AI client intake for law firms: a governance checklist

Every AI intake demo I have sat through, on both sides of the table, has been impressive. The voice is good. The transcript is accurate. It books the appointment. Then somebody senior asks a question the demo cannot answer, and the room goes quiet.

The best AI intake tools are not the ones that sound most human. They are the ones a COLP, a DPO and a fee-earner can each control. That is an unglamorous claim, and it is the one I would stake the company on, because sounding human is now commodity and being governable is not.

What follows is the checklist I would use if I were buying rather than building. It is deliberately made of questions a vendor either answers concretely or does not.

Does the caller know they are speaking to AI?

This is the first question and it is not close. A system that lets a caller believe they reached a person has created a problem the firm owns, not the vendor. Ask when the disclosure happens, in what words, and whether it can be turned off. If it can be turned off, somebody will turn it off.

The commercial fear is that disclosure loses callers. Our experience is the opposite: people accept an answered phone over an unanswered one, and they accept a machine that is honest about being a machine. What they do not forgive is finding out afterwards.

Can the system refuse to answer?

A model that will always produce something is a liability in a regulated setting. The useful question is not how much it knows, it is what it does at the edge of what it knows.

Ask to see a caller pushing for legal advice. Ask what happens when somebody is distressed. Ask what happens when the caller is a child, or an existing client of the other side, or clearly in the wrong place. A good answer is a refusal, a handoff and a record. A bad answer is a confident paragraph.

Who can see the record?

Intake data is often more sensitive than the matter file that follows it, because at intake nobody has decided yet what is relevant, so everything is captured. What people ring a law firm about is their health, their family or an allegation against them.

Ask whether access follows matter membership, whether an administrator can quietly read everything, and whether looking at a record leaves a trace. In our design, adding somebody to a matter does not retrospectively hand them every conversation ever recorded on it. That is a deliberate constraint and it costs us demo simplicity, which is roughly how you can tell it is real.

Where is the human gate?

Automation should stop before anything reaches the client. Drafting a follow-up is administrative. Sending it is a decision by somebody at the firm, and the difference between those two sentences is most of the risk in this category.

Ask what the system can do without a person: send an email, send a text, book time in a fee-earner's diary, write to a case management system, tell a caller something about their matter. Then ask which of those you can switch off, one by one, rather than as a single all-or-nothing setting.

What should the first deployment include?

• One line or one office, not the whole firm.
• Pre-client contact only: name, number, source, matter category, urgency, availability.
• A written disclosure script the firm has approved.
• An escalation rule for anything urgent or distressing, with a named person on the other end.
• A weekly review of what was captured, booked, escalated and missed.
• An agreed date to stop if the numbers do not move.

The last one matters more than it looks. A pilot with no exit condition is not a pilot, it is a rollout with optimistic branding, and it is how firms end up defending a purchase rather than evaluating it.

The question nobody asks and everybody should

What happens on the calls that are not the demo call? The demo call is always the clean one: a cooperative caller, a common matter type, a quiet room. It tells you almost nothing.

Ask for a recording of a call that went badly. A vendor who cannot produce one either has not run enough real traffic to know, or has and would rather you did not hear it. Both answers are useful.

Why this checklist will get shorter

I think most of these questions have a shelf life. Within a couple of years, disclosure, refusal behaviour and audit trails will be assumed, the way encryption at rest stopped being a differentiator and became a procurement checkbox. Regulators will get there, and so will buyers.

What will still separate products is duller and harder to copy: whether the record the system creates is any good, and whether the firm can act on it a month later. Governance is the entry ticket. The record is the business.

If you are evaluating anything in this category, take the list above into the meeting and write down the answers. A vendor that welcomes the questions is telling you something. So is one that changes the subject.

Frequently asked questions

Does a firm need a DPIA for AI intake? In most cases yes, because you are processing personal data at scale in a new way, frequently including special-category data. Treat it as the first piece of work rather than a document produced after go-live to justify a decision already taken.

Can AI intake ever give legal advice? No, and a system that can be talked into it has failed. Capturing that somebody was dismissed on a date is administration. Telling them whether they have a claim is advice, and it belongs to a lawyer.

What about recording and consent? Notify at the start of the call, keep the notice in the same words every time, and be able to show what was recorded and for how long. The full picture is in can a UK law firm let AI answer client calls.

Who owns the risk if the AI gets it wrong? The firm does, in the eyes of a client and a regulator. That is precisely why the controls above matter more than the voice quality, and why any vendor answer that begins by reassuring you about accuracy is answering a different question.