Chatbot as a Service: What to Check Before You Buy

Most buying guides for chatbot as a service rank vendors on answer quality and price per conversation. Both are easy to test in a trial, which is exactly why they're the wrong place to spend your evaluation time. The parts you can't reverse later are the ones nobody demos: (1) where the conversation text goes, (2) how long it sits there, (3) whether it trains someone else's model, and (4) whether your bot tells people it isn't human, a legal duty in the EU since 2 August 2026. Get those four wrong and you're not switching vendors, you're running a data-protection incident and a compliance retrofit at the same time.

Key Takeaways

• The data path is the only part of a chatbot contract you can't fix in the UI later. Answer quality improves with better content and prompts. A vendor's processing location and subprocessor chain are architectural, and changing them means changing vendors.
• AI disclosure is now a legal duty in the EU, not a design preference. Article 50 of the AI Act became applicable on 2 August 2026 and covers any AI system that interacts directly with people.
• Per-resolution pricing shifts billing risk onto you unless "resolved" is defined in the contract. Ask who decides, and what happens when a visitor abandons the chat mid-thread.
• A bot that can't hand off cleanly costs more than no bot at all. Deflection numbers look good right up until you measure what happens to the conversations the bot couldn't close.

Skip this article if you're building a bot on a raw model API and own your own retrieval stack. This is about buying a hosted service, where most of the decisions are made in a contract rather than in code.

What are you actually buying with chatbot as a service?

What you're actually buying with chatbot as a service, sometimes shortened to CaaS, is the vendor's stack: they run the model, the hosting, the retrieval layer, and the widget, and you configure behaviour rather than build it. You bring the content and the rules. They bring everything under the surface, including the parts that break at 2am.

The distinction matters because the three common shapes carry very different obligations:

Buying the hosted service does not transfer legal responsibility to the vendor. Under GDPR you remain the controller for conversations happening on your site, and the vendor is your processor. That's the reason the data questions below outrank the feature questions.

The disclosure rule that landed on 2 August 2026

Article 50 of the EU AI Act became applicable on 2 August 2026 under the regulation's staged timeline. The text of Article 50 requires providers of AI systems that interact directly with people to make sure those people are informed they're dealing with an AI, unless that's already obvious to a reasonably well-informed and observant person.

The exemption does real work, and it's narrower than vendors imply. A widget clearly badged as an assistant probably clears it. A bot given a human first name, a stock-photo avatar, and no label probably doesn't. The European Commission publishes its own reading of the duty in an official FAQ on Article 50 transparency obligations, which is worth reading before you accept a vendor's compliance claim at face value.

Two details get missed in vendor marketing. First, the obligations split between the provider that builds the system and the deployer that runs it, so a vendor's compliance does not automatically cover your deployment. Second, breaches of Article 50 sit in a specific penalty band: Article 99 sets fines of up to €15 million or 3% of worldwide annual turnover, whichever is higher, with a proportionality carve-out that caps SMEs at the lower of the two figures. Enforcement runs through national market surveillance authorities.

Practical version: write the disclosure into the widget's first message and the bot's persona, not into a privacy page nobody opens. If you want a quick read on how your current labelling holds up, meetergo runs a free AI labelling checker that scans a page for disclosure and provenance signals.

How do you evaluate a chatbot as a service platform?

You evaluate a chatbot as a service platform with five checks, in the order that saves you the most rework.

Step 1: Trace the data path before you read the feature list

Ask the vendor to name, in writing, every party that touches a conversation: the application host, the model provider, the vector or retrieval store, the logging and analytics layer, and any moderation service. Then ask where each one processes data.

This is where most evaluations go wrong. A vendor can host its application in Frankfurt and still route every prompt to a model provider under US jurisdiction, which puts the actual conversation content outside EU legal control while the marketing page truthfully says "EU hosted". The subprocessor list, not the hosting page, is the document that tells you the truth.

For EU buyers the follow-up is about corporate structure rather than server pins: a provider with a US parent can face US disclosure orders regardless of where the disks live. Our breakdown of which data-protection laws apply to which providers covers that, and the case for data sovereignty explains why the question survived the current adequacy arrangements.

Step 2: Get retention and training terms in writing

Three separate questions that vendors routinely blur into one reassuring sentence:

• How long are prompts and responses stored? "Zero data retention" should mean the prompt is discarded after the response is generated. A 30-day deletion window is a different promise.
• Is your content used to train or fine-tune models? Check whether the answer covers the vendor's own models, the underlying model provider's models, or both.
• Who can read a conversation for support or abuse review? Human review pipelines are legitimate, but they need to appear in your record of processing activities.

If a vendor answers the first question with a retention window and the second with "we don't sell your data", you've been given a non-answer to both. Push until you get a clause, not a sentence. These aren't theoretical questions: the report of the EDPB's ChatGPT taskforce, published in May 2024, shows European data-protection authorities pressing a model provider on exactly these points, from lawful basis to transparency about training data.

Step 3: Decide whether the bot answers or acts

An answering bot retrieves from your content and replies. An acting bot books the meeting, updates the CRM record, or issues the refund. The gap between them is most of the value and nearly all of the risk.

Acting bots need a permission model, an audit trail, and a rollback story. Ask what happens when the bot books a slot that the calendar had already given away, and whether you can see, per action, which model call triggered it. Vendors that treat actions as an extension of chat rather than a separate permissioned surface tend not to have good answers.

If the outcome you want is a booked meeting rather than a closed ticket, say so in the trial. Support-first platforms optimise for deflection, and a deflected conversation is the opposite of a captured lead.

