For a salon, a clinic, an estate agency or a local service firm, Instagram is often the first place a customer speaks up. A comment under a reel asks about price. A direct message asks whether Saturday is free. Someone shares a listing and asks if it is still available. Each is a sales conversation that begins outside the website, the phone and the booking form, and lands in an inbox that the same few people also use for everything else. An AI-powered social inbox makes sure those conversations are read, sorted and either answered or routed, so that more of them reach a booking.
This article explains how such a system works, what Meta's rules and European law require of it, and how to decide what the AI may answer alone. Another channel is covered in WhatsApp Business Automation for European Companies, but Instagram has different rules and a public comment stream. This is general information, not legal advice. Meta's developer rules change, and the rules below were read from Meta's documentation in October 2026.
What an AI social inbox does
It is closer to a switchboard than to a chatbot that tries to answer everything. The difference matters, and we explain it in AI Agent vs Chatbot. A switchboard decides who should handle each message, and answers itself only when the answer is safe and known.
| Stage | What happens | What it produces |
|---|---|---|
| 1. Collect | Direct messages and comments arrive in one queue through Meta's webhooks | A single inbox for both streams |
| 2. Classify | AI reads each item and assigns an intent, such as a price question, booking request or complaint | An intent label and a confidence level |
| 3. Answer | For approved intents, AI replies from a vetted knowledge base | A reply built from business-approved facts |
| 4. Capture | The system creates or updates a lead in the CRM with the source post, intent and any contact details given | A CRM record with an owner |
| 5. Hand off | Complex or sensitive items go to a named person with the conversation attached | A task with a deadline |
| 6. Report | A weekly summary of volume, handoffs and bookings by source | Input for improving the rules |
The commercial point is the link between stages 4 and 5. A reply that does not end in a booking, a quote request or a CRM record is a conversation that the business cannot count.
Why this channel needs its own design
According to Eurostat, 63.6% of EU enterprises with ten or more employees used social media in 2025, up from 61.1% in 2023. By size class the shares were 60.6% for small, 76.2% for medium and 89.1% for large enterprises. This measures use, not how many customer enquiries arrive there, and we found no EU-wide data on that. The first step in any project is to count your own.
Two streams with different rules
Direct messages and comments look similar to the people who answer them, but Meta treats them differently, and so does the law.
| Feature | Direct messages | Comments |
|---|---|---|
| Visibility | Private | Public to everyone who sees the post |
| Who starts it | The customer | Anyone who comments |
| Time limit | 24 hours to respond to a message | Notified in real time by webhook |
| Access needed | Professional account and message permission | Comment permission, with Advanced Access for comment notifications |
Meta's messaging documentation states that conversations begin when an Instagram user messages the account, and that the app has 24 hours to respond to a message. It describes a way to tag a reply so that a human agent can send it outside the window, but gives no duration for Instagram on that page. Meta's Messenger policy page, which also covers the Instagram messaging API, describes a seven-day period for manual replies and states that sponsored messages are not available through the Instagram messaging API. It adds that messages inside the 24-hour window may contain promotional content.
Comments need a webhook subscription to arrive in real time. According to Meta's webhooks documentation, comment notifications require Advanced Access, a live app and a public account, and comments on live video arrive in a separate field. Permissions differ by login route: the Instagram Login route uses instagram_business_manage_messages and instagram_business_manage_comments, and the Facebook Login route uses instagram_manage_messages, instagram_manage_comments and pages_messaging. An agency building for a client also needs Advanced Access, because the app serves accounts it does not own.
The route from a comment to a private message is called a private reply. Meta's Messenger Platform guide for Instagram says a business can send a private reply within 7 days of the comment, that only one message can be sent to the person who commented, and that the business can continue the conversation only after that person replies, at which point the 24-hour window applies. It lists comments on posts, ads posts, reels and live stories as eligible, with live-story comments answerable only during the broadcast, and states that IGTV comments are not supported. It lists the Human Agent feature and Advanced Access among the requirements. This guide describes the Facebook Login route, and Meta changes these rules, so check the current guide for your login route before you build.
