AI Chatbot for Law Firms: Client Intake Without Giving Legal Advice

A visitor lands on your firm's website at 9 p.m. and types "my landlord changed the locks today, what are my rights?" Three things can happen. Nothing until morning, by which time the visitor has called another firm. A chatbot answers the legal question, which is the unauthorised practice of law in your name. Or a chatbot says plainly that it cannot give legal advice, takes the visitor's name, number and type of matter, books a consultation for tomorrow and alerts you tonight.

This guide is for solo practitioners, small-firm partners and office managers who want the third outcome. Every rule and opinion below was read from the issuing body's own text on 16 October 2026. It is general information, not legal advice; your jurisdiction's rules govern, and your bar's ethics line is the place to check anything that matters.

What should a law firm chatbot do, and what must it never do?

A law firm chatbot should answer questions about the firm from content you have published, capture prospective clients and book consultations. It must never apply the law to a visitor's facts, predict an outcome, quote a fee you have not published or let anyone believe a lawyer has taken their case.

An AI support agent is a chatbot that answers from your own knowledge base, takes actions such as booking a meeting, and hands the conversation to a person when it cannot help. For a firm, the knowledge base is the public part of your website plus a few documents you choose.

The right-hand column is where the law draws lines. The Texas Government Code's definition of the practice of law includes "the giving of advice or the rendering of any service requiring the use of legal skill or knowledge, such as preparing a will, contract, or other instrument". The Florida Bar's frequently asked questions give a two-part test: does the advice or service affect important rights of a person under the law, and does protecting those rights require legal skill and knowledge "greater than that possessed by the average citizen". Yes to both means the practice of law, which no bot can be licensed to do. In Florida, under section 454.23 of the Florida Statutes, practising law without a licence, or holding yourself out as qualified to, is a third-degree felony.

What do prospective clients ask a law firm's website?

Most questions a website chatbot receives are about the firm, not the law, and those it answers well. The rest are a handoff.

The questions a bot must not answer are often the ones visitors most want answered, which is a reason to make the handoff fast and specific: "I can't advise on that, but I can book you a consultation with an attorney today or take your details so someone calls you back." The human handoff guide covers the mechanics.

Which ethics rules apply to a law firm chatbot?

The same rules as every other tool in the office: competence, confidentiality, communication, supervision and the bar on misleading statements, plus the prohibition on unauthorised practice. Three sources apply them to generative AI. ABA Formal Opinion 512 of 29 July 2024 says lawyers using these tools "must fully consider their applicable ethical obligations, including their duties to provide competent legal representation, to protect client information, to communicate with clients, to supervise their employees and agents". The Florida Bar's Ethics Opinion 24-1 of 19 January 2024 deals directly with chatbots. The State Bar of California's Practical Guidance for the Use of Generative AI, updated in 2026, lists "autonomously facilitating client intake" among the tasks agentic systems now perform.

Competence: Rule 1.1

Opinion 512 is clear that "lawyers need not become GAI experts. Rather, lawyers must have a reasonable understanding of the capabilities and limitations of the specific GAI technology that the lawyer might use", grounded in Comment 8 to Rule 1.1 and its "benefits and risks associated with relevant technology". For a website chatbot that understanding is modest: it retrieves passages from your content and writes from them, offers a person when the answer is not there, and can be told never to do certain things. California's guidance adds the governing principle: "A lawyer's professional judgment cannot be delegated to AI and remains the lawyer's responsibility at all times."

Confidentiality: Rules 1.6 and 1.18

Opinion 512 notes that Rules 1.9(c) and 1.18(b) "require lawyers to extend similar protections to former and prospective clients' information", so a visitor who describes a dispute is a prospective client and the transcript is their information. Its baseline duty is specific: "all lawyers should read and understand the Terms of Use, privacy policy, and related contractual terms and policies of any GAI tool they use to learn who has access to the information that the lawyer inputs into the tool", and where a tool learns from what is typed into it, informed client consent comes first. California puts it more bluntly: "a lawyer must not input any confidential information of the client into a generative AI solution that may present material risks to confidentiality or security, absent informed client consent", and "Reasonable efforts require more than reliance on generalized marketing assurances." Two rules follow: nothing from a client file belongs in the chatbot's knowledge base, and the bot should collect as little as possible, because everything it collects is information you now hold.

Communication and misleading statements: Rules 1.4 and 7.1

Opinion 512 leaves Rule 7.1, on communications about a lawyer's services, for another day, but points to Florida's opinion as the one that applied the advertising rules to chatbots. Opinion 24-1 warns against an "overly welcoming generative AI chatbot that may provide legal advice" or that may "fail to immediately identify itself as a chatbot", states that "the lawyer will be ultimately responsible in the event the chatbot provides misleading information to prospective clients", and flags the risk that "a prospective client relationship or even a lawyer-client relationship has been created without the lawyer's knowledge". In practice: no "you have a strong case", no fee the website does not state, and nothing that sounds like an engagement.

Supervision: Rule 5.3

Opinion 512 says "Managerial lawyers must establish clear policies regarding the law firm's permissible use of GAI, and supervisory lawyers must make reasonable efforts to ensure that the firm's lawyers and nonlawyers comply with their professional obligations when using GAI tools", and that outside providers must be shown to "do the work capably and protect the confidentiality of information relating to the representation". California adds that the greater a system's autonomy, "the greater the lawyer's obligation to implement oversight mechanisms". A chatbot is a nonlawyer assistant that talks to strangers all night; someone named in a one-page policy reads its transcripts every week.

Do you have to tell visitors the chatbot is AI?

Yes. Florida's Opinion 24-1 says "a lawyer must inform prospective clients that they are communicating with an AI program" and not with a lawyer or law firm employee. In the EU, the AI Act's transparency duty has applied since 2 August 2026, and several US states have their own rules; the guide to AI chatbot disclosure laws covers each of them.

Utah's rule names legal advice. Title 13, Chapter 77 of the Utah Code, in force since 7 May 2025, requires any supplier using generative AI in a consumer transaction to say that the person "is interacting with generative artificial intelligence and not a human" whenever they make "a clear and unambiguous request" to find out. It defines a high-risk artificial intelligence interaction to include "the provision of legal advice or services", and requires anyone in a regulated occupation to "prominently disclose" generative AI in such interactions, "in writing before the start of a written interaction". The chapter ties regulated occupations to Utah's Department of Commerce, while lawyers are licensed through the courts, so whether that proactive duty reaches a law practice is a question for Utah counsel. The on-request duty applies to any supplier, fines run up to $2,500 per violation, and the safe harbor rewards firms that disclose anyway: no enforcement action if the AI "clearly and conspicuously discloses", at the outset and throughout, that it is generative AI, is not human, or "is an artificial intelligence assistant".

That last phrase is a free design spec. Name the bot "Reyes Law AI assistant", not "Sofia", open with "I'm the firm's AI assistant, not a lawyer", and answer "are you a real person?" with "No, I'm an AI assistant. I can book you a consultation with an attorney or take your details." In PepoChat the assistant name takes up to 40 characters.

Where do chat transcripts go, and what should visitors never be asked to type?

Transcripts live on the vendor's systems, so treat the vendor as a provider holding prospective-client information, assess it before launch, and design the bot to collect little. For PepoChat, the privacy notes are the document Opinion 512 tells you to read: messages go to PepoChat's servers, replies come from OpenAI models, and the services involved are Convex, Vercel, OpenAI and Resend, plus Vapi for voice and Dodo Payments for billing. PepoChat does not currently claim a hosting region, a signed data processing agreement template, or certifications such as SOC 2 or ISO 27001, and says to ask rather than assume. Whether that meets the reasonable-efforts duty for the small amount of intake data the bot will hold is the firm's call.

Then limit what it holds:

• Knowledge base. Only public pages and documents you would hand a stranger; anything in it can appear in an answer.
• Intake fields. Email, and optionally name, phone and company, through lead capture, asked once in one sentence.
• Consent text. Up to 300 characters under the pre-chat form, where the "not legal advice, no attorney-client relationship" line belongs.
• Retention. The data retention setting deletes resolved conversations, transcript included, after 30, 90, 180 or 365 days; it is off by default. Contacts stay until you ask support to remove one; the Contacts page has no delete button yet.
• Exports and emails. The inbox's CSV export contains full transcripts and the escalation email quotes the last three messages, so both are copies of prospective-client information outside