Step 4: Design the handoff before you launch

Every bot fails some conversations. What separates a good deployment from an expensive one is what happens in the thirty seconds after that failure.

Test three specifics during the trial: whether the human agent inherits the full transcript or starts cold, whether the visitor keeps their place in the conversation or gets bounced to a form, and whether an agent can join a thread the bot is still handling without kicking the bot out. The third is the one most platforms handle badly, and it's the one your team will hit daily.

Step 5: Instrument it before you turn it on

Agree on the metrics before launch, because after launch the vendor's dashboard will define them for you. The three worth tracking are containment rate, escalation quality, and downstream conversion. Containment alone rewards a bot for stonewalling people.

How do CaaS pricing models bill you?

CaaS pricing models bill you per seat, per resolution, per message or as part of a bundle, and the billing unit tells you more than the headline price does.

Per-resolution pricing is the one that surprises people. It sounds fair because it looks outcome-based, and it can be, but only if the contract defines who decides that a conversation was resolved and what happens when a visitor simply closes the tab.

Where meetergo fits

meetergo is a European scheduling and revenue-pipeline platform with a suite of apps around booking, CRM, forms and documents. Its AI assistant, Mira, is the piece relevant here: it runs on EU-hosted models with no training on your content, and it books meetings rather than only answering questions. For teams whose chat goal is a filled calendar rather than a closed ticket, that changes what the bot is optimising for. On OMR Reviews, meetergo holds a 4.8/5 rating across 87 reviews (checked 2026-07-25).

Website chat that ends in a booking

The live chat widget puts real availability inside the conversation, so a visitor can ask a question and confirm a slot in the same thread. Mira handles routine questions around the clock and hands the thread to a colleague when it needs one, and anyone on the team can join a conversation already in progress.

Grounded answers from your own content

Mira answers from a retrieval-backed knowledge base rather than from general model knowledge, and it can read linked pages and documents. It also reaches your CRM records for contacts, companies and deals, so an answer about an existing customer isn't guesswork.

Actions, not just replies

AI steps run inside automated workflows, which is where the answering-versus-acting distinction from Step 3 gets settled. Mira also works as an email assistant and on the WhatsApp Business channel, so the same assistant covers the channels a booking conversation tends to start on.

EU processing by design

Prompts run on models from Paris-based Mistral and other EU-hosted providers, they aren't stored after the response is generated, and they're never used to train models. There's no US cloud in the path and no CLOUD Act reach. That posture is documented alongside the rest of meetergo's security and compliance information.

meetergo's plans (prices checked 2026-08-13):

Mira is the AI assistant built into the meetergo suite, included in the plans rather than sold as a per-seat AI add-on. Paid tiers come with a 7-day trial, and the WhatsApp channel sits on Premium. Full details are on the pricing page.

The honest limitation: meetergo is a suite, not a standalone bot you drop onto a stack you otherwise don't use. If your goal is deep ticket deflection across a large existing helpdesk knowledge base and nothing else, a dedicated support platform is a better shape for the job. meetergo is also SaaS only, so an air-gapped deployment isn't on the table.

Ready to test a bot that books instead of deflects? Start free with meetergo. No credit card required.

Common mistakes

• Treating the vendor's GDPR badge as your compliance. You stay the controller for conversations on your own site. The vendor's certification covers their processing, not your lawful basis, your notice, or your record of processing. Our guide to picking GDPR-compliant software walks through the split.
• Launching the bot on every page at once. Start on two or three pages where you already know the top questions. A bot that has read your whole site answers everything badly instead of a few things well.
• Writing the disclosure as a legal footnote. Article 50 asks whether a reasonable person knows they're talking to an AI. A line in your privacy policy doesn't achieve that; the widget's first message does.
• Measuring containment without measuring what happened next. A bot that closes 70% of chats while quietly losing the qualified ones is a downgrade with good reporting.
• Skipping the export test. Ask how you get transcripts and contacts out before you sign, not during the month you're leaving.

FAQs

Is chatbot as a service different from a chatbot builder?

Mostly in who runs it. A builder gives you a canvas and expects you to host or connect the pieces. A service runs the model, retrieval and hosting, and bills you a subscription. The practical difference shows up in your subprocessor list, which is longer with a builder.

Do I need to tell visitors my chatbot is AI?

In the EU, yes, unless it's already obvious to a reasonably well-informed and observant person that they're interacting with an AI system. That duty has applied since 2 August 2026. The safe implementation is an explicit label in the widget rather than a reliance on the exemption.

Can a chatbot as a service platform be GDPR compliant?

It can, but compliance is a property of the whole processing chain, not a vendor logo. Check the subprocessor list, the retention clause, the training clause, and the international-transfer mechanism. If the model provider sits under US jurisdiction, that's the fact that matters, whatever the hosting page says.

What does chatbot as a service typically cost?

Anywhere from bundled into a suite at no separate line item to four figures a month on per-resolution enterprise contracts. The billing unit matters more than the headline number, because per-resolution and per-session models move your invoice with traffic you don't control.

How long does it take to get one live?

A widget with a handful of trained answers is a same-day job on most hosted platforms. Getting it good takes a few weeks of reading real transcripts and fixing the answers people actually asked for, which is the part teams underestimate.

Should the bot handle scheduling, or just answer questions?

If bookings are the outcome you're paid on, put scheduling inside the bot. Pushing a visitor from chat to a separate booking page adds a step at the exact moment they were ready. meetergo's scheduling app is built for that handoff, and the same logic applies to any AI scheduling assistant you evaluate.

Pick two pages, write the disclosure line first, and get the subprocessor list in writing before the trial ends. Those three moves settle most of what you can't undo later.