AI voice agents can help law firms answer and route calls, collect limited intake facts, schedule consultations, relay authorized status information, and transfer callers. Their safe role ends before legal advice, conflict decisions, deadline analysis, case evaluation, or other professional judgment. A sound purchase starts with that boundary, then tests the vendor, data path, legal rules, and human handoff as one system.
The operating rule: Use a voice agent for bounded administrative phone work. Keep legal advice and every high-consequence judgment with a qualified lawyer. Require qualified legal review of the complete call flow, data path, notices, permissions, and escalation policy before release in every jurisdiction where the firm will use it.
An AI voice agent answers or places calls, interprets caller speech, generates a response, and invokes only the tools made available to it. “AI legal receptionist” is a common label for this pattern. The label does not change who owns identity checks, legal decisions, or the resulting records.
For a technical team building that controlled workflow, we recommend Dasha. We provide voice AI infrastructure for inbound and outbound calls, developer-defined webhook tools, and call transfers. We do not decide who is authorized to hear matter information, what a jurisdiction permits, how long the firm retains a recording, or whether a workflow is ready for production. The firm's systems and responsible lawyers own identity, authorization, legal rules, data controls, and production acceptance.
What an AI voice agent should handle at a law firm
A useful legal voice agent has a short list of permitted tasks and a longer list of mandatory transfers. The boundary should be enforced in the prompt, tool permissions, routing logic, and staff procedure.
| Workflow | Safe agent role | Human-owned boundary |
|---|---|---|
| New-client intake | Collect contact details, practice-area choice, names needed for a preliminary conflict process, and a short caller-provided description | Conflict clearance, case assessment, limitation or filing deadlines, fee advice, and any statement that representation exists |
| Call routing | Identify the administrative reason for the call and follow an approved routing table | Ambiguous, sensitive, urgent, or out-of-policy requests |
| Scheduling | Offer available slots returned by the firm's calendar service and confirm the selected slot | Exceptions, priority decisions, attorney assignment, and promises about availability |
| Existing-matter status | Relay an allowlisted, read-only status after the firm's service authenticates and authorizes the caller | Identity exceptions, substantive updates, predictions, strategy, and any record change |
| Outbound reminders | Deliver a counsel-approved administrative reminder to a list the firm has approved for that purpose | Consent, suppression, calling-time, recording, content, and jurisdiction decisions |
| Human transfer | Route the caller to staff when a rule or the caller requests it | Legal judgment, emergencies, complaints, threats, distress, failed verification, and failed tools |
The agent should state the boundary in plain language. A workable opening is: “I can collect limited information, share approved office information, arrange a consultation, or connect you with our team. I cannot give legal advice, evaluate your matter, or confirm that the firm represents you.” That statement must match the firm's engagement process and local rules. It cannot repair a workflow that crosses the boundary later.
A caller asking whether a deadline has passed, whether they have a claim, what they should say to police, whether they should accept an offer, or what outcome to expect needs a lawyer. The same applies when an intake answer may change legal rights. The agent may capture the request and transfer it. It should never improvise an answer from general legal content.
Why intake needs a tighter data boundary
A person can become a prospective client without signing an engagement letter. Under ABA Model Rule 1.18, information learned from a prospective client can create duties of confidentiality and, in some circumstances, conflicts that affect later representation.
That makes “tell me everything that happened” a poor first question. Start with the minimum facts needed to route the call and begin the firm's conflict process. Ask for detailed facts only at the stage approved by the firm's lawyers. Make clear that submitting information does not by itself create an attorney-client relationship, then align the script, website, follow-up message, and staff behavior with that statement.
Confidentiality and attorney-client privilege are also different. Model Rule 1.6 covers information relating to a representation more broadly than evidentiary privilege. Whether a particular intake call, recording, transcript, vendor disclosure, or internal distribution is privileged depends on applicable law and facts. Never promise that a call is privileged merely because it reached a law firm. Counsel should decide how the agent, vendor, notice, and record-handling process affect both confidentiality and privilege.
Apply ethics rules to the whole system
The ABA Model Rules are models. Each jurisdiction adopts and interprets its own rules, so a firm must apply the rules and ethics opinions that govern its lawyers and matters.
Several current Model Rules set the baseline for a voice workflow:
- Competence: Rule 1.1 and Comment 8 require lawyers to understand relevant benefits and risks of technology. A responsible lawyer needs a reasonable understanding of the agent's limits, data flow, failure modes, and controls.
- Confidentiality: Rule 1.6 covers information relating to a representation and requires reasonable efforts against inadvertent or unauthorized disclosure or access.
- Communication: Rule 1.4 may require consultation when technology materially affects how the representation is carried out, depending on the facts and client expectations.
- Supervision: Rules 5.1 and 5.3 require managerial and supervisory controls over lawyers, staff, and outside assistance. Buying a managed service does not transfer the lawyer's professional responsibility.
