On 14 October 2026, eight US states — Iowa, Kansas, Nebraska, West Virginia, Arkansas, Arizona, Idaho and Montana — filed separate lawsuits against OpenAI. The allegation is not that the AI is too clever, but the opposite: that ChatGPT is designed to be too agreeable, too eager to please, building trust and dependency in users including teenagers, and in some cases giving dangerous medical advice or responses around self-harm. The suits also accuse the company of misleading the public about how safe the product is.
How that case ends is not your problem. The design question inside it is exactly the decision you make when you put an AI assistant on your own site.
The core allegation: not wrong answers, but never saying no
One thread running through the filings is that ChatGPT is tuned to agree with users and simulate empathy, so people keep engaging. That can sound like good customer service.
But an assistant that always agrees with you will not correct you when you are wrong. And the three most common briefs for a business chatbot are precisely: never turn a customer away, answer everything, never say you don't know.
Those three requirements point in the same direction. Ask it to answer when it doesn't know, and it will invent. Ask it never to refuse, and it will never tell a customer to see a doctor or to call and confirm.
You are not OpenAI, but you are the one who deployed it
Customers do not separate the model from you. They see your website, your WhatsApp, your company name. Responsibility lands with whoever deployed it.
That is not a legal threat, it is operational reality: if a bot quotes the wrong price, the wrong treatment, or promises something you do not do, it is your staff who handle the fallout — not the model vendor.
Three boundaries to add
One: write down what it must not answer
Not a disclaimer sentence, an actual scope, enforced:
Medical, diagnosis, medication, legal advice, investment advice: never answer, hand over to a human
Price, stock, lead time: answer only from your system, otherwise say a colleague will confirm
Distress or crisis: do not attempt to counsel, give a human contact immediately
“I don't know” is a legitimate answer. Configure the bot so it is allowed to say it, rather than forcing it to fill every silence.
Two: keep a record of the conversation
When something goes wrong you need a record, not a feeling: when, who, what was asked, what the bot answered, whether it handed over to a person.
Logging is also a privacy question. In Hong Kong, the Personal Data (Privacy) Ordinance applies: if conversations contain personal data, state the purpose, the retention period and who can access it. Do not keep everything forever because it is convenient.
Three: review it, don't just configure it
The most dangerous state for a chatbot is “live and unread”. A minimum process:
Sample twenty conversations a week, especially ones where a customer asked three times
When it answers badly, fix the knowledge base and ask why it answered that way
Version and date every change to the knowledge base or prompt so you can trace it later
A disclaimer will not save you; a process will
“AI responses are for reference only” in the footer is a statement made afterwards. It is not a control. What reduces risk is: it declines when it should, its answers have a source, someone reads them regularly, and you can trace what happened.
How we build AI assistants
The knowledge base contains only material you have confirmed — we do not scrape the web to fill gaps
The refusal scope and handover rules are agreed line by line before signing
High-risk topics — pricing, treatment, contract terms — go to a human by default
Conversations are logged so problems can be traced
We do not report automation rate as a success metric. Correct answers are the metric.
If you already have a chat, or are about to add one, and want a second opinion on where it should not answer, book a 30-minute call. Our prices are public on the pricing page.