AI in a law firm: what to automate without putting confidentiality at risk

At a law firm, AI helps most with the administrative work around the legal work: answering “what’s the status?” with the agreed case update, chasing missing documents, organizing the first contact and feeding the firm’s system. Legal questions still go to the responsible attorney. Confidentiality is protected with minimal data, defined access and a person reviewing wherever sensitive information is involved.

Thursday, 4 p.m. The intern interrupts the meeting for the third time. The client in the employment case wants to know the status. The information exists, but it’s scattered: one piece in the legal software, another in the partner’s WhatsApp (the main messaging channel for business in Brazil), another in an email only the secretary saw. She checks all three places, puts the answer together and comes back. Twenty minutes to say “still waiting on the decision.”

How many times a day does this happen at your firm?

Few people count. Nobody logs hours for “looking up status.” Even so, this work eats up someone’s afternoon and interrupts the people who should be thinking about the case.

Before talking about AI, track it for one week: how many status requests come in, through which channel and how long each answer takes. That’s your baseline. Without it, no vendor can tell you whether things improved.

What you can automate

• Agreed status updates. The system checks the recorded case progress and answers in plain language, within what the firm decided to share.
• Missing documents. A list of what’s missing per client and an automatic reminder. “If the power of attorney hasn’t arrived in three days, notify the person in charge.” That’s a rule. It doesn’t even need AI.
• First contact. Sorting out who the person is, what the matter is and how urgent it is, and handing it to the attorney with the context ready.
• Record keeping. What comes in through WhatsApp goes into the firm’s system without anyone copying and pasting.

What stays out

Anything that counts as legal advice. “Am I entitled to this?”, “Should I sign this settlement?”, “How long do I have to appeal?” The system recognizes the type of question and passes it to the responsible attorney, with the message organized. It doesn’t risk even a “general” answer.

Also out: strategy, court filings without review and any message that creates a commitment on behalf of the firm. AI can prepare a draft. A person signs.

Confidentiality and the LGPD in practice

Professional confidentiality is the lawyer’s duty under the Brazilian Bar’s professional rules, and it still applies when a tool enters the picture. The right question about any system is: who sees what?

• Minimal data. To report status, the system needs the case progress. The full filing stays out.
• Role-based access. The front desk sees one thing, the partner sees another.
• Access logs. It’s recorded who accessed what and when.
• Contracts with AI vendors. In writing: how long the data is stored and whether it’s used to train models.

Brazil’s data protection law, the LGPD (Law 13,709/2018), requires a purpose and a legal basis for every processing of personal data. A well-designed system has this documented in the scope before it goes live.

If someone guarantees the solution is “100% secure,” be suspicious. Security is described in concrete decisions: where the data lives, who accesses it and what happens if something goes wrong.

Look first at the software you already pay for

Before hiring something new, see what your current legal software offers. Many already have a client portal, notifications and integrations nobody set up. Sometimes the best recommendation is to turn on what already exists. We say so even when it means not selling anything.

If you want to understand where your firm stands, the AI-ization Diagnostic shows you in a few minutes what you can configure, connect or automate, and what should stay with the attorneys only.

How many times did someone ask for a status update today?