Can AI Safely Handle Client Intake for a Law Firm? What to Ask Before You Say Yes

AI can safely support client intake when its role is narrowly defined, its data use is understood, its safeguards are verified and meaningful human oversight remains in place. It should not be trusted simply because it is marketed as secure, private or built for law firms. Before approving any AI intake platform, a firm needs evidence about what the system can do, what it must not do and how the supplier manages information, errors, security incidents and change.

TL:DR: Key takeaways

AI client intake should support administrative processes, not replace professional judgement.
A purpose-built legal platform still requires independent due diligence.
Free and paid AI systems can both create confidentiality risks.
Law firms should assess the supplier, the technology and their own proposed use.
Approval should depend on documented evidence, not a product demonstration alone.

Is AI client intake safe for law firms?

AI client intake can be safe, but only within a controlled operating model.

The technology can be used to ask approved questions, organise information, identify a potentially relevant practice area and support appointment booking. Those are structured tasks with boundaries that a firm can define and test.

The risk increases when the system is expected to interpret legal rights, assess the merits of a matter, provide advice or make unsupervised decisions about whether someone should become a client.

The distinction is not whether a product contains AI. It is whether the firm understands the task, information, consequences and controls involved in using it.

This matters because prospective clients may disclose highly sensitive information during their first interaction. The firm needs to know where that information goes before allowing any system to receive it.

What has the SRA said about law firms using AI?

On 17 August 2026, the Solicitors Regulation Authority published a formal warning notice on the misuse of AI.

The warning explains that free and paid AI systems may both create risks to client confidentiality. Depending on a provider’s terms, settings and technical architecture, information entered into a tool may be stored, retained or used to improve it.

The SRA said firms should satisfy themselves that confidential information:

Remains within an appropriately secure environment.
Cannot be accessed by unauthorised third parties.
Is not used to train AI models without appropriate authorisation.
Is not retained for longer than necessary.
Is protected through contractual, technical and organisational safeguards.

The regulator also reported receiving 42 reports concerning the potential misuse of AI between July 2025 and July 2026. These included issues involving inaccurate legal citations, supervision and confidentiality.

That number should not be used to suggest that AI misuse is universal across the profession. It does show that AI governance is now an active compliance issue rather than a hypothetical concern.

The SRA regulates solicitors in England and Wales. Law firms operating in Northern Ireland, Scotland or Ireland should also consider the requirements and guidance of their own regulators.

Is a purpose-built AI intake platform different from a general chatbot?

A purpose-built intake platform should be designed around a defined operational workflow. A general chatbot is typically designed to respond flexibly across a much wider range of topics.

For a law firm, the important difference should be control.

A purpose-built system should allow the firm to define:

The services it handles.
The questions it asks.
The information it collects.
The criteria used for routing or initial qualification.
The language it can use.
The actions it can take.
The circumstances that require human intervention.

However, the phrase “purpose-built for law firms” is not evidence of safety by itself. The firm must still verify how the system works, where information is processed and whether the controls described by the supplier exist in practice.

The four approval gates for AI client intake

A law firm should not approve an AI intake platform until it can pass four separate decision gates: permitted purpose, information governance, operational control and supplier evidence.

Gate one: Is the permitted purpose clearly defined?

The first question is not what the system can do. It is what the firm needs it to do.

A clear purpose might include receiving an enquiry, gathering specific information and directing a suitable person towards an appointment.

The supplier should be able to explain:

Which tasks are automated.
Which outputs are generated by AI.
Whether responses are scripted, generated or combined.
Whether the system can depart from approved questions.
How the firm’s qualification criteria are configured.
Whether the system can make or recommend substantive decisions.
How out-of-scope questions are handled.

The firm should then document explicit prohibitions.

The system should not be permitted to imply that the firm has accepted instructions, that a solicitor-client relationship exists or that legal advice has been provided. It should not complete professional checks that require information or judgement beyond its approved scope.

If the boundary cannot be explained in simple language, it is unlikely to be sufficiently controlled.

Gate two: Is the information governance defensible?

The firm needs a complete picture of the information lifecycle.

Ask the supplier:

What personal information is collected?
Why is each category required?
Where is the information stored?
In which countries is it processed?
Who can access conversations and records?
How long is information retained?
How is it deleted?
Is it included in backups?
Can it be used to train or improve any model?
Which subprocessors receive it?
Will the firm be notified before those arrangements change?

Data minimisation should begin with the intake design. The system should not request information merely because it might become useful later.

The firm should also identify the lawful basis for the processing and determine whether additional conditions are required for sensitive information. Privacy information should accurately describe how AI is involved and how prospective-client data is handled.

The ICO defines a Data Protection Impact Assessment as a process for systematically identifying and minimising a project’s data-protection risks. Innovative technology, evaluation, sensitive data and large-scale processing can all affect whether one is required.

A firm should screen the proposed use before implementation and document its conclusion. Where a DPIA is required, responsibility remains with the firm even if a supplier assists with the assessment.

Gate three: Does the firm retain operational control?

Human oversight must change what happens when the system reaches its limits.

The platform should have defined escalation conditions for:

Requests for legal advice.
Unclear or contradictory information.
Signs of vulnerability or distress.
Threats of harm.
Urgent deadlines.
Complaints.
Accessibility requirements.
Matters outside the approved practice areas.
Outputs that fall below a defined confidence threshold.
Technical failures.

The firm should know exactly who receives each escalation and how the issue is recorded.

It should also be possible to stop, correct or override an automated pathway. A human reviewer needs enough information to understand what the system asked, what the prospective client said and why a particular outcome occurred.

This reflects the SRA’s position that professional responsibility remains with authorised individuals. AI can support work, but it does not inherit accountability from the solicitor or firm.

Operational control also requires a fallback process. If the system, calendar connection or notification service fails, the firm still needs a reliable way to identify and respond to affected enquiries.

Gate four: Can the supplier support its claims with evidence?

A polished demonstration does not establish security, consistency or regulatory suitability.

The supplier should be prepared to provide relevant evidence covering:

Information-security responsibilities.
Encryption.
Authentication and access control.
Administrative permissions.
Security logging.
Vulnerability management.
Secure development.
Testing.
Backup and recovery.
Incident response.
Business continuity.
Subprocessor oversight.
Staff access and training.

The National Cyber Security Centre’s supplier-assurance questions provide a useful basis for examining personal-data handling, offshore services, authentication, staff controls, subcontractors and security certifications.

Certifications may support due diligence, but their scope matters. The firm should confirm that any certification applies to the service, systems and processing activities it intends to use.

If the supplier cannot provide an answer immediately, it should be able to explain how the information can be obtained. Vague assurances such as “bank-grade security” or “fully compliant” should not replace specific evidence.

What should law firms ask about accuracy?

Accuracy in intake is not limited to whether the wording sounds plausible.

The firm should assess whether the system:

Asks the approved questions consistently.
Records answers correctly.
Distinguishes between missing and negative responses.
Handles unclear language appropriately.
Avoids inventing information.
Applies qualification rules as configured.
Refuses questions outside its scope.
Escalates when confidence is insufficient.
Produces a reliable briefing for human review.

Testing should reflect the firm’s actual services, terminology and risk boundaries. It should also examine both sides of qualification: unsuitable enquiries being progressed and potentially suitable enquiries being excluded.

Ask who is responsible for testing, how defects are documented and whether the firm can review the results.

The supplier should also explain how updates are controlled. A system that performs correctly at approval may change when models, prompts, integrations or underlying services are updated.

How will prospective clients know AI is being used?

Transparency should form part of the interaction rather than being hidden inside legal terms.

A person should be able to understand:

That the interaction is automated.
Why the system is collecting information.
Whether the interaction constitutes advice.
How the information will be used.
How to reach a human.
Where the privacy information can be found.

The language should be clear without overstating what the system can do.

Transparency is also connected to trust. A firm should not present automation as a solicitor, conceal the point at which a human becomes involved or imply that an intake outcome is a professional legal decision.

What happens after the platform is approved?

Approval is the start of governance, not the end.

The firm should assign a named person or group to review:

Complaints and problematic conversations.
Escalations.
Incorrect qualification.
Unexpected outputs.
Abandoned interactions.
Supplier incidents.
Security notifications.
Subprocessor changes.
Product updates.
Changes to the firm’s services or criteria.

The SRA’s compliance guidance for AI and technology identifies leadership, risk assessments, policies, training, monitoring and board oversight as important elements of responsible adoption.

The contract should also address termination. The firm needs to know how information will be exported, returned or deleted if the service ends.

Monitoring should therefore cover performance, compliance and supplier change. A system should not remain approved indefinitely simply because it passed an initial assessment.

Questions to answer before signing

Before committing to an AI intake platform, a law firm should be able to answer:

What specific business task will the system perform?
Which decisions and statements are prohibited?
What information will it collect and why?
Where will that information be stored and processed?
Can any enquiry data be used for model training?
Who can access the information?
Which suppliers and subprocessors are involved?
What contractual protections apply?
Has the need for a DPIA been assessed?
What security evidence has been reviewed?
How has the system been tested?
When must a human intervene?
How are changes approved and monitored?
What happens after an incident or service failure?
How will information be returned or deleted when the contract ends?

A confident supplier should treat these questions as a normal part of procurement.

Where Auvia fits

Auvia is an AI-powered client-intake platform built for law firms and accountancy practices.

According to its website, Auvia responds to website enquiries within seconds, asks qualifying questions, books suitable meetings into fee earners’ calendars and provides a briefing before the consultation. It operates 24 hours a day and allows firms to monitor incoming enquiries and adjust how qualification works.

These are defined intake functions. They do not replace the firm’s responsibility for legal advice, conflicts, professional judgement, confidentiality or final client acceptance.

A demonstration should therefore cover how Auvia would be configured for the firm and how its data handling, safeguards, escalation routes and monitoring fit the firm’s requirements.

The decision is not simply yes or no

AI client intake should not be approved because the technology appears efficient. It should not be rejected solely because it uses AI either.

The responsible decision depends on whether the proposed use is proportionate, controlled and supported by evidence.

Define the task. Trace the information. Verify the supplier. Test the boundaries. Assign accountable human oversight.

If those questions can be answered satisfactorily, AI can support a more responsive intake service without asking the technology to replace the judgement of a solicitor.

See exactly how Auvia handles this. Book a demonstration.

Follow Auvia on LinkedIn for practical guidance on responsible AI intake and professional-services operations.

Frequently asked questions

Can an AI intake system provide legal advice?

It should not provide legal advice unless the firm has deliberately approved that use and established the necessary professional, regulatory and supervisory controls. Most intake platforms should remain within administrative information gathering, routing and appointment support.

Is a legal-sector AI platform automatically compliant?

No. A product’s target market does not prove compliance. The firm must assess its own intended use, contractual position, data flows, security controls and professional obligations.

Can a supplier complete the DPIA for the law firm?

A supplier can provide information and assist with the assessment, but the organisation responsible for the processing retains responsibility for the DPIA and its conclusions.

Should a law firm accept a supplier’s security certification?

A relevant certification can support due diligence. The firm should confirm its validity, scope and relationship to the service being purchased rather than treating the certification as complete assurance.

Who should approve an AI intake platform?

Approval should involve appropriate operational, legal, compliance, data-protection and information-security input. Senior leadership should understand the material risks and assign continuing responsibility after launch.

How often should an AI intake system be reviewed?

It should be reviewed at planned intervals and whenever there is a material change to its purpose, model, data use, integrations, sub-processors, security position or regulatory environment.

null