Someone types into your store's chat widget: "I took two of your supplements and now I feel dizzy, is that dangerous?" This is not a question your bot should answer on its own. Get it wrong and someone gets hurt and you get sued. Get it right by accident and you've still gambled with a person's health.
Most chatbot advice is about answering more questions. This one's about the opposite: knowing which questions your bot must not answer alone, and building the reflexes that catch them. A bot that's honest about its limits is safer, and frankly more trustworthy, than one that confidently answers everything.
What makes a question sensitive
Sensitive isn't the same as hard. A hard question is one the bot might not know. A sensitive question is one where a confident wrong answer, or even a confident right one, can cause real harm or real liability. Those need different handling, because the failure mode isn't "unhelpful." It's "dangerous."
A few categories cover most of it:
- Regulated advice. Medical, legal, financial, or tax questions specific to someone's situation.
- Safety and crisis. Any hint of self-harm, an emergency, or someone in danger.
- Personal and account data. Requests to see, change, or share account details or identity.
- Serious complaints and disputes. Billing disputes, threats to take legal action, accusations.
- High-stakes commitments. Anything the bot might promise that binds you, like guarantees or firm quotes.
Notice these aren't rare exotic cases. A normal small business bumps into all of them in a regular month.
The default rule: know the limit, then hand off
Every sensitive category shares one solution, so set it as the bot's core instinct: when a question crosses into sensitive territory, don't improvise, hand off. What the bot's value in these moments comes down to is recognizing the situation and getting a human involved fast, not the answer.
Write this into the bot's standing instructions plainly. Something like: "For any medical, legal, or financial question specific to a person, do not give advice. Acknowledge it, and offer to connect them with a qualified human. If anyone mentions being in danger or in crisis, stop and direct them to appropriate help or emergency services immediately."
The instinct you're building is restraint. A bot that answers everything feels impressive right up until the one answer that goes badly. A bot that knows when to stop is the one you can actually trust on your site.
Handling each type without freezing up
Restraint doesn't mean the bot goes silent or unhelpful. Each category has a right posture:
| Sensitive type | What the bot should do |
|---|---|
| Regulated advice (medical/legal/financial) | Give general info only, decline specifics, offer a qualified human |
| Safety or crisis signals | Stop the normal flow, point to real help, escalate immediately |
| Account or personal data | Route to a secure, verified process, never expose details in open chat |
| Serious complaint or dispute | Acknowledge calmly, don't argue, hand to a person quickly |
| Requests for guarantees/quotes | Decline to commit, pass to someone authorized |
Take the supplement question from the top. The right response isn't a diagnosis and isn't stony silence. It's something like: "I'm not able to give medical advice, and dizziness after taking a supplement is worth taking seriously. If you're feeling unwell, please contact a doctor or, if it's urgent, emergency services. I can also connect you with our team." Honest, calm, and pointed at real help.
Writing fallbacks that are safe and still human
The wrong fallback is a cold "I can't help with that," which leaves someone with a real problem feeling dismissed. The right one declines the risky part while still being a decent human about it.
Good sensitive fallbacks share three traits. They acknowledge the person's concern so they feel heard. They're clear about what the bot won't do and why, without hiding behind jargon. And they offer a real next step, a human, a phone number, a proper channel, so the person isn't stuck at a dead end.
Draft these ahead of time for your likely cases rather than leaving them to chance. If you run a health product, write the "I feel unwell" fallback now. If you handle money, write the "should I do X with my finances" one. In SpideyChat you'd set these responses and escalation rules directly in the bot's instructions, so the moment a message trips a sensitive topic, the bot follows your careful wording instead of improvising something risky.
The handoff, done so it actually lands
A handoff that goes nowhere is worse than no handoff, because you've promised help and not delivered. If the bot says "I'll connect you with our team," a real person needs to actually receive that.
Set it up so escalations land somewhere watched, with the conversation attached so the customer doesn't have to repeat a stressful story. Be honest about timing, too. If your team is offline, don't have the bot imply someone's standing by. "Our team will follow up first thing tomorrow, and here's an emergency number in the meantime" beats a vague promise that breeds a second, angrier message.
Consider Harbor Health Co, a fictional small vitamin brand. Their bot answers plenty of routine questions about ingredients and shipping, but anything that sounds like a health concern, an allergic reaction, or a dosage question triggers a fixed response that declines advice, points to a doctor, and flags the chat to a staff member with a note. Nobody on their small team has to be a medical expert. They just have to catch the sensitive ones and route them, which the bot handles.
Don't let the bot become a privacy leak
Sensitive isn't only about advice; it's about data. A chatbot that collects more than it needs, or hands out account details to whoever asks, is a breach waiting to happen.
Keep the bot's data appetite small:
- Only ask for what a given task genuinely requires, and no more.
- Never have it read out account details, order history, or personal info in open chat without proper verification.
- Route identity-sensitive requests to a secure, human-verified process instead of the conversation.
- Don't collect health, financial, or ID numbers in casual chat if you can avoid it.
The principle is simple. The chat window is a public-ish doorway, not a secure vault. Treat it that way and you avoid the worst mistakes.
Test with the questions you're dreading
Nobody wants to type "I want to hurt myself" into their own chatbot to see what it does. Do it anyway, in testing, because that's how you find out whether your guardrails actually hold before a real person hits them.
Write a list of the hard cases for your business: the medical scare, the furious refund threat, the "give me my account details," the crisis signal. Run each through the bot and read the response as if you were the person in that moment. Adjust until every one produces a calm, honest, safe reply that routes to real help.
You'll never predict every sensitive question a customer might ask. But you can build a bot that reliably notices when it's out of its depth and reaches for a human. That reflex, more than any clever answer, is what makes a bot safe to put in front of the public.