What the AI decides, and what it should not
Classification decides whether the system helps or damages the customer relationship. A message about price and one about a reaction to a treatment can look similar in a keyword list and differ greatly in risk.
| Intent | Example | Default handling |
|---|---|---|
| Price or service question | "How much is a manicure?" | AI answers from the approved price list |
| Booking or availability | "Is Saturday free?" | AI offers slots from the booking system |
| Practical information | "Where do I park?" | AI answers from approved facts |
| High-value enquiry | "Looking for a three-bedroom flat in the centre" | AI asks qualifying questions, creates a lead and alerts a person |
| Complaint | "My appointment was cancelled twice" | Person replies the same day |
| Sensitive or clinical | "My gums are bleeding" | Person replies, AI sends only a neutral booking prompt |
| Spam or scam | A link offering followers | Hidden or ignored under policy, and logged |
| Partnership or press | "We would like to collaborate" | Person |
Two rules keep this safe. When confidence in an intent is low, the item goes to a person, and any message that touches health, money, legal rights or a complaint goes to a person whatever the confidence. How far an agent should act alone is covered in How Much Autonomy Should an AI Agent Have Before a Human Steps In?.
From message to CRM record
A lead is only useful when it can be found and acted on. Instagram typically identifies a sender by a platform identifier and a username, so a phone number or email address reaches the CRM only if the customer provides it. The system should ask for contact details when it is needed for the next step, such as confirming a booking, and should say why.
A usable record carries a small set of fields: the source and the post or reel it came from; the intent; the stage; the owner; the time of the first reply; and, where contact details were given, the basis on which they are held. The system should link a customer who comments today and messages tomorrow to the same record. Collect only what the next step needs. The workflow platforms that connect Instagram, an AI model and a CRM, and how they are priced by unit, are compared in n8n vs Make vs Zapier.
The rules that apply in Europe
Say that it is automated. Meta's documentation states that automated chat experiences must disclose that the user is talking to an automated service where the law requires it, at the start of a conversation, after a long gap, and when a chat moves from a person to automation. It recommends disclosure even where the law does not demand it, with wording such as "You are talking to a bot". Under the EU AI Act, Article 50(1) requires providers to ensure that systems intended to interact directly with people are designed so that the people concerned are informed they are interacting with an AI system, unless this is obvious to a reasonably well-informed, observant and circumspect person. Article 50(5) requires the information to be given in a clear and distinguishable manner at the latest at the first interaction. The Commission's guidance says the obviousness exception should be read restrictively and that Article 50 applies from 2 August 2026. The only grace period it gives, until 2 December 2026, covers the marking of AI-generated content under Article 50(2) for systems already on the market, not chatbot disclosure.
On the status of the law in October 2026: the EUR-Lex record shows that Regulation (EU) 2026/1744, the Digital Omnibus on AI, is dated 8 July 2026 and entered into force on 27 July 2026. A law-firm summary reports that it moved the high-risk deadlines to 2 December 2027 and 2 August 2028 and left Article 50 on its original date. We could not read the omnibus text itself, so check the consolidated AI Act. Under Article 99(4), infringements of the Article 50 obligations can bring fines of up to €15 million or 3% of worldwide annual turnover, whichever is higher, and under Article 99(6) the lower of the two amounts applies to SMEs. Whether the business or the tool builder is the provider depends on the setup, which is a question for legal advice. The wider picture is in EU AI Act 2026: What SMBs Actually Need to Do Now.
Handle personal data deliberately. Names, usernames, messages and contact details are personal data under the GDPR. A business that puts them into its CRM is typically the controller, and an AI or workflow tool that processes them for it is typically a processor, which requires a contract under Article 28. The roles depend on the specific contracts and set-up. The questions to ask a tool provider are in Is Your Business Data Safe with AI? What Every European Company Should Know Before Automating.
Treat health data as a special case. Data concerning health is a special category under Article 9. For a clinic, the safe design is that the AI collects no symptoms or diagnoses and moves the person to a booking or to a staff member. A public reply that confirms someone's appointment can reveal that they are a patient, so public replies should not refer to a specific person's treatment. The sector differences are covered in AI Automation for Specific Industries: Dental, Real Estate, Accounting, and E-commerce.
Keep marketing separate from service. Meta states that messages within the 24-hour window may contain promotional content. That is a platform rule, not an answer to whether you may send marketing to a given person under ePrivacy and national direct-marketing law.
