AI Chatbots for Singapore Business Websites: Uses, Risks and the PDPA

An AI chatbot is worth adding to a Singapore business website when visitors ask many questions whose answers are already written down, and someone will keep that content current and take over when the bot cannot help. It should answer only from your own pages, say when it does not know, and tell people they are talking to AI. Under the PDPA, you stay responsible for what visitors type into it, including when an AI provider overseas processes the chats.

For a handful of repeat questions, a clear FAQ page or WhatsApp is often the better choice. We add assistants and smart search to the AI-powered websites we build, and this guide covers what we check before recommending one.

Last checked: 15 October 2026, on the PDPC, IMDA, AI Verify Foundation, MOH, MAS, Enterprise Singapore and IRAS websites. Where we interpret a rule we say it is our reading. This is not legal advice, so confirm with the authority or your adviser before you rely on it.

What can an AI chatbot do on a Singapore business website?

An open-ended chatbot answers from whatever its language model learned in training, so it will talk about anything. A grounded chatbot first searches your own pages and documents, then answers only from what it found. For a business website, build the grounded kind, because you can check where every answer came from.

Even grounded, a chatbot suits some jobs far better than others:

Job on your website	Good fit?	What to watch
Answer questions about services, hours, outlets and policies	Yes	The pages it reads must be current
Find the right passage in long manuals, product sheets or terms	Yes, this is where it beats a FAQ page	Link each answer to its source page
Take enquiry details after hours and pass them to staff	Yes, with a handover	A PDPA notice before it asks for details
Quote fees or prices	Only if they are published on your site and current	A wrong figure turns into a dispute
Confirm bookings, refunds or exceptions	Only if it is connected to your booking or order system	Promises it makes on your behalf
Medical, legal, financial or safety advice	No	Hand over to a qualified person
Chat about anything unrelated to your business	No	It should decline and stay on topic

Why do AI chatbots make things up, and how does grounding help?

IMDA’s chatbot guidelines describe hallucinations as instances where the chatbot generates false or misleading information that it presents confidently as fact. A language model writes the most likely next words, so when it has no source to work from it can give a confident answer that is wrong.

Grounding, often called retrieval-augmented generation or RAG, narrows what the model works from:

Grounding reduces the risk but does not remove it. IMDA’s Starter Kit for Testing LLM-Based Applications (version 1.0, January 2026) notes that an app can give a correct answer even after retrieving the wrong documents, and recommends testing off-topic questions, where the right response is a refusal or a set fallback message.

We applied the same thinking to the optional AI summary in our own analytics dashboard, which only our team can use and which stays off unless it is configured. It sends the model only aggregated statistics, such as totals and breakdowns by channel, page, country and device, plus the question typed in, never enquiry contents or anyone’s details. Its instructions tell it to use only the numbers given, never invent data and say plainly when the data is too thin to conclude anything. A website chatbot needs the same kind of limits, written down before it goes live.

What does a website chatbot need from you?

Most of the work that decides whether a chatbot helps sits with the business, not with the AI model.

• Answers written on your pages. A grounded chatbot is built to answer only from what you have published. If customers ask about parking, warranty claims or lead times and your site is silent, write those answers first. Clear pages also help AI search tools describe your business, which our free AI search readiness checker can check.
• A person to hand over to. Decide when a person takes over, through which channel (a call back, email or WhatsApp) and what the bot passes on, so the customer does not have to repeat themselves. Outside office hours, the bot should say when someone will reply.
• An update routine. Name one person who owns the content. When a fee, policy or opening hour changes, update the page first and check the chatbot picks it up. Each month, turn the questions it could not answer into page content.
• A test set before launch. Use real questions from your emails, calls and WhatsApp, plus questions the bot should refuse. IMDA’s starter kit suggests at least 30 to 50 test prompts for a narrow topic and 100 to 200 for a wider one. Run it again after any big change.

Is a chatbot better than a FAQ page or WhatsApp?

Start from the questions your customers actually ask and who needs to answer them.

If most of your questions are…	Usually best	Why
The same handful, week after week	A FAQ page	Easy to scan and to keep accurate
About orders, bookings or special requests	WhatsApp or a call	A person can check and commit
Answered somewhere in long documents	An AI chatbot	It finds the right passage fast
Coming in after hours and worth following up	An AI chatbot with a handover	It answers now and passes the lead on
About someone’s health, money or legal position	A qualified person	The answer depends on their own situation
Unanswered because no one updates the site	A FAQ page first	A chatbot repeats out-of-date pages

Many small businesses do best with a good FAQ page and a WhatsApp link, and add a chatbot later once the questions outgrow the page.

How does the PDPA apply to an AI chatbot on your website?

Anything a visitor types that identifies them, from a name and phone number to details of a medical condition, is personal data under the PDPA. The PDPC’s Advisory Guidelines on Use of Personal Data in Generative AI, issued on 20 July 2026, set out how the Act applies to businesses that deploy AI systems such as a website chatbot. They are advisory, not legally binding, and build on the PDPC’s 2024 guidelines on AI recommendation and decision systems.

You are responsible, even when a vendor runs the chatbot

The guidelines call the business that puts a chatbot in front of users a System Deployer, and say deployers bear primary responsibility for making sure the system they choose lets them meet their PDPA obligations (paragraph 9.1). When a model provider runs your visitors’ messages through its model for you, it acts as a data intermediary (paragraph 7.4).

Before you sign, ask the vendor where data is stored, how long it is kept, how it is secured and how breaches are handled. The guidelines call sharing this information good practice for providers (paragraphs 7.5 and 8.3).

Tell visitors what you collect before they type it

Section 20 of the PDPA requires you to tell people the purposes for collecting their personal data on or before collecting it. For a chatbot, that means a short notice in the chat window, before it asks for any details, with a link to your privacy policy. The PDPC’s 2024 guidelines suggest layering: the key point up front, details one click away.

Our reading is that a visitor who types a phone number and asks for a call back has agreed to be called about that request. The PDPA calls this deemed consent by conduct, explained in the PDPC’s Advisory Guidelines on Key Concepts. It does not extend to marketing messages or to using the chat to train an AI model.

Marketing follow-ups bring in the Do Not Call rules too. The PDPC’s DNC guidelines say that before sending a marketing call or message to a Singapore number, including through apps such as WhatsApp that use the number, you must check the DNC Registry unless you hold the person’s clear and unambiguous consent in a form you can produce later.

Visitors often type more than you ask for, so the notice should say what not to share; the PDPC expects deployers to guide users on this (paragraph 9.3). A website chatbot has no reason to ask for NRIC numbers, which the PDPC’s NRIC guidelines restrict to cases required by law or needed to verify identity to a high degree of fidelity.

If chats will train an AI model, say so plainly

The PDPC’s view is that a general statement, such as one citing “new product development” without mentioning AI, is not enough to obtain consent for using customer data to train or fine-tune generative AI models at scale. For this purpose, businesses must give an AI-specific notification that lets people understand what data is used and how, and the PDPC encourages explaining how to opt out (paragraphs 4.4 and 4.6).

This matters most in your vendor’s terms. Check whether the provider uses your visitors’ chats to improve its own models, and switch that off if you can. Adding your own web pages to the chatbot’s search index is a different thing: the guidelines limit “training” here to activities that change a model’s parameters or underlying capabilities.

Keep chat logs only as long as you need them

Section 25 of the PDPA requires you to stop keeping personal data once it no longer serves its purpose or a legal or business need. Decide how long chat logs are kept and automate the deletion; the PDPC applies its retention guidance to deployers too (paragraph 7.3).

Chat logs held by your vendor are still under your control, so include them when someone asks for their personal data (paragraph 10.2). The PDPC gives data in a RAG database as an example of where acceding to such a request is reasonable (paragraph 10.5).

Sending chats to an AI provider outside Singapore

The model behind your chatbot may run on servers outside Singapore. Section 26 of the PDPA, the Transfer Limitation Obligation, only allows overseas transfers that keep a standard of protection comparable to the PDPA. The PDPC’s Key Concepts guidelines say a contract can do this if it binds the recipient to that standard and names the countries the data may go to, and the obligation applies even when a data intermediary makes the transfer for you.

Our reading is that a chatbot sending conversations to a model provider overseas needs that contract, usually a data processing agreement naming where the data is processed.

Security: prompt injection and access to logs

The PDPC names prompt injection, where someone types instructions designed to make the bot ignore its rules or reveal data, as one of the newer risks (paragraph 8.2). Keep the chatbot away from any data it does not need, so a successful trick has nothing to reveal. Limit who on your team can read chat logs.

Do you have to tell visitors they are talking to an AI chatbot?

No Singapore rule we found sets a specific AI label for website chatbots. IMDA’s voluntary Transparency Guidelines for Generative AI Chatbots, launched on 20 July 2026, go further, and we recommend saying plainly that visitors are chatting with AI. IMDA says the guidelines do not impose obligations, but it strongly encourages every deployer of an external-facing chatbot, such as a customer service bot, to meet a minimum:

• A chatbot info card with at least one specific statement in each of four areas: what the chatbot can and cannot be used for, how reliable and safe it is, how user data is handled, and how to report issues. “We take safety seriously” does not count.
• A safety statement at first use, with a clear link to the card, such as a note that the chatbot can make mistakes and answers should be checked.
• The card reachable from inside the chatbot afterwards, such as through an information icon.

IMDA also asks deployers to publish the card when the chatbot goes live, update it when the model or safeguards change significantly, and show a last updated date. The guidelines do not replace sector rules, such as those for chatbots regulated as medical devices.

For a small business, the card can be one plain page. Here is the kind of wording we would draft for a fictional clinic:

What do the Model AI Governance Framework and AI Verify mean for a small business?

Neither is a licence or certificate you need before adding a chatbot. The Model AI Governance Framework for Generative AI, finalised by IMDA and the AI Verify Foundation on 30 May 2024, is written mainly for model developers and policymakers, and its useful points for a website chatbot are naming who is accountable, testing before launch and having a way to report and fix incidents. AI Verify is the Foundation’s testing framework and toolkit for checking AI systems against 11 governance principles, and the PDPC’s 2023 overview of Singapore’s approach notes that it does not guarantee a tested system will be completely safe or free from risks or biases. For a small business chatbot, IMDA’s starter kit is the more practical reference.

What extra rules apply to AI chatbots for clinics and financial firms?

Clinics: MOH’s advertising rules apply to what the chatbot says

The Healthcare Services (Advertisement) Regulations 2021 define an advertisement as any information published or conveyed by any means or in any form or medium to advertise a licensable healthcare service. Regulation 5 then requires that information to be factually accurate and capable of being substantiated, and bars, among other things:

• claims that the clinic can get results other licensees cannot, or that create an unjustified expectation
• comparisons with other licensees
• before-and-after or after-only treatment photos
• laudatory statements and superlatives
• reviews and testimonials, except as regulation 14 allows
• information presented in a way that amounts to soliciting or encouraging the use of the service, under regulation 5(1)(g)

MOH’s FAQ on the regulations confirms that a licensee’s website is covered and that claims need credible evidence that can be given to MOH on request. Regulation 6(4) also bars sending an advertisement through push technology without the person’s prior written consent.

Our reading is that a clinic chatbot’s answers about its services are advertisements, so regulation 5 applies to them. In practice, we would ground it only in pages already checked against the rules, block superlatives and outcome promises, keep reviews out, give the booking link when asked rather than pushing it, and send symptom questions to a call. Promotional SMS or WhatsApp follow-ups need prior written consent, which we read as falling under regulation 6(4). Our landing page guide covers the same rules for ad pages. Check with MOH or your adviser before launch.

Financial services: MAS expects AI risk management

MAS issued its Guidelines on AI Risk Management on 7 October 2026. They cover all financial institutions and all forms of AI, including AI supplied by third parties, and expect an inventory of AI uses, an assessment of how material each is, and proportionate controls such as testing and human oversight. They take effect on 7 October 2027, with Sections 5 and 6 due by 7 October 2028.

Our reading is that a customer-facing website chatbot is an AI use a financial institution would list and assess. Keep its answers to information already published on the site, route anything that sounds like advice to a licensed representative, and involve your compliance team from the start.

How do you measure whether a website chatbot is worth it?

We do not quote industry benchmarks, because published figures come from different businesses and setups. Before launch, count for a few weeks how many emails, calls and WhatsApp messages ask routine questions the chatbot will handle, and how many enquiries come in after hours. After launch, track:

• Questions answered without a person. Often called deflection or containment. It only counts if the answers were right, so check a sample.
• Handover rate and the reasons. A rising rate for one topic usually points to a missing page.
• Questions it could not answer. Your list of content to write next.
• Enquiries started in the chat, and how many became customers, tracked by source like form enquiries, as our tracking and analytics setup does.
• Wrong answers found in review, and how quickly the content was fixed.

If routine messages to staff do not fall and chat leads do not convert, a better FAQ page may do the job.

Can you get a grant for an AI chatbot in Singapore?

Yes, for a pre-approved package. Enterprise Singapore’s GenAI Customer Engagement Chatbot activity under the EDGE Grant supports chatbots that answer customer enquiries, recommend products, collect feedback and follow up on leads. Its main terms:

• Support: up to 50% for SMEs, up to S$7,500, on an activity cost capped at S$15,000, for software costs over up to 12 months. GST and maintenance are not supported.
• Conditions: a pre-approved package from IMDA’s SMEs Go Digital, no work or payment before you apply, one application for this solution, and the support counts towards the S$30,000 yearly cap for automation and digitalisation.

A chatbot built into your own website is not a listed package, so this activity does not apply to it. Under the Enterprise Innovation Scheme, IRAS allows a 400% tax deduction on the first S$50,000 of qualifying AI spending each year for YA 2027 and YA 2028, including AI system development. Hardware and grant-funded spending do not qualify, and there is no cash payout option. Our guide to website and AI grants covers both routes and the application steps.

Worked examples: AI chatbots for Singapore businesses

These businesses are fictional.

A dental clinic with two branches

Most messages ask about opening hours, which branch offers which treatment, and how to book. A few ask whether a symptom needs urgent care.

• Decision: a narrow chatbot grounded only in the clinic’s service, branch and booking pages, which the clinic has already checked against MOH’s rules.
• Limits: it does not discuss symptoms. Those questions get the clinic’s phone number and the booking link. It uses no superlatives, makes no outcome promises and never quotes reviews.
• PDPA: a notice above the chat asks visitors not to share medical details, logs are deleted after a set period, and the vendor contract covers where messages are processed and rules out training on them.

An industrial parts supplier with long product manuals

Engineers email the sales team with questions whose answers sit in hundreds of pages of datasheets and installation manuals.

• Decision: a grounded assistant on the website that searches the manuals and answers with a link to the right section. This is the job a chatbot does better than a FAQ page.
• Handover: anything about pricing, stock or a custom part goes to sales with the conversation attached.
• Funding: custom work, so the EDGE chatbot activity does not apply. The supplier asks for the AI development to be itemised for an EIS assessment.

A bakery that takes custom cake orders

Almost every message is about one order, so the bakery skips the chatbot. It adds a FAQ page on lead times, delivery and allergens, and a WhatsApp button so a person can confirm each date and design.

Thinking about adding a chatbot to your website?

Start with the questions your customers ask and the pages that answer them. If those pages are thin, write them first. If the questions are many and the answers are long, a grounded chatbot with a clear handover, a PDPA notice and an info card can take routine work off your team.

On the AI-powered websites we build, AI features for visitors include smart enquiry forms, search that understands questions and assistants that answer common queries. Each is grounded in the client’s own content and checked by our team, with clear limits on what it answers and a person to hand over to. jin-design.com itself has no chatbot today, because our service pages and FAQs answer the common questions. If you want the AI work itemised in the quote so your tax adviser can assess it under the EIS, ask us for that.

Tell us about your website and the questions your customers ask, and we will tell you whether a chatbot, a better FAQ page or WhatsApp fits.