An AI Chatbot for Your Website: Costs, Data Protection, Effort

Three ways to a chatbot

Before we get to costs: "AI chatbot" can mean three very different things.

RAG (retrieval-augmented generation) means: for every question, the bot first finds the matching sections in your documents and passes them to the language model. The model then answers from those sections instead of from its general knowledge. That way the bot can quote your prices, opening hours or product data, and you can tell it to show the source. More on the term language model (LLM).

What does running it cost?

Language models are billed by tokens, roughly parts of words. So a conversation costs: the tokens you send (system instructions, retrieved document sections, the conversation so far) times the input price, plus the tokens of the answer times the output price.

A worked example based on an assumption, not a measurement: a conversation with four questions, each with about 3,000 input tokens (most of them retrieved sections) and a 300-token answer. That makes 12,000 input tokens and 1,200 output tokens per conversation. The calculation uses list prices without caching, batch discounts or VAT. Longer conversations, more retrieved sections or a different model change the result directly.

The prices behind it: Claude Haiku 5.5 costs $0.10 per million input tokens and $0.50 per million output tokens (for requests up to 100,000 tokens; above that a higher price applies), Claude Sonnet 5.5 $2 and $10 (Anthropic), Mistral Large $0.50 and $1.50 (Mistral), each checked on 13 November 2026. Prices change; check them before you plan. Caching the system instructions, which are the same every time, makes it cheaper still.

What the example shows: for a website with a few hundred conversations a month, model costs hardly matter. The choice of model decides the quality of the answers, not your budget. Smaller items come on top: hosting for the interface and the search index, possibly a vector database, and logging.

What do building and maintenance cost?

Most of the effort is not in the code, but here:

• Preparing the content. The bot is only as good as the documents it answers from. Outdated PDFs, duplicate pages and conflicting prices lead to conflicting answers.
• Testing the answers. You need a list of real questions with the expected answers, and you check the bot against it after every change. These are called evals. Without them, you only find out something broke from complaints.
• Setting limits. What should the bot not answer? Legal questions, prices for special cases, complaints? For those it needs a clean handover to a person.
• Maintenance. New products, changed prices, new model versions: every change needs a short test run.

Data protection and the AI Act

This applies to the approaches with an external provider, the widget and the API. With a local model there is no transfer to a model provider; the rest still applies.

1. Sign a data processing agreement

   The provider processes your visitors' messages on your behalf. That requires a contract under Art. 28 GDPR, which the large providers offer as a Data Processing Addendum (DPA) you can sign in your account.

2. Check storage location, third-country transfers and training

   Since February 2025, OpenAI has offered data residency in Europe for new API projects. Claude models are available through Amazon Bedrock and Google Cloud with regional endpoints, at a 10% premium over global endpoints according to Anthropic. Mistral is based in France. If data goes to a provider in the US or another third country, the transfer needs a basis under Art. 44 et seq. GDPR: for example the provider's certification under the EU-US Data Privacy Framework, or standard contractual clauses, which are usually part of the DPA. The provider's documents say which one applies. Also check that API data is not used for training; with the large providers, that is the default for the API.

3. Update your privacy policy

   The information duties under Art. 13 GDPR apply to the chat too: which provider, which data, for what purpose, on which legal basis (Art. 6 GDPR), whether data goes to a third country and how long it is stored. If the bot stores conversation histories, set a deletion period and actually delete them afterwards, including in logs and at the provider.

4. Make it clear it is an AI

   Since 2 August 2026, users must be able to tell that they are talking to an AI, unless that is obvious (Art. 50(1) AI Act). The duty lies with the provider of the AI system; if you build the bot yourself, that is usually you. The notice must be clear at the latest at the first interaction. The simplest place for it is the chat window itself. More in the article on the EU AI Act.

5. Don't ask for sensitive data

   The bot should not ask for health data, account numbers or ID details. A note in the chat window helps keep visitors from entering them on their own.

Off-the-shelf widgets often load scripts and set cookies or write to the browser's local storage as soon as the page loads. If that is not strictly necessary for the service the visitor asked for, you need consent first (§ 25 TDDDG, the German telecommunications and digital services data protection act), through your cookie banner before the widget loads. A custom bot can be built so it only starts when someone opens the chat window.

When is a chatbot not worth it?

A chatbot is not always the best answer. Often less is enough:

• Always the same ten questions? A good FAQ page is faster, cheaper and found by search engines.
• Every enquiry is a one-off? A short contact form with the right fields gets you better enquiries than a bot.
• Hardly any visitors? With few conversations a month, building a custom bot rarely pays off. An off-the-shelf widget is enough to test the idea.
• Nobody maintains the content? Then the bot goes out of date and gives wrong answers. Plan for maintenance before you start.

A custom bot is worth it when many questions have to be answered from extensive documents, such as product catalogues, manuals or internal policies, and the answers have to be right.

Conclusion

• Costs: Running it usually costs little; the effort is in content, tests and maintenance.
• Data protection: Data processing agreement, EU storage where possible, privacy policy, AI notice in the chat window.
• Decision: First check whether an FAQ page or a better form is enough. If not: start small, test with real questions, then expand.

This article is not legal advice; it summarises publicly available sources as of 13 November 2026.