One conversation from start to finish
A flow is easier to judge than a list of features. This one follows a single customer of the salon group in the scenario below, from a comment under a reel to a person on the team.
| Step | What happens | Rule or design point |
|---|---|---|
| 1. Comment | A viewer writes under a reel: "How much is balayage?" The comment arrives by webhook and is classified as a price question | The post must be on a public account, and the app needs comment notification access |
| 2. Public reply | The system posts an approved reply with the price range from the business's list and an invitation to send a message | Public text carries only what you would put on a poster, with no personal details |
| 3. Move to a message | The customer sends a message, or the business sends one private reply | One private reply within 7 days, and the conversation continues only after the customer replies |
| 4. Qualification | The first line says the reply comes from an automated assistant, then it asks three things: the service, the preferred day and the nearest salon | Ask only what the booking needs |
| 5. CRM | A lead is created with the source reel, the intent, the service, the day and a note of what the customer agreed to | Link it to the same customer if they message again |
| 6. Booking | The system offers slots from the calendar and confirms one | If no slot fits, the item goes to step 7 |
| 7. Manager | A task with the conversation attached goes to the manager when a trigger fires, such as an allergy question, a complaint, a price exception or low confidence | The deadline falls inside the 24-hour window |
Each step has a point where a person can see what happened and step in. That visibility is what makes it reasonable to let the AI handle steps 1 to 6.
What it could be worth: a worked example
Illustrative calculation, not a forecast and not a client result. Every figure below is an assumption chosen to show the method, and each should be replaced with your own count.
| Input | Assumed value | Where your real figure comes from |
|---|---|---|
| Instagram enquiries per month, messages and comments with a question | 500 | A count of the last three months |
| Share answered within 24 hours today | 70% | Message timestamps |
| Share of unanswered enquiries the AI may handle under the matrix | 60% | The intent sample |
| Share of those that would have booked, in a low, central and high case | 5%, 10% and 15% | A pilot |
| Value of a new customer over twelve months | €135 revenue at 60% margin, so €81 | Your booking data |
| Running cost per month | €300 | Quotes and a time log |
| One-off setup | €4,000 | A quote |
The running cost assumes €150 for the platform and AI usage, €50 for calendar and CRM add-ons, and five hours of staff review at €20. How vendors count usage is explained in How to Read an AI Agent Price List: A Buyer's Guide.
The calculation runs in six steps. Of 500 enquiries, 30% go unanswered in time, which is 150. The AI may handle 60% of those, which is 90. At a 5%, 10% or 15% booking rate that recovers 4.5, 9 or 13.5 new customers a month. Each is worth €81 in contribution, and the running cost is deducted. Payback is the setup cost divided by the monthly net.
| Case | New customers a month | Monthly contribution | Monthly net after running cost | Payback on €4,000 |
|---|---|---|---|---|
| Low | 4.5 | €364.50 | €64.50 | 62 months |
| Central | 9 | €729.00 | €429.00 | 9.3 months |
| High | 13.5 | €1,093.50 | €793.50 | 5.0 months |
Under these assumptions the break-even point is 3.7 recovered customers a month, which is €300 divided by €81. The low case clears it only just, and volume matters: with 200 enquiries a month instead of 500, the central case recovers 3.6 customers and does not cover the running cost. The method also leaves things out. It counts only recovered enquiries, not faster replies to enquiries that were already answered, it ignores staff time saved, and it books the twelve-month value at the moment of acquisition. The number of unanswered enquiries and the booking rate are the least certain inputs, so measure them in a pilot before relying on the result. The measurement approach is in How to Measure ROI from AI Automation: A Practical Guide for European Small Businesses.
A framework for deciding what the AI may answer
This is a Kubera AI planning heuristic, not a validated method. It is meant to turn a vague wish to automate replies into a short list of decisions that a team can approve.
The Kubera Reply Rights Matrix has five steps:
| Step | Question to ask | What to do | Example output |
|---|---|---|---|
| 1. Sample the real inbox | What do customers actually write | Label a recent sample of messages and comments by intent | A ranked list of intents |
| 2. Assign reply rights | Who may answer each intent | Give each intent one of three rights: AI answers alone, AI drafts and a person sends, or person only | A table of intents and rights |
| 3. Set triggers and deadlines | When does a person take over, and how fast | Define handoff triggers and a human reply deadline inside the 24-hour window | A trigger list and a reply deadline |
| 4. Define the record | What must the CRM hold | Choose the fields and stages that follow from step 2 | A CRM field list |
| 5. Review and widen | When does an intent move to a higher right | Review a sample of sent replies each week and widen rights only after the review | A weekly review log |
Step 5 is the safeguard: rights widen as the team reads real replies, not when the system looks confident.
How the pattern differs by business
| Business | Typical intents | AI can handle | A person should handle |
|---|---|---|---|
| Beauty salon | Price, availability, aftercare, rebooking | Price list, slots, opening hours | Reactions to a treatment, complaints |
| Clinic | Booking, location, insurance questions | Booking requests and practical information | Symptoms, results, anything clinical |
| Estate agency | Availability, viewings, price | Listing facts, viewing slots, qualifying questions | Negotiation, buyer verification |
| Local service firm | Quote requests, scope, scheduling | Collecting job details, booking a survey | Price exceptions, complaints |
Where this plays out in practice
Illustrative scenario, not a specific Kubera client: a group of four beauty salons in a mid-size European city has two people at the front desks who answer Instagram between appointments. Comments asking for prices are answered late or not at all, and evening messages wait until the next morning.
The group applies the matrix to a sample of its recent inbox. Most items are price, availability and opening-hours questions, so the AI gets the right to answer those from an approved price list and the booking calendar, with a first line saying the reply comes from an automated assistant. Allergy questions, reactions and complaints go to the salon manager, and the AI sends only a neutral holding message. The group records its response times and booking counts before switching on the AI and reviews a sample of sent replies each week. We describe the design intent here, not a measured result.
Measuring whether it works
Track five things: first response time against a baseline taken before the pilot, the share of items handed to a person, the message-to-booking rate, a weekly score of sampled replies for accuracy and tone, and the time complaints take to reach a person. A falling handoff share is not necessarily good, since it may mean the rules have become too wide. Attribution on Instagram is weak, so the booking system should record how the customer arrived. The AI is only as good as the facts it replies from, which is why the approved price list and policies should live in a maintained knowledge base, as described in How to Build an Internal Knowledge Base with AI.
FAQ
Is it allowed to automate Instagram messages?
Meta provides a messaging API for professional accounts that supports automated replies, subject to its policies. Compliance with data protection and AI transparency rules is a separate matter, as covered above.
Can the AI message everyone who comments?
Not freely. Meta's guide allows one private reply to a commenter within 7 days of the comment, and further messages only after the person replies. Mass promotional messaging also raises ePrivacy and direct-marketing questions, so check the current guide and national rules.
Do we have to tell customers they are talking to a bot?
Meta requires disclosure where the law demands it and recommends it elsewhere. Article 50(1) of the AI Act requires providers to design systems so that people are informed, unless it is obvious, and applies from 2 August 2026. A clear first line in every automated conversation covers both.
What happens after the 24-hour window?
Meta gives the app 24 hours to respond. Its policy page describes a seven-day period for manual human-agent replies, but we could not confirm the Instagram details, so check them. Design the handoff deadline to fall inside the window.
Should the AI answer medical or legal questions?
No. Route them to a person and keep the AI to booking and practical information. For clinics this is also a data protection safeguard.
What does the setup need technically?
An Instagram professional account, a Meta app with permissions and webhooks, a workflow layer, a CRM and a calendar system.
How fast should replies be?
We found no verified European benchmark. Set a target from your own baseline, with Meta's 24-hour window as the limit.
How do we stop wrong answers?
Restrict the AI to an approved knowledge base, give it narrow reply rights and review a weekly sample of sent replies. Widen rights only when the review supports it.
Where should a small team start?
With one intent that is frequent and low risk, such as opening hours and prices. The method for choosing is in How to Choose Your First AI Automation Project.
If you would like to work out which Instagram conversations your business can answer with AI, which must stay with your team, and how to connect them to your CRM, that is design work worth doing before you switch anything on.