Putting artificial intelligence into customer service is now simple. The WhatsApp Business app itself already offers qualified businesses in some markets an AI agent that replies to customers, asks for information and hands the conversation off to the team when needed1. The question is no longer "can we add it?" Now it's "where in customer service does it help, and where does it get in the way?".
The answer depends less on the tool and more on the type of question your customer asks. This guide shows where AI tends to work, where it creates problems, and what the LGPD requires of anyone who puts a bot in front of customers.
What customers say about AI customer service
A Gartner survey of 5,728 consumers, conducted in December 2023 and published in 2024, found that 64% would prefer companies not use AI in customer service, and that 53% would consider switching providers if they learned a company was going to use it. The top concern was that it would become harder to reach a person. Next came job displacement and wrong answers2.
A more recent survey by the same firm, of 3,566 customers interviewed in February and March 2026, shows the same pattern from another angle. Almost half (49%) said they would use a chatbot if the company offered one, but only 7% used one in their most recent service interaction. And only 27% would try a chatbot again after a bad experience. For 87%, access to a human agent is essential when a company uses AI in customer service3.
The practical takeaway: people don't reject AI itself. They reject AI that becomes a wall between them and someone who can actually solve their problem.
Where AI tends to help
AI works best where the answer is fixed, short and the same for everyone.
- Repeated questions. Opening hours, address, parking, payment methods, what to bring to your first appointment.
- After hours. Log the request, say when the team will be back and keep the message from going unanswered until the next morning.
- Initial intake. Name, service needed, neighborhood and best time for a callback, so the team member starts the conversation already knowing what it's about. Nielsen Norman Group's guidelines for chat support say a company should never ask for the same information twice, so whatever the bot collected needs to reach whoever takes over4.
- Simple scheduling, when the tool is connected to the actual calendar and the service does not require a prior assessment.
Meta Business Agent's official page describes a similar scope: answering questions about address and hours, products and services, prices and payment, and asking the customer for information1. It also describes handoff control, so that the AI always passes conversations about complex or sensitive topics to the team1.
Where it gets in the way
- Custom quotes and assessments. When the price depends on seeing the case, the AI may give a generic answer or, worse, promise something the team would not confirm.
- Complaints, urgency and delicate moments. An angry or worried customer who gets an automated reply may leave the conversation feeling even worse than when they started.
- Information that changes. Prices, promotions, cancellation policy. If the answer base hasn't been updated, the AI repeats the old version with complete confidence.
- Regulated professions. In health and law, a single sentence can sound like clinical or legal advice. The article about clinics and advertising shows why this care also matters on the website.
- When the person asks for a human. Pushing the bot after that request confirms exactly the fear Gartner measured.
The costliest risk: a made-up answer
Nielsen Norman Group defines hallucination as a response from a generative AI that appears plausible but is incorrect or does not make sense5. In customer service, this becomes a concrete problem: the customer acts based on what they have read.
A well-known case involves Air Canada. In February 2024, British Columbia's Civil Resolution Tribunal, in Canada, ruled on a claim by a passenger who bought tickets after the website's chatbot told him he could apply for the bereavement fare after the trip, within 90 days of ticket issue. The airline's own page said otherwise. The airline argued that it could not be held liable for information provided by its agents and representatives, including the chatbot. The tribunal called the argument "remarkable", stated that the company is responsible for all information on its website, whether it comes from a static page or a chatbot, and ordered it to pay the passenger 812.02 Canadian dollars6.
The decision is Canadian, but the lesson crosses borders: what the bot says, the company says. In Brazil, the Consumer Protection Code establishes that any sufficiently precise information about the products and services offered is binding on the supplier and becomes part of the contract (art. 30)7.
In practice
Restrict the AI to an answer base written and approved by you, with a review date. Include explicit instructions for when it doesn't know: "I don't have that information, I'll get someone from the team." An AI that admits it doesn't know costs less than one that makes things up.
