFs and images |
| GPT-6.1 Sol | $2 / $10 | High quality, built-in web search |
Prices as of October 2026. A typical answer reads 5-15 thousand tokens (instructions and site passages) and writes a few hundred: from fractions of a cent to a few cents per question.
The content
This is where you win or lose. Before any technology:
- write a real FAQ page with the 30 questions you actually get;
- keep prices and opening hours in one up-to-date place;
- remove outdated information from the site: the chatbot would use it.
The instructions
You are the AI assistant on [business]’s website. Say so if asked and don’t pretend to be a person. Answer only using the site information provided; if you can’t find it, say so and suggest contacting [email/WhatsApp]. Always cite the page the information comes from, with its link. Don’t give personalised [legal/tax/medical] advice: explain the service and invite people to book a consultation. Don’t ask for or store personal data; if the user wants a call back, point them to the contact form. Keep answers short (max 150 words), friendly, in the user’s language.
Security: three non-negotiable rules
- Key on the server. If the API key is in the page code, anyone can copy it and use it at your expense. It goes in the server function’s environment variables.
- Limits. A monthly spending cap in the provider’s dashboard, a per-user message limit, a maximum question length.
- Distrust inputs. Users will try to make it say odd things (“ignore your instructions and…”). Clear instructions, no access to dangerous tools (no sending emails or database access without checks), and testing before going live.
Legal duties
- Transparency (AI Act, Art. 50): people chatting must know they’re talking to an AI. A clear welcome message and a fixed note under the input box are enough.
- Privacy (GDPR): a notice explaining what data goes to the model provider, how long it’s kept, on which legal basis. Better not to store conversations, or only anonymously.
- Professionals in Italy: if it’s a firm’s chatbot, remember the AI-use notice under Law 132/2025 too.
Before publishing: the test
Prepare 30 real questions, including hard and “trick” ones (off-topic, provocative, with personal data). Check that the chatbot answers correctly, cites the source, says “I don’t know” when needed, and stays within its rules. Repeat the test after every significant change.
Want a chatbot like this on your site?
It’s exactly the “AI-powered website” package I build for professionals and small businesses, with a monthly care plan if you’d like me to look after it. Prices and details on the Websites page.
Sources
Informational content, current as of the date shown. Prices, models and rules change often: always check official sources. Written with the support of AI tools and reviewed by the author.
