Omnichannel Customer Communication with an AI Assistant

Omnichannel customer communication means that conversations from WhatsApp, Instagram, web chat, phone and other channels go into one customer record and one inbox, so the context stays when a customer switches channels. An AI assistant added on top should answer from data it reads live from the CRM and operational systems through tool calls, instead of relying on the model's general knowledge. Of the common designs, this one does the most to reduce hallucinations.

On the privacy side, transparency, data minimisation and cross-border transfers need the most care.

Multichannel vs omnichannel

WhatsApp Business app or WhatsApp Business API?

Since 1 July 2025, Meta has charged per message instead of per conversation. Template messages in the marketing, utility and authentication categories are billed at country-specific rates. Free-form replies sent within the 24-hour customer service window, which the customer's last message opens, are not charged. Check Meta's official rate card for current prices.

Meta's policy also restricts some bots. From 15 January 2026, Meta prohibits general-purpose AI chatbots, meaning assistants that chat about any topic, on the WhatsApp Business API. Assistants that serve a defined business process, such as support, order tracking, bookings or billing enquiries, remain allowed within the rules.

What a unified inbox needs

• One queue: conversations from every channel appear in a single list, labelled by channel.
• Identity resolution: phone number, email and social handles map to the same customer record.
• Routing and SLAs: assignment by topic, language or customer segment, with timers for first response and resolution.
• Customer details in the conversation: agents see plan, billing and open tickets without leaving the chat.
• Bot-to-agent handover: the assistant hands over with a summary, so the customer does not have to repeat themselves.
• Two-way translation: agents write in their own language and customers read replies in theirs.
• Reporting and audit: channel mix, resolution times, satisfaction scores, role-based permissions and activity logs.

How should an AI assistant access CRM data?

What a language model cannot know

A large language model cannot know a subscriber's invoice amount, plan or a local outage. If asked anyway, it may produce a convincing but wrong answer, known as a hallucination. Static knowledge such as price lists and FAQs is best served by retrieval from an approved knowledge base (RAG). Personal, fast-changing data requires tool calling.

How tool calling works

1. A customer message arrives.
2. The model decides which of its defined tools it needs and generates parameters that match a JSON schema.
3. The application layer checks authorisation and executes the tool, for example a CRM API call.
4. The result goes back to the model as structured data.
5. The model writes its reply from that data only. If the data is missing, it says so or hands the conversation to an agent.

An example tool definition:

{
  "name": "get_invoice_status",
  "description": "Returns the amount, due date and payment status of the authenticated subscriber's latest invoice.",
  "parameters": {
    "type": "object",
    "properties": {
      "period": {
        "type": "string",
        "description": "Billing period as YYYY-MM; latest invoice if omitted"
      }
    }
  }
}

The subscriber ID is not a parameter. The application never takes it from the model. It injects the ID from the authenticated session, so even a manipulative prompt cannot make the model request another subscriber's data.

Rules for reducing hallucination and security risk

• Separate data sources: dynamic facts (billing, plans, outages) come only from tool results. Static facts come only from the approved knowledge base.
• Authenticate first: share personal data only after verification, such as a one-time code sent to the registered number.
• Least privilege: read-only tools by default. Write actions such as plan changes or cancellations need explicit customer confirmation and, where appropriate, agent approval.
• Constrained endpoints: the model never writes free-form database queries. It calls predefined, schema-validated endpoints with rate limits and timeouts.
• Prompt injection defence: instructions inside customer messages ("ignore previous instructions") cannot change system rules. Tool outputs are treated as data and never as commands.
• Log and test: record every tool call and evaluate the assistant regularly against test sets built from real scenarios.

Voice assistants

A voice assistant uses the same logic on the phone channel. The call arrives over SIP/VoIP, speech-to-text (STT) transcribes it, the language model calls the tools it needs, and text-to-speech (TTS) speaks the answer. Design points:

• Latency: long silences break the flow of conversation, so keep the combined STT, model and TTS time as short as possible.
• Barge-in: callers must be able to interrupt the assistant.
• Confirmation: read back critical values such as amounts, dates and account numbers.
• Fallbacks: offer keypad (DTMF) input for noisy environments and one-step transfer to a human.
• Transparency: tell callers at the start that the call is recorded and that they are speaking with an AI assistant.

Example: an AI assistant in an ISP contact center

Say a fiber cable is cut in one district and "my internet is down" calls and messages pile up. A well-designed assistant would handle them like this:

The assistant does not guess at any step, because every answer is based on a system record. Agents spend their time on the cases that actually need a person.

In WiChat, conversations from WhatsApp Business API, Instagram, Messenger, Telegram, WebChat and phone/VoIP arrive in one inbox. Its AI voice and chat assistant answers from CRM data and offers two-way translation. For ISPs, subscriber, session and billing data can be read through tool calls from a subscriber management system such as Cetvel / WiRadius.

Privacy and KVKK checklist

The points below refer to Türkiye's Personal Data Protection Law (KVKK, Law No. 6698). Most have direct GDPR equivalents.

• Transparency (Art. 10): share a short notice and a link to the privacy notice at the start of a chat, and announce call recording on the phone.
• Legal basis (Art. 5): support requests usually rely on performance of a contract or legitimate interest. Marketing messages are additionally subject to consent rules, including Türkiye's e-commerce law (No. 6563) and the İYS consent registry. Never make service conditional on marketing consent.
• Data minimisation: send the model only the fields it needs to answer. Mask national ID numbers and full addresses, and never collect card details in chat.
• Cross-border transfers (Art. 9): if the model or messaging infrastructure is hosted abroad, the rules amended by Law No. 7499 (in force since 1 June 2024) apply. Without an adequacy decision you need an appropriate safeguard. If you use the Board's standard contract, it must be notified to the Authority within five business days of signing.
• Processor agreement: agree in writing whether the provider may use your data for model training, and how long it is retained.
• Retention and deletion: set retention periods for messages, call recordings and transcripts, and delete on schedule.
• Special category data: customers may volunteer health or other sensitive details, so build in masking and warnings. Voice biometrics count as biometric data.
• Security measures (Art. 12): role-based access, encryption and activity logs. Data breaches are expected to be notified to the Board within 72 hours of discovery.

This section is general information, not legal advice.

Frequently asked questions

Is the WhatsApp Business app enough for omnichannel?

For a single person or a very small team, it can be a starting point. Once you need multiple agents, CRM integration, a bot or AI assistant, reporting and shared history with other channels, you need the WhatsApp Business API and an omnichannel inbox.

How do you stop an AI assistant from giving wrong answers?

For personal and current information, the assistant must rely on system data read through tool calls instead of its own knowledge. Add authentication, least-privilege tools, schema validation, permission to say "I don't know" and handover to an agent.

Can customer data be sent to an AI model hosted abroad under KVKK?

Yes, provided the conditions in Article 9 are met: an adequacy decision, an appropriate safeguard such as a notified standard contract, or one of the narrow exceptions.

Are AI chatbots banned on WhatsApp?

No. Meta's policy that took effect on 15 January 2026 targets general-purpose AI assistants that chat about anything. Assistants that serve a business's own processes, such as customer support, order tracking and billing enquiries, are still allowed.