What Brazil’s LGPD requires when AI joins the conversation
This excerpt summarizes points of the law to guide questions to your supplier and your lawyer. It is not legal advice.
Personal and sensitive data. Everything that identifies the customer is personal data. Health data is sensitive personal data (art. 5, II) and can only be processed in the cases listed in art. 11, such as specific, prominent consent or health protection in procedures carried out by health professionals and services8.
Purpose, necessity and transparency. Processing must have a stated purpose, use the minimum data necessary and be transparent (art. 6)8. In practice: say in the first message that replies come from an automated assistant, ask only for what is needed to route the request and do not reuse conversations for another purpose without a legal basis.
The AI provider processes data on your behalf. Under the law, the party that decides on the processing is the controller, and the party that processes data on its behalf is the processor, which must follow the controller's instructions (art. 5, VI and VII, and art. 39)8. Before hiring, ask in writing what the supplier does with the conversations, whether they are used to train models, how long they are stored and where.
Data leaving the country. If the tool processes data outside Brazil, it is worth knowing that LGPD only allows international transfer in specific cases, such as standard contractual clauses (art. 33)8. The ANPD approved the text of these clauses in Resolution CD/ANPD No. 19/2024 and gave those using contractual clauses 12 months, a period that has already ended, to incorporate them into their contracts9.
Automatic decisions. The data subject may request a review of decisions made solely on the basis of automated processing that affect their interests (art. 20)8. If the bot refuses, filters or classifies customers on its own, a person needs to be available to review it.
Data subject rights. The customer can request confirmation, access, correction and deletion of data, among other rights (art. 18)8. Know how to handle this request before it arrives.
Small businesses have simplified rules, with exceptions. Resolution CD/ANPD No. 2/2022 exempts micro and small businesses from appointing a data protection officer, as long as they offer a communication channel for data subjects. The simplified regime, however, does not apply to those carrying out high-risk processing, defined by the combination of a general criterion (such as large scale) with a specific one, including the use of emerging technologies or sensitive data10.
The rules may also change. The bill that would create a legal framework for AI in Brazil (PL 2,338/2023) reached the Chamber of Deputies from the Senate in March 2025 and was still awaiting a rapporteur's report in September 202611.
How to build an AI assistant that helps
| Task | AI alone | AI, then person | Person only |
|---|---|---|---|
| Opening hours, address, payment | Yes | ||
| Logging after-hours requests | Yes | ||
| Collecting information for a quote | Yes | ||
| Simple calendar-linked scheduling | Yes | ||
| Custom quote | Yes | ||
| Complaint or urgency | Yes | ||
| Any clinical or legal advice | Yes |
Gartner recommends prioritizing reliability over reach: a chatbot that handles a few issues well builds more trust than one that tries everything and frequently fails3. In practice:
- Start with three to five topics that have fixed answers.
- Write the answer base and review it whenever a price or policy changes.
- Explain in the first message that this is an automated assistant.
- Always keep the path to a person visible, and make sure the conversation context goes along with it.
- List the topics that the AI never responds to and test each one.
- Read a sample of conversations every week for the first few months.
- Update your privacy policy and vendor contract.
Checklist
- List the most common questions and identify those with fixed answers.
- Write and date the answer base the AI can use.
- Set up the opening message to say it's an automated assistant.
- Ensure a handoff to a person, including the conversation history.
- Block sensitive topics: tailored pricing, complaints, clinical or legal advice.
- Ask the vendor about conversation usage, model training, retention, and country of storage.
- Review the privacy policy and the channel for data subject requests.
- Read real conversations every week and fix the answers that were wrong.
AI repeats what you teach it
An AI agent is only as good as the information it receives. Meta, for example, says that your agent learns from your Facebook Page, past conversations, and your company website1. If the website doesn't clearly say what you do, where you serve and how the service works, the AI will inherit that confusion. Before automating the conversation, it's worth knowing whether the foundation is solid. Flowt's free diagnosis measures your online presence against fixed criteria and shows, point by point, where it is losing customers.
