Why not explicitly make the service provider explicitly responsible for what the chatbot writes (as if it were a human employee)? That way the company’s incentive is to build meaningful guardrails instead of checking whatever boxes the bureaucrats come up with.