They might be the strictest but they still feel like they’re band-aids.

Why not explicitly make the service provider explicitly responsible for what the chatbot writes (as if it were a human employee)? That way the company’s incentive is to build meaningful guardrails instead of checking whatever boxes the bureaucrats come up with.