WhatsApp Generative AI Policy: Classifying Your Agent

There is a small habit we find in almost every WhatsApp account we inherit, and it never appears on anyone's risk register. Somebody widened the assistant's prompt. Usually to make it friendlier. A staff member noticed the agent refusing a harmless question, felt embarrassed on the business's behalf, and added a line telling the model to be helpful about anything the customer asks. Nobody logged the change. Nobody tested it.

Six weeks later that number is answering questions about parking in Al Barsha, about whether a rival clinic is any good, about school holidays. Each of those exchanges is a billed 24-hour session that produced nothing, and each one nudges the agent further into a category Meta has explicitly written out of its terms. The compliance exposure and the wasted spend come from the same source: an agent nobody bothered to classify.

The answer, up front

The WhatsApp Business Platform policy on generative AI permits a business to run its own task-oriented AI agent on its own WhatsApp number, serving its own customers, with opt-in captured before proactive messaging, replies confined to the 24-hour service window, approved templates for outbound contact, and a working handoff to a human. WhatsApp's Business Solution Terms prohibit something different: AI Providers, meaning developers of large language models, generative AI platforms and general-purpose AI assistants, are strictly barred from accessing or using the WhatsApp Business Platform. WhatsApp is not a distribution channel for somebody else's chatbot product, and that is the whole of the ban.

We have written the underlying rules elsewhere, in our WhatsApp platform reference. What that piece does not do, and what operators actually ask us for, is a way to decide which side of the line a specific agent falls on when it is not obvious. That is what the rest of this article is: the classification test we use, the evidence we keep, and the instrumentation that tells us an agent is drifting before Meta does.

A classification test for agents that are not obviously fine

Most agents classify themselves. A single clinic, a single number, a booking assistant that answers questions about that clinic: permitted, no analysis needed. A consumer product that lets anyone chat with a model on WhatsApp: prohibited, no analysis needed. The interesting cases sit between, and the terms give you a hard edge to work with, because Meta reserved the classification judgement to itself with the phrase "or similar technologies as determined by Meta in its sole discretion." You do not get to argue your way past that after the fact. You design so the question never becomes interesting.

Four questions, in this order.

Whose customers is the agent serving?

If the humans on the other end of the conversation are your customers, in a relationship that existed or was being formed independently of the AI, you are a business. If they are users of an assistant product, and the business relationship is with the model, you are an AI Provider. This is the question that does most of the work. A real estate agency's qualification agent talks to people who enquired about a listing. A general assistant talks to people who wanted an assistant.

What is being sold?

Ask what the customer would be paying for at the end of a successful conversation. If the answer is a hygienist appointment, a viewing, a colour correction, the agent is instrumentation for a service business. If the answer is access to the conversation itself, or a subscription to the assistant, the product is the model, and the platform is being used as distribution. Martin Endara's summary of the change makes the target clear enough: the companies affected are the ones that put a general assistant in front of WhatsApp's user base.

Could the agent hold a satisfying conversation about something the business does not sell?

This is the practical test, and it is the one that catches drift. Open your own agent, ask it to recommend a restaurant, ask it to summarise an article, ask it to write a birthday message. If it obliges, an outside reviewer looking at transcripts sees a general-purpose assistant on a business number, regardless of what your system prompt says it is for. Intent is invisible in a transcript. Behaviour is not.

How many separate businesses share the number?

The genuinely contested case is the agency running one WhatsApp number through which several client brands' agents answer. We do not build that, and we say so when asked. Each business should hold its own WhatsApp Business Account and its own number, with its own opt-in trail, its own templates and its own quality rating. Whatever the policy reading, the operational argument settles it: on a shared number, one client's complaints become everyone's messaging limits.

The edge case people ask about most: AI-augmented humans

An agent that drafts replies for a human to approve and send is not a chatbot at all, in policy terms. The message is composed by a person with a send button. We install this pattern often for higher-value conversations, and it sidesteps the classification question entirely while keeping most of the speed benefit. It also matches how we think AI should earn its place in a service business: clients pay premium prices for a practitioner's judgement, so the AI should be removing the typing, not standing in for the judgement.

