Adding AI to a small website responsibly

It has never been easier to connect a website to a large language model. The companies behind Claude, ChatGPT and Gemini all offer APIs, which let your site send a question to their model and show the answer to a visitor.

The hard part isn’t the connection. It’s making sure the feature is honest, affordable, accurate and kind to the people using it. This note covers what we check before adding AI to a client’s site.

Start with a real job

An AI feature should do something a person currently does slowly or badly. Good candidates include a search that understands everyday wording, a helper that answers from your own FAQs, or a tool that summarises messy enquiries for your team.

“Everyone has a chatbot now” isn’t a job. If a clear FAQ page or a better contact form would do the same work, build that instead. It’s cheaper, lighter and easier to keep right.

Privacy comes first

Whatever a visitor types into an AI feature is sent to a third-party provider, usually overseas. Under the Australian Privacy Act, organisations covered by the Australian Privacy Principles need to be open about how they handle personal information, including when it’s disclosed overseas. Even if a small business exemption applies to you, your visitors still deserve to know where their words go.

The Office of the Australian Information Commissioner has published guidance on privacy and commercially available AI products. For a website, the practical points are straightforward:

• Tell visitors plainly, next to the feature, that it’s automated and what happens to what they type.
• Update your privacy policy to name the provider and explain the overseas disclosure.
• Ask visitors not to enter sensitive details, and don’t design features that invite them to.
• Check the provider’s terms on whether your data is kept or used to train models; terms often differ between free and paid plans.
• Keep logs only as long as you need them, and know who can see them.

Changes passed in late 2024 also add new privacy policy requirements for organisations that use automated decision-making in ways that significantly affect people, starting in December 2026. If your feature does more than answer questions, get advice early.

Cost: pay for what’s used

AI APIs are billed by usage, roughly in proportion to how much text goes in and comes out. That’s fair for small sites with modest traffic, but it can surprise you: a feature that sends a long document with every question, or one hit by bots, can cost far more than expected.

• Set a monthly spending cap or alert where the provider offers one.
• Send the model only the content it needs, not your whole site.
• Protect the feature from automated abuse, for example with rate limits.
• Start with a smaller, cheaper model and move up only if the answers aren’t good enough.

Accuracy and handing over to a person

Language models can give fluent, confident answers that are wrong. For a council, school or community service, a wrong answer about eligibility, fees or opening hours can do real harm.

We reduce that risk by having the assistant answer only from content you’ve written and approved, and by having it say “I don’t know” rather than guess. Just as important is a clear way out: a link to contact a person, a phone number, or an option to pass the conversation to your team. Nobody should get stuck in a loop with a machine.

Someone on your team also needs to own the feature: checking answers now and then, updating the source content, and switching it off if it misbehaves.

Load it only when it’s used

Many chat widgets load large scripts on every page, for every visitor, whether or not anyone opens them. That slows the site down, especially on older phones and patchy connections, and uses more energy on every visit.

A better pattern is to show a small, plain button and load the assistant only when someone clicks it. Everyone else gets the same fast page they had before. It’s the same thinking behind a page-weight budget: if a feature is used by a few visitors, it shouldn’t cost the rest.

The assistant itself needs to be accessible too: usable with a keyboard, readable by screen readers, and clear about when it’s waiting for a reply.

Our rule of thumb

Before adding AI to a site, we want a yes to each of these:

• Does it do a real job better than a simpler option would?
• Are visitors told it’s automated and what happens to their information?
• Is there a spending cap and protection from abuse?
• Can visitors reach a person easily?
• Does it load only when someone uses it?

Where to start

Look at the questions your team answers most often and the searches on your site that come up empty. That’s usually where a small, careful AI feature can help.

If you’d like a hand working out whether it’s worth it, have a look at our automation and AI service, or tell us what you’re working on. We’ll be honest if the answer is a better FAQ.