What a WhatsApp AI agent can and cannot do for a company

A prospect messages a company on WhatsApp at 21:40. By 08:00 the message is cold. An agent can reply at once, but it works inside three limits: what the company has approved, what Meta's platform allows and what Tanzanian data protection law requires. This note sets out what an agent can do, what it must never do, the platform rules and the duties under the Personal Data Protection Act, 2022.

What can a WhatsApp business AI agent do?

A WhatsApp business agent can answer from approved content, qualify an enquiry, propose the next step and hand over to a person. The NEMBO desk agent works on WhatsApp and web chat in English and Kiswahili, asks one question per message and logs the source, channel and answers before a person sees them ⁶.

What must an agent never do?

An agent must not give a legal opinion, quote outside the approved list, promise an outcome or run a conversation without a route to a person. The first three are limits the NEMBO agents page places on its own agent ⁶. The fourth is a platform rule: a business may use automation inside the 24-hour window but must have "prompt, clear, and direct escalation paths" ⁴.

The reason is practical. A prospect told the wrong licence route pays for the wrong application. Qualification therefore settles the route before a price is mentioned, and edge cases go to a person ⁶.

What does the 24-hour window mean for response times?

When a customer messages or calls, a 24-hour customer service window opens, and any service message type can be sent without pre-approval while it is open ¹. When it closes, only pre-approved template messages can be sent, and a new customer message resets the timer to 24 hours ¹. Each template is approved before use and assigned one of three categories: authentication, marketing or utility ².

An agent that answers inside the window is unaffected. The window matters at handover, because a person who replies after 24 hours must use an approved template.

What do Meta's rules require before a business messages?

Meta requires opt-in permission before a business messages a person, and the opt-in must state that the person agrees to receive communication and name the business ³. The Business Messaging Policy, last updated 23 September 2026, requires a business to honour requests to block or stop, and lists restricted categories, among them payday loans, peer-to-peer lending and debt collection ⁴. The platform also requires a business portfolio ⁸.

What does the Personal Data Protection Act require?

A company whose agent records names, numbers and answers collects personal data, which the Act defines as data about an identifiable person recorded in any form (section 3) ⁵. The Act, No. 11 of 2022, sets these duties:

• Registration: a person shall not collect or process personal data without being registered (section 14(1)) ⁵.
• Principles: personal data is processed lawfully, fairly and transparently (section 5(a)) ⁵.
• Direct marketing: a data subject may require the controller to stop processing for direct marketing (section 35(1)) ⁵.
• Automated decisions: a data subject may require that a significant decision not be based solely on automated means (section 36(1)) ⁵.
• Breach: the controller notifies the Commission without undue delay (section 27(5)) ⁵.

Section 32(1) permits transfer abroad where an adequate level of protection is ensured in the recipient's country ⁵. Where the agent's platform stores messages outside Tanzania, the Client records the basis for the transfer.

What does an agent change in a month of enquiries?

What the NEMBO desk prepares

The desk builds the agent under the Build package, staged, from TZS 3,500,000 or USD 4,500, with 50 per cent of each stage starting it ⁷. The deliverables are a qualification flow with one question per message, knowledge limited to content the Client has approved, written and tested escalation triggers, a conversation log with a daily summary, and WhatsApp or web chat in English and Kiswahili ⁶.

The build runs in five steps: write the questions, load approved content, set the hand-over rules, test on past conversations, then go live with weekly review ⁶. The Client supplies the service list, the price list, the approved answers and a named person who takes the hand-over. Zatra Consultants Limited supplies the regulatory knowledge. The date is set in the written quote after the question set is agreed ⁶. The desk does not guarantee a platform's approval of an account or template.