Can ChatGPT build a website or app for my business?
Updated October 22, 2026 · 5 min read
Partly. In 2026, ChatGPT, Claude and Gemini can write a simple website or small app from a description, and some can publish it. Website builders such as Wix and Squarespace can draft a whole site from a prompt. What none of them does on its own is the part that makes software safe to run a business on: your domain, taking payments properly, protecting customer data, meeting consumer and accessibility rules, and fixing things when they break. Use AI for drafts and prototypes; have someone accountable check anything that touches customers’ data or money.
What the main tools can do today
| Tool | Can it publish? | Your own domain | Taking payments |
|---|---|---|---|
| ChatGPT Sites | Yes, with hosting included on the paid Plus and Pro plans | Only one you already own, and you edit its DNS yourself | Only through a third-party payment processor that you set up and maintain |
| Claude artifacts | Shares single pages and small tools; viewers need a Claude account | Not covered | Not covered; a tool that needs a backend has to be deployed on your own infrastructure |
| Gemini Canvas and Google AI Studio | Canvas shares through public links; AI Studio deploys apps to Google Cloud | AI Studio offers a subdomain; your own domain isn’t covered | Not covered |
| Wix and Squarespace AI builders | Yes | Yes, on paid plans | Yes, on the plans that include payments |
Sources: OpenAI on ChatGPT Sites, Claude artifacts and sharing, Claude Code artifacts, Gemini Canvas, AI Studio deployment, Wix plans and Squarespace pricing, checked in October 2026.
A few details matter more than they first appear. OpenAI says every ChatGPT Sites deployment is a production address, and on personal plans the conversations used to build a site may be used to train its models if that setting is on. Anyone with a public Gemini Canvas link can view and edit the app’s data, according to Google. And an app built in AI Studio uses your own API key for every visitor’s requests, with you responsible for its behaviour and the data it handles, according to Google’s developer docs.
Where AI-built apps go wrong
The code usually runs. The problems are in what you can’t see. In a 2026 study of 200 publicly deployed apps built with AI coding tools, 91% had at least one security vulnerability and about two in three of the flaws found were rated critical or high, most often broken access control, injection and login failures, according to a university preprint that has not yet been peer reviewed. Better prompting reduced the problems but didn’t remove them.
The UK’s National Cyber Security Centre puts it plainly in its June 2026 guidance: heavy AI generation suits prototypes, demos and internal tools with little exposure, while login and permission logic, sensitive personal data and passwords or keys need more human control.
What still needs a person
| Job | Why AI alone doesn’t cover it |
|---|---|
| Domain | A .com.au must be held by an Australian business, for example one with an ABN, under auDA’s rules. Register it yourself and keep the login. |
| Payments | Send card details straight to a payment provider rather than through your own site. Even then your site stays part of the security picture, and embedded payment forms need extra checks under PCI rules. |
| Customer data | If your business is covered by the Privacy Act, from 10 December 2026 your privacy policy must also explain decisions a computer program makes about people, according to the OAIC. |
| Prices and checkout | The ACCC requires one total price including unavoidable fees, and card surcharges have been banned since 1 October 2026. |
| Accessibility | The Australian Human Rights Commission recommends meeting WCAG 2.2 at Level AA for websites and apps. |
| Upkeep | Admin logins need multi-factor authentication, the site needs HTTPS, backups and updates, and the domain should renew automatically, says the Australian Cyber Security Centre. |
Payment providers do much of the heavy lifting if you let them. Stripe says low-risk integrations send card data directly to it, not through your servers, though the business still confirms its compliance every year. Square says sellers who use it for all card storage and processing don’t need to validate PCI compliance for those transactions.
Who owns what the AI made
Copyright for many types of work requires a human author, so how much protection AI-generated material gets is still an open question, says IP Australia. It suggests keeping notes of your prompts and of what you chose and edited, checking each tool’s terms on ownership, and checking that a generated name or logo doesn’t resemble someone else’s.
Plenty of businesses are still cautious
Only 11% of small and micro businesses used AI in 2024–25, according to the ABS. The National AI Centre’s tracker, which counts any use, found 44% of SMEs using AI in February 2026. About half of those check AI output before it reaches customers, and among businesses not using AI, around 65% cited distrust or wanting human control. Being careful is normal.
The Australian Cyber Security Centre’s advice for small businesses, published in January 2026, starts with a simple AI-use policy: decide what data may be shared with AI tools, check whether your data is used to train the vendor’s models, and keep a person reviewing what the AI produces.
A sensible way to use it
- Draft with AI. Page wording, a layout, a clickable prototype to show customers: this is where AI saves the most time and money.
- Sort what goes live. A brochure site with no customer data can go live from a builder. Anything with logins, bookings, payments or personal information needs a review first.
- Keep ownership. Domain, hosting and every account in your business’s name, and the code exported where the tool allows it.
- Get an accountable review of logins, permissions, who can reach the data, and how payments are handled, before customers use it.
- Plan the upkeep. Decide who updates it, backs it up and answers when it breaks.
Sources
- OpenAI: Creating and using ChatGPT Sites
- Anthropic: What are artifacts, Share artifacts and Claude Code artifacts
- Google: Gemini Canvas, AI Studio Build mode (October 2026) and Deploying from AI Studio (September 2026)
- Wix: Plans and Squarespace: Pricing
- Deng, Fan and Meng: Understanding the (In)Security of Vibe-Coded Applications (preprint, 2026)
- UK National Cyber Security Centre: The vibe coding spectrum (June 2026)
- auDA: com.au and net.au rules
- PCI Security Standards Council: SAQ A eligibility FAQ
- Stripe: Integration security guide and Square: Privacy and security
- OAIC: Transparency for AI and automated decision-making (September 2026)
- ACCC: Price displays
- Australian Human Rights Commission: Guidelines on equal access to digital goods and services
- Australian Cyber Security Centre: Secure your website and Artificial intelligence for small business (January 2026)
- IP Australia: Considerations when using AI to create IP
- ABS: Characteristics of Australian Business, 2024–25 (June 2026)
- National AI Centre: AI adoption insights, December 2025 to February 2026
Tool features were checked on the providers’ own pages in October 2026 and change often. General information, not legal or security advice.
Built well. Costs less. Backed by real engineers.
AI builds your software; engineers check the work and look after it once it's live.
