AI for client intake at a law firm: where to draw the line

AI can take a law firm's client intake from a pile of messy inquiries to organized, ready files, but the automation is not the hard part. The hard part is the boundary: which intake data the AI touches and which stays in human hands. Get that line wrong and you can automate your way into a confidentiality problem faster than you ever saved time, because intake is the first place a prospective client hands you sensitive facts.

Every intake vendor sells the same picture: a form goes in, an organized matter comes out, and nobody has to think about what happens in between. That is the quiet lie. That space in between is where a firm can automate its way into trouble. The inquiry has to sit somewhere, and the tool may quietly keep a copy. Automating intake is worth doing. The only question that matters is where the line goes.

What does client intake involve at a small firm?

Intake is the pipeline from first contact to opened matter. A prospective client fills out a web form, sends an email, or leaves a voicemail. Someone reads it, decides whether it is the kind of work the firm takes, checks for conflicts, and either books a consult or sends a decline. If the answer is yes, the scattered details become a clean record: names, parties, dates, the nature of the problem, and whatever the client attached. Most of that is sorting and formatting, the dull work AI is genuinely good at. Some of it is judgment about people and risk, which it is not.

Where does AI actually fit in the intake flow?

In the sorting, not the judgment. AI is strong at the mechanical layer: reading a long, rambling inquiry and pulling out the structured facts, drafting a neutral summary, tagging the practice area, turning a voicemail into a tidy note, flagging a possible conflict for a human to confirm. It is weak, and belongs nowhere near, the points that decide something: whether to take the case, what the matter is worth, what to tell the client. Keep AI on the side that organizes information and off the side that exercises judgment, and most of the risk in automating intake goes away.

Where does the intake data sit between the form and the matter file?

This is the question the sales pitch skips, and it is the one that counts. The moment an intake message leaves the prospective client and lands inside an AI tool, it is sitting on someone's server and being processed under whatever contract governs that tool. Two things can go wrong there. First, the model can misread the inquiry: a language model predicts probable-looking text, so it can smooth a gap into a confident summary the client never gave, which is why a person has to read the source before that summary becomes the record. Second, and quieter, the data can be retained or used to train the tool, depending entirely on which account and which plan the firm is running.

What should a firm check before routing intake through an AI tool?

Read what the tool's contract says about your data, because the same brand can behave in opposite ways. On a business footing the terms can be reassuring. OpenAI's data processing addendum states that OpenAI 'acts as a Data Processor on the Customer's behalf' and 'will process Customer Data only in accordance with Customer Instructions.' That is a vendor agreeing, in writing, to handle the data only as directed and not for its own ends. The consumer side is a different animal. Microsoft's privacy statement is blunt about consumer Copilot: 'In certain markets, we use conversation data to train the generative AI models in Copilot, unless you choose to opt-out of such training.' Same company, two regimes, one of them quietly feeding your inputs back into the model.

The trap is assuming the product name tells you which regime you are in. It does not; the tier the firm bought does. Microsoft's own statement notes that where an enterprise agreement conflicts with the consumer privacy terms, 'the terms of those agreement(s) will control,' so a firm on enterprise Copilot is governed by a contract its marketing page never mentions. The ABA's first ethics opinion on these tools, Formal Opinion 512 from July 2024, frames the lawyer's job around understanding how a tool uses data and keeping client information protected. It does not bless or ban any product. Put in intake terms, the message is plain: before a client inquiry ever flows through a tool, someone should know what plan it runs on, whether it learns from inputs, and where the data rests. That is the boundary, and most firms never draw it. That, not the technology, is why intake automation goes wrong.

So should a small firm automate client intake?

Yes, and it is one of the best places to start, because intake is repetitive and mostly sorting. The firms that get it right do three unglamorous things first. They map where the data flows. They pick a tool whose contract says it will not learn from the input. And they put a human review step at the threshold between the raw inquiry and the opened matter. Done that way, AI takes the tedium out of intake and leaves the judgment where it belongs. The boundary question is the right place to begin, and it is exactly what a Workflow Build maps before anything gets automated. A short call can tell you whether your current intake flow has a clean line, or just a black box.