AI Chatbot for Your Website FAQ: Options, Costs and Limits for Small Business

Posted on Oct 29 • Originally published at epifive.com

The simplest safe way to put an AI FAQ chatbot on a small business website is to use a managed agent builder such as Microsoft Copilot Studio, point it at a handful of public pages you control, embed it with Microsoft's supplied snippet, and cap its spending. If you have a developer, a custom build with OpenAI's ChatKit is the other documented route. This guide compares both, explains how they are billed, and lists the limits and security steps you should settle before going live.

Product details were checked on Microsoft Learn and OpenAI's developer documentation on 28 October 2026. AI products change quickly, so confirm prices and menu names on the day you build.

This is for owners and office managers of small businesses who answer the same customer questions repeatedly (opening hours, delivery, returns, pricing structure), and for the IT person asked to "add a chatbot".

An FAQ bot is useful for repeat, factual questions with a single correct answer from your own content. It is a poor fit for anything that needs account access, a judgment call, or legal accuracy, such as refunds above a limit, medical or financial advice, or disputes.

If your answers are inconsistent between pages, fix the pages before building anything.

Copilot Studio lets you build an agent in a browser, ground it in knowledge sources and publish it to channels including a website.

Microsoft's knowledge sources page lists public websites, uploaded documents, SharePoint, Dataverse and connector-based enterprise data. For a public FAQ the relevant ones are public websites and uploaded documents. In generative mode, Microsoft lists support for up to 25 public websites. For websites you need to confirm which sites your organisation owns that Bing will search through Copilot Studio. Public website knowledge searches the query on Bing and only returns results from the websites you provide.

You can also set a content moderation level from Lowest to Highest; the default is High.

Copilot Studio is billed by Copilot Credits. The billing page lists these rates for the standard harness:

Microsoft's own example for a customer support agent on a website is four classic answers and two generative answers per conversation, which comes to 8 credits per customer. At 900 customers a day that is 7,200 credits a day. Use that arithmetic with your own numbers. If you expect 30 conversations a day with three generative answers each, that is 30 x 3 x 2 = 180 credits a day.

This article does not list a price per credit pack because the Microsoft pages it draws on do not state one. Microsoft points to its Copilot Studio Licensing Guide and a usage estimator for current figures; use both before committing.

Licensing facts that affect a small business:

A disabled agent shows users a message such as "This agent is currently unavailable. It has reached its usage limit." Decide whether you prefer that or a surprise bill.

Microsoft's publishing article describes two things: a demo website for testing, which is not for production and whose URL you should not share with customers, and an iframe-based embed for the live site. In outline:

The live-site sample is a full HTML page, so your developer will lift the relevant script and markup into your site template. Test on mobile as well, because the sample's chat window is sized for desktop and switches to full screen below 768 pixels wide.

Microsoft's web channel security page says that without secured access, anyone who knows the agent ID can connect through the demo website and custom website channels. The Require secured access setting is under Settings, Security, Web channel security. Changes can take up to two hours to take effect. Credentials from this setting authorise access to the Direct Line channel; they do not authenticate the end user or restrict access to one website.

The rule that matters most: never place the Direct Line secret in code that runs in the browser. Exchange the secret for a token in your server code, using the generate-token request Microsoft documents. Tokens are valid for one conversation and expire unless refreshed.

OpenAI's ChatKit documentation describes ChatKit as an embeddable chat user interface for agent experiences. There are two paths: a custom server integration, where you run ChatKit on your own infrastructure with the ChatKit Python SDK connected to an agent service, and an integration that uses a workflow hosted in Agent Builder.

The page states that Agent Builder is scheduled to shut down on November 30, 2026, and recommends the custom server integration for new work. That is a reason to avoid starting a new project on the hosted workflow path.

For the hosted path the documented flow is: your server creates a session by calling the ChatKit sessions endpoint with your API key, a workflow ID and a unique value for each end user, then returns a client secret to the browser. The API key stays on the server. The documentation says your server must authenticate users and supply the identifier.

Costs: the ChatKit page does not describe pricing, so check OpenAI's pricing page directly. Because the integration calls OpenAI's API with your account, plan to cap spend there with the controls your account offers.

This option suits a business with a developer or an agency already maintaining the site. For most small businesses with no developer, Option 1 is less work.

If the questions are few and stable, a well-organised FAQ page with a search box often does the job with no running cost and no risk of an invented answer. Consider it seriously if your top 20 questions fit on one page. It can also become the knowledge source for a bot later.

Related reading: an AI hallucinations verification checklist for business and an AI acceptable use policy template.

Build a test sheet of 40 real questions in three groups: the FAQ questions, questions the bot should refuse or hand off, and tricky ones with wrong assumptions ("Do you deliver on Sundays?" when you do not). Run each through the bot and mark every answer correct, partly correct, wrong or withheld. Fix the source pages for any wrong answer, not just the bot's instructions, then retest. Ask two colleagues to try to break it.

This guide was researched and drafted with AI assistance and checked against the vendor documentation listed in its References. Read the maintained version and related guides on EpiFive.