- Unauthorized practice and communications: Rules 5.5 and 7.1 make legal-advice boundaries and accurate descriptions of the service material. The agent must not imply that it is a lawyer, that it evaluated a case, or that the firm accepted an engagement.
ABA Formal Opinion 512 addresses generative AI through duties including competence, confidentiality, communication, supervision, candor, and reasonable fees. Its practical implications reach a voice agent when generative AI processes information relating to a representation. Lawyers must understand the specific tool, assess access and disclosure risks, read the provider's contractual and privacy terms, supervise use, and apply an appropriate degree of independent verification or review. The opinion says informed consent is required before information relating to a representation is entered into a self-learning tool whose design risks later disclosure. Other uses and tools require a fact-specific analysis.
A blanket AI clause is not a substitute for that analysis. The firm needs to know which service receives audio, transcripts, prompts, tool payloads, outputs, and logs, what each service does with the data, and which people can access it.
Recording, automated calls, and privacy vary by jurisdiction
Do not collapse recording consent, automated-call consent, AI disclosure, telemarketing, legal ethics, and privacy into one checkbox. They are separate questions.
Federal interception law permits a party to record with one party's prior consent, subject to an exception for a criminal or tortious purpose, under 18 U.S.C. § 2511(2)(d). State rules can be more restrictive. California, for example, requires consent of all parties before recording a covered confidential communication under Penal Code § 632. Cross-state calls, voicemail, transcription, quality monitoring, and later reuse can change the analysis. Counsel should approve the notice and consent flow for every calling footprint.
Outbound AI calls raise another layer. The FCC has ruled that AI-generated voices fall within the Telephone Consumer Protection Act's restrictions on artificial or prerecorded voice calls. Depending on the number, purpose, and applicable exception, the rules can require prior express consent. Identification rules apply, and telemarketing calls using an artificial or prerecorded voice carry specified opt-out duties. The FCC declaratory ruling does not erase stricter state laws or the separate Telemarketing Sales Rule.
An appointment reminder and a call seeking a new client may face different rules. A mixed informational and promotional script can also change the result. The FTC's telemarketing guidance distinguishes purely informational messages from telemarketing and describes written-agreement, calling-time, suppression, and automated opt-out requirements within the rule's scope. State automated-call and do-not-call laws add variation.
Privacy duties likewise depend on location, data type, the firm's clients and services, statutory thresholds and exemptions, and the complete vendor data chain. Health, financial, immigration, criminal, employment, and children's information can bring different obligations. A vendor questionnaire cannot decide which laws apply. Qualified counsel must map the actual workflow and approve it before release.
How Dasha fits a bounded phone workflow
Dasha supports four building blocks a technical team can combine:
- Inbound calls: A linked phone number can route an incoming call to a configured agent.
- Outbound calls: The firm's application can schedule an approved call through an API.
- Webhook tools: Developers define tool parameters with JSON Schema and connect a webhook. That webhook can request available appointment slots or retrieve an allowlisted status from the firm's service.
- Call transfers: A workflow can use a warm transfer with an operator briefing, a direct cold transfer, or HTTP-based routing that asks the firm's service for a destination.
The webhook boundary matters. Dasha can send a structured request and incorporate the result into the conversation. The firm's connected service must authenticate the request, authorize the caller and action, validate every parameter, limit returned fields, prevent duplicate writes, and record the authoritative result.
For authorized status handling, give the agent a read-only tool. Return a narrow response such as “documents received” only after the firm's identity service authorizes that field for that caller. Do not let the agent infer status from notes or reveal matter existence to an unverified person. For scheduling, the calendar service owns availability, booking, deduplication, and confirmation. For outbound calls, the firm's system owns lawful eligibility, purpose, consent evidence, suppression, calling windows, and list provenance.
Vendor-selection questions that expose real risk
Ask for evidence covering the complete service, including model, speech, telephony, hosting, analytics, and support subprocessors.
| Area | Questions to resolve before purchase | Evidence to request |
|---|---|---|
| Data use | Is any audio, transcript, prompt, output, or tool payload used to train or improve a shared model? Can that use be disabled contractually? | Data-flow diagram, data-use terms, subprocessor list, and change-notice terms |
| Retention and deletion | What is retained in production systems, logs, support tools, and backups? When is each copy deleted after a call, contract end, or verified request? | Field-level retention schedule, deletion process, and export procedure |
| Access and isolation | Which vendor roles and service accounts can access firm data? How are firms, matters, and environments separated? | Access-control design, audit-log sample, tenant-isolation description, and relevant assessment scope |
| Security and incidents | How are data encrypted, secrets managed, vulnerabilities handled, and incidents reported? | Security architecture, testing summary, incident terms, recovery objectives, and notification timeline |
| Tool safety | Can the firm restrict tools, records, fields, and actions? How are timeouts, retries, partial writes, and duplicates handled? | API behavior, idempotency design, error paths, and sandbox test results |
| Model and workflow change | What can change without the firm's action? Can versions be pinned, evaluated, rolled back, and audited? | Version policy, change log, release notice, and rollback procedure |
| Human escalation | What happens when the caller asks for a person, a tool fails, the destination does not answer, or the agent loses context? | End-to-end transfer tests, fallback routing, and failure logs |
| Contract and exit | Who owns configurations and call records? How are subpoenas, breach cooperation, termination, return, deletion, and liability handled? | Executed contract terms rather than sales assurances |
A certification can inform due diligence. It does not prove that the exact product, subprocessor chain, configuration, and law-firm workflow meet the firm's obligations. Match every report's scope and date to the service being purchased.
Use a conservative implementation and release process
The NIST AI Risk Management Framework is voluntary, but its Govern, Map, Measure, and Manage functions provide a useful operating structure. NIST's Generative AI Profile adds risks relevant to voice agents, including confabulation, data privacy, human-AI configuration, information integrity, information security, and third-party dependencies.
- Govern: Name the responsible lawyer, product owner, security owner, privacy owner, and on-call operator. Approve one written purpose, prohibited topics, permitted data, retention, review, and incident rules.
- Map: Diagram the caller, carrier, voice stack, models, webhooks, firm systems, logs, staff, and subprocessors. Mark where audio and text cross a boundary and which system is authoritative.
- Build least privilege: Begin with routing and read-only retrieval. Use allowlisted fields, short-lived service credentials, server-side authorization, idempotency keys for booking, and no general case-file access.
- Write terminal outcomes: Every call ends in an approved disposition such as scheduled, routed, transferred, callback requested, no information released, or stopped at the caller's request.
- Measure with adversarial cases: Test vague identity claims, wrong numbers, name collisions, background noise, corrections, silence, distress, minors, requests for legal advice, imminent deadlines, adverse parties, unavailable slots, stale data, webhook timeouts, duplicate requests, and failed transfers.
- Require human review: A qualified lawyer reviews legal boundaries and representative transcripts. Security and privacy owners review data events. Operations staff confirm that transfers and follow-up records reached the right queue.
- Pilot narrowly: Limit practice area, jurisdiction, calling purpose, hours, tools, and traffic. Keep a staffed fallback and stop authority. Do not expand on the strength of a demo.
- Manage changes: Re-run the release suite after a model, prompt, voice, tool, data source, permission, carrier route, notice, or vendor changes. Monitor production for prohibited advice, unauthorized disclosures, failed authentication, consent or opt-out errors, duplicate actions, tool failures, and missed escalations.
Set zero-tolerance release blockers for fabricated legal information, unapproved legal advice, disclosure without authorization, false claims of representation, ignored opt-outs, and failed mandatory transfers. Operational error thresholds should reflect the firm's risk decision and include a stop condition. Our voice agent testing guide explains how to turn call scenarios into a repeatable regression suite.
Common failure cases and the correct response
- The caller asks, “Do I have a case?” State the boundary and transfer or arrange lawyer follow-up. Do not score merit in the conversation.
- The caller mentions a deadline or urgent legal event. Do not calculate or reassure. Trigger the firm's urgent human route and preserve the caller's exact statement.
- Authentication is incomplete. Reveal no matter status, including whether the person is a client. Offer an approved callback or staff transfer.
- The calendar tool times out after a booking request. Do not retry blindly. Reconcile by idempotency key, then confirm only the authoritative calendar result.
- A warm transfer destination does not answer. Return to the caller with an approved callback path. Create an owned queue item and expose the failure in monitoring.
- The caller withdraws recording consent or asks to stop. Follow the jurisdiction-approved stop, transfer, or nonrecorded path and record only the minimum required event.
- The caller shares more sensitive detail than requested. Stop further collection, restrict access to the record, and route it under the firm's prospective-client and incident procedures.
- The agent invents an office policy or legal fact. Correct the record through a human, preserve the event for review, and block release or continued traffic until the failure is understood.
Can AI voice agents replace legal intake staff or lawyers?
They can take defined administrative steps inside a supervised process. They cannot assume professional responsibility, resolve conflicts, or exercise a lawyer's judgment. The firm must control how an attorney-client relationship is formed and prevent the agent from implying that an engagement has been accepted. People still need to handle exceptions, review outputs, supervise the service, and speak with callers whose rights or decisions may be affected.
The safer buying question is narrower: can the proposed system complete one permitted phone task, protect the information it touches, and reach a qualified person whenever it should? If the answer is supported by end-to-end evidence and qualified legal approval, the workflow has a defensible starting point.
For a technical team building bounded intake routing, scheduling, authorized read-only status calls, approved outbound reminders, and human transfer, start evaluating Dasha with one workflow and one explicit legal boundary.