Building the evidence file before anyone asks for it

Classification is a judgement. Evidence is what turns your judgement into something a reviewer can verify quickly. We keep one document per WhatsApp Business Account, and it is deliberately unglamorous.

• The opt-in mechanism, quoted verbatim, with a screenshot of where it appears and the date the wording last changed
• The agent's scope definition: the permitted intents, written as a list, not as a personality description
• The escalation path and the hours a human is actually reachable
• The template inventory, with category, approval date and the trigger that fires each one
• A dated note of the last adversarial test and what the agent did
• A change log of every prompt edit, with who made it and why

That change log is the item most teams skip and the one we would keep if we could keep only one. Prompt drift is the mechanism by which a compliant agent becomes a non-compliant one, and it happens through small well-meant edits nobody records. Tailors keep the original pattern pieces after an alteration for exactly this reason: when a jacket has been taken in three times by three different hands, the only way to know how much cloth is left in the seam is to look at what you started with.

Opt-in records that survive a question

Meta's opt-in requirement means the customer took a clear action to agree to receive WhatsApp messages from that specific business, and the business can show where and when. A tick box buried inside a booking form's general terms is a weak record. A visible checkbox naming WhatsApp explicitly, timestamped and stored against the contact record, is a strong one.

We keep opt-in queryable rather than archived, because the day someone asks why a particular number received a template message, the answer has to be a row you can pull up in seconds. Two fields matter beyond the timestamp: the source (which form, which page, which staff member at the front desk) and the exact wording shown at the time, since wording changes and consent is only as good as what the person actually read.

Where generative text is allowed to appear

Generative AI belongs inside the 24-hour service window, responding to something the customer said. It does not belong in template copy. Templates are pre-approved static text with variables, and the approved thing is what Meta reviewed, not what a model produces at send time. Our agents choose which approved template fits a situation and populate the variables. They never write the template. This distinction is worth stating in your policy file in one sentence, because it is the first thing a reviewer will check if outbound messaging is the reason they came.

Instrumenting an agent that is already live

For teams past the basics, the remaining work is observability. Conversion tracking is universal and almost useless for policy purposes, because a well-behaved agent and a drifting one both book appointments.

Refusal rate is the metric that matters

Log every out-of-scope request and what the agent did with it. That gives you two numbers: how often people ask your agent things it should not answer, and how often it refused cleanly. Read a sample weekly. A rising out-of-scope request rate usually means your marketing is attracting the wrong conversations. A falling refusal rate on the same volume means someone loosened the prompt, and that is the signal you are actually watching for.

We also keep a small fixed set of adversarial prompts and run them monthly: write me a poem, what do you think of the clinic down the road, help me with my tax return. The agent should decline briefly and redirect to what it can do. When one of those starts getting answered, we find the prompt edit that caused it in the change log, usually within a minute.

Platform signals arrive before Meta acts

The platform tells you something is wrong well before any enforcement lands. Message status events, block signals and quality rating changes come through as webhook events worth monitoring, and a shift in the read-to-block ratio on a number running an AI agent is the cheapest early warning available. A falling quality rating is also among the things that triggers an account review, which is a poor week to discover you kept no logs.

The cost line nobody attributes correctly

Back to the widened prompt. An unscoped agent burns money in a way that never reaches a compliance report. Every conversation it opens with someone who was never going to book is a billed session. Every rambling transcript makes the team trust the logs less, so they stop reading them. And an agent with no refusal boundary tends to improvise about prices and availability, which produces the most expensive outcome in any service business: a customer arriving at the front desk with a wrong expectation that a human now has to unpick in person.

The pricing rule, and what to actually do about it

Two separate 2026 changes get conflated constantly. One is the terms clause barring AI Providers. The other is pricing: Meta's developer documentation sets out new pricing for AI Providers using the WhatsApp Business Platform, charging for non-template messages from AI Providers in certain markets, and states explicitly that it applies to AI Providers as defined in the Terms of Service updated on that date. That update is behind us. It is the operating reality of every live account, not a change to prepare for, and any guidance still describing it in the future tense predates the rules.

Our practical verdict, since the two documents sit awkwardly together: build as though the ban is the only rule that applies to you. If you are a business running your own agent, the AI Provider pricing schedule is not aimed at you and your costs follow the ordinary conversation-based model. Do not architect anything on the assumption that a sanctioned AI Provider route will open up. Nothing in Meta's published documents promises one, and a business plan that requires a policy to change is not a business plan. If you are close enough to the AI Provider definition that the pricing page feels relevant to you, that is the finding, and the fix is to change what you are building rather than to budget for it.

Buy the platform, build only the workflow

A related decision that saves more money than any policy optimisation: do not build a bespoke messaging stack to run a booking agent. Buy the platform, customise the agent, and spend engineering time only on the workflow that is genuinely your competitive advantage, which for a clinic is triage and scheduling logic and for an agency is qualification. Learnmind builds WhatsApp and AI phone systems for clinics, salons and agencies from our base in Dubai, and across those installs the differentiated value sits in a thin slice of the system. The rest should be bought and fitted, the way you buy the suit and pay the tailor for the fitting rather than commissioning cloth.

Where the rules are sound and where they strain

The AI Provider ban is defensible on its own terms. WhatsApp's value to a two-chair dental practice rests on the number being a trusted line to a real business, and consumer assistants using the channel as free distribution would have thinned that trust for everyone. Guidance summarised in Alibaba Cloud's compliance guide frames the same point operationally for businesses building on the platform, and the conditions set out by the practitioners at upperfloor.ai, prior consent, the service window, approved templates and a route to a human, match what we install.

Reasonable people disagree about how capable a business agent can get before it looks general-purpose from the outside. An intake assistant that handles medical history in natural language and remembers context across weeks is, viewed only through transcripts, hard to distinguish from a narrow-prompted general assistant. We have no clean rule for that, and neither does anyone else honestly. What we do is keep answers tethered to the business's own content and keep a human in the loop for anything consequential.

Separately, and this trips up business owners regularly: Meta's own help centre explains that Meta provides the generative AI powering AI experiences inside the consumer WhatsApp app, including the privacy and safety guardrails around that model. That is a consumer product. It does not govern whether your salon can run an assistant on its Business Platform number, and alarmist consumer-app content, including a widely shared video framed as a final warning, has no bearing on your Business Platform architecture. Keep the two files separate.

What people ask us

Can my business legally use ChatGPT to answer WhatsApp messages?

Yes. Using a model such as GPT inside your own WhatsApp Business Platform integration is permitted, because you are the business serving your own customers. What is prohibited is an AI Provider putting its own assistant product on WhatsApp for end users.

How do I know if my agent counts as general-purpose?

Open a chat and ask it three things your business does not sell. If it answers them helpfully rather than declining and redirecting, a reviewer reading transcripts will see a general-purpose assistant regardless of your intent.

Can an agency run several clients' AI agents on one WhatsApp number?

We advise against it. Each business should hold its own WhatsApp Business Account, number and opt-in records, because a shared number pools quality rating and messaging limits across unrelated brands.

Do I need opt-in before an AI agent replies to a customer?

If the customer messaged you first, you are inside the 24-hour service window and can reply. Opt-in is required before proactive template messages, and you should hold a timestamped record of when it was given and what wording was shown.

What evidence should I keep in case of an account review?

Keep the opt-in wording and its screenshot, the agent's written scope, the escalation path and hours, the template inventory with approval dates, refusal logs, and a change log of every prompt edit with dates and reasons.

We will classify your existing WhatsApp AI agent against Meta's current generative AI terms, run the adversarial prompt set against it, and hand you back the exact scope, opt-in and template changes it needs. Ask us for it and we will book a slot.