AI agents for law firms: what 'agentic' means in practice

An AI agent is software that takes steps towards a goal rather than just producing text: it looks things up, fills in forms, sends messages, books appointments or moves work along. For a law firm, the question is not whether a product is 'agentic' but which actions it may take without a person approving them. The fewer and more reversible those actions, the safer the agent.

'Agentic' has become one of the most stretched words in legal technology marketing. It is applied to everything from a chatbot with a booking link to systems that run a multi-stage piece of legal work. This piece gives you a way to cut through that: a four-level scale, a list of actions sorted by risk, and a test to run on any product that calls itself an agent. It sits in our guide to AI for UK law firms.

What is the difference between an AI agent and a chatbot?

A chatbot answers. An agent acts. A chatbot produces a reply and stops; a person decides what to do with it. An agent is given a goal and some tools (a calendar, an email account, a document store, a form) and decides for itself which to use and in what order to reach the goal.

The SRA's Risk Outlook on AI names autonomy as one of the two ways AI differs from ordinary software: some systems can make decisions without the express intent or ongoing control of a person, which can make it harder to say who is responsible for the outputs. That is exactly the property that makes agents useful, and exactly the one a firm has to manage.

How autonomous is an AI agent? A four-level scale

We sort any 'agentic' product by what it may do without a person pressing a button. The levels are ours, offered as a practical tool rather than an industry standard.

• Level 0, suggests. It drafts or recommends; a person does everything. A drafting assistant.
• Level 1, prepares. It assembles the work (a filled form, a drafted message, a proposed booking) and waits for a person to approve before anything leaves the firm.
• Level 2, acts within fixed limits. It takes a small set of pre-approved, reversible actions on its own, such as booking a call-back slot in a calendar or sending a confirmation the firm wrote in advance. Everything else goes to a person.
• Level 3, acts on judgment. It decides what to do and does it, including actions that commit the firm or affect a client's legal position, with review after the fact if at all.

Most of the useful work for a law firm today sits at levels 1 and 2. Level 3, applied to anything that affects a client's legal position, is where the risk concentrates. When the SRA authorised Garfield.Law in 2025, it noted that the system is not autonomous and only takes a step where the client has approved it, which places it at level 1 for the steps that matter. Our piece on the first SRA-approved AI law firm covers that decision.

Which actions can an AI agent safely take for a law firm?

Sort actions, not products. For each action an agent might take, ask two questions: can it be undone, and does it change anyone's legal position or commit the firm? That gives three groups.

• Usually fine on its own (reversible, no legal effect): booking a call-back into a free slot, sending a confirmation the firm pre-wrote, creating a new enquiry record, sending the firm a summary, telling a caller when to expect contact.
• Needs approval (reversible but consequential, or client-facing in new words): sending a client a message the firm has not pre-approved, sharing a matter update, sending a draft to another party, changing a record other people rely on.
• Should not be delegated (irreversible or legally significant): filing anything at court, accepting or rejecting an offer, advising on merits or deadlines, sending money, signing, giving an undertaking.

Write the first group down, per tool, and treat everything not on it as needing approval. An allow-list is safer than a block-list, because the actions you did not think of default to a person.

What can AI agents do for law firms today?

Three broad families of product use the word.

• Document agents. Tools that run multi-step work on documents, such as reviewing a set of contracts against a checklist and producing a report. Harvey, for example, describes purpose-built agents that carry out complex legal work end to end. See what Harvey AI is for a fair account.
• Workflow agents. Tools that move work between systems: creating matters, chasing documents, updating records. Close to traditional automation, with a language model deciding the route. Our law firm workflow automation piece covers the wider category.
• Front-door agents. Tools that deal with people trying to reach the firm: answering the line, gathering details, qualifying the enquiry, booking the call back, keeping clients updated. Their actions are mostly in the 'usually fine' group, which is part of why they are a sensible first use.

Is an AI agent just workflow automation with a new name?

Partly, and it is worth knowing which part. Traditional automation follows rules someone wrote: when a matter is opened, send this letter; when a document arrives, file it here. It does exactly what it was told, including the wrong thing, every time. That predictability is a feature. You can read the rule and know what will happen.

An agent replaces some of those rules with judgment. It reads the email and decides whether it is a new enquiry or a client chasing an update. It works out which of three calendars to use. That flexibility is why agents handle messy, real-world input better than rules do, and also why they are harder to predict. The same input on two different days can produce two different routes.

A sensible design uses both. Let the agent do the reading and sorting, where judgment helps, and let fixed rules govern the actions, where predictability matters. An agent that decides a caller is a new family enquiry is doing useful interpretation. What happens next (book into the family team's call-back slots, send the pre-written confirmation, notify the fee-earner) should be a rule the firm wrote, not a decision the agent makes afresh each time. When a vendor describes its product as agentic, ask which parts are judgment and which are rules. A clear answer is a good sign.

What are the risks of AI agents in law firms?

• Compounding errors. A chatbot's mistake sits in a reply a person reads. An agent's mistake can be acted on by the next step before anyone sees it. Hallucinated facts are more dangerous when something acts on them; see AI hallucinations and law firms.
• Instructions hidden in content. An agent that reads emails or documents can be misled by text inside them written to look like an instruction. Keep agents that read untrusted content away from powerful actions.
• Unclear accountability. If an agent sent it, who decided? The SRA's position is clear for regulated work: named solicitors remain responsible for all the system's outputs. Make sure your records show which actions were taken automatically and which were approved, and by whom.
• Scope creep. An agent given access to the whole mailbox to do one job can do other things. Give each agent the least access its job needs.

How do you test an AI agent before letting it act?

Ask the vendor for, and then check, four things.

• The action list. Every action the agent can take, in writing, marked as automatic or approval-required. If they cannot produce it, the agent's limits are not really defined.
• The log. Show me every action it took yesterday, with the reason and whether a person approved it.
• The stop. How does the firm switch off one action, or the whole agent, immediately?
• The edge. Give it a goal it cannot complete within its limits, and see whether it stops and hands over, or improvises.

Then run it in 'prepare only' mode (level 1) for the first fortnight, even for actions you intend to automate, and read what it would have done. That fortnight tells you whether its judgment matches the firm's.

A worked example

A hypothetical front-door agent, invented for illustration. At 7pm a new caller rings about a dismissal. The agent says it is AI, asks the firm's qualifying questions, records the date of dismissal the caller gives, and books a call-back into a slot the employment team has left open for new enquiries (automatic, reversible). It sends the caller a confirmation the firm wrote in advance (automatic, pre-approved words). It sends the fee-earner a summary (automatic, internal). It does not tell the caller whether they have a claim, and it does not calculate the time limit for a tribunal claim, though it flags that the dismissal date is recent so the fee-earner can check. Three actions, all on the allow-list, none legally significant. That is what a well-bounded agent looks like.

How should a law firm govern AI agents?

Add one column to your AI register: the allow-list of automatic actions for each tool. Review it monthly alongside a sample of the agent's log. Anything added to the list is a partner decision, recorded with the date and reason. AI governance for law firms has a one-page policy and register you can extend this way.

Where Cam sits on the scale

Cam, our AI Engagement Coordinator, works at the front door: it takes calls on the firm's line at any hour, says it is AI, asks the firm's own qualifying questions, books the call back and sends the firm a summary. Those are the reversible, non-legal actions at the safe end of the scale. It does not give advice, file anything or commit the firm to a position. If you want to see where it would sit on your register, we are happy to walk through it.

Frequently asked questions

What is agentic AI in law? It means AI that takes steps towards a goal, such as looking things up, filling in forms or sending messages, rather than only producing text for a person to act on. The key question is which steps it may take without approval.

Are AI agents safe for law firms? They can be, when their automatic actions are few, reversible and without legal effect, when everything else needs a person's approval, and when every action is logged.

Can an AI agent act on a client's behalf? Anything that affects a client's legal position should stay with a person. The SRA noted that Garfield.Law's system only takes a step where the client has approved it.

Who is responsible for what an AI agent does? The firm. For regulated work, the SRA has said named solicitors remain responsible for all a system's outputs and for anything that goes wrong.