AI in customer emails, chats and documents: policy points

Use AI with customers only for jobs the policy names. Read everything before it's sent. And never let a customer think they're talking to a person when they're not.

Two very different uses

Customer-facing AI comes in two forms, and the rules differ.

The first is a drafting aid. The person who sends it owns it. The second puts the tool itself in the conversation, and that needs more care.

Telling customers

Australia's privacy regulator wants chatbots that face the public to be labelled as AI.¹ It also wants people told when they're dealing with a machine instead of a human.¹ The National AI Centre offers a plain example: a customer getting guidance from a chatbot should know it isn't a human specialist.²

Those are Australian sources. Disclosure rules can differ by country, and some industries add their own. Look at the consumer and privacy regulator where you trade: the ACCC and OAIC in Australia, the FTC in the United States, the ICO in the UK. This isn't legal advice.

For drafts a staff member has read and sent, a policy can choose either way. You might not mention it for a tidied-up email, but say so when a document was mainly AI-written. Whatever you choose, apply it the same way each time, and never claim something was written by a person if it wasn't.

Rules worth writing down

• Name the allowed jobs. For example: first drafts of routine replies, summaries of a customer's own message, rewording for clarity.
• Name the banned jobs. For example: decisions about a person, refunds or complaints outcomes, legal or medical statements, and anything with a promise or a price.
• Read before sending. Every word, every time. See the checking rule.
• No personal details in the tool unless the approved list says that tool may take them. A separate page lists what to hold back.
• Don't invent. Staff must not let a tool make up names, quotes, reviews or experience, and must not present them as real.

If you run a chatbot

The regulator advises careful testing of any chatbot before customers use it.¹ The National AI Centre calls a chatbot low-risk when it answers simple questions in business hours and a staff member can monitor it. It says risks grow if the bot runs all day and night, unwatched, and takes on harder questions.²

A small policy for a chatbot can set:

• the topics it may answer, and a hand-off to a person for the rest
• a visible label saying it's an AI assistant
• who reads its conversations, and how often
• a clear way for the customer to reach a human

The UK's cyber security centre warns that such tools can be coaxed into toxic content and are prone to prompt injection attacks.³ In plain terms, a customer, or someone posing as one, may try to push the bot off script. That's another reason to keep it to narrow topics and review its chats.

When it goes wrong

The same centre lists wrong answers stated as fact among the tools' flaws.³ When that reaches a customer, the policy should tell staff to correct it quickly, tell the owner, and note it down. Keep the tone plain and honest with the customer.

Sample wording

"We may use AI tools to help draft messages. A staff member reads and approves everything before it's sent. Chatbots on our site are labelled as AI and pass anything complex to a person. We don't use AI to decide complaints, refunds or anything about an individual's rights."

Adjust it to fit what you really do. If the wording promises a check, make sure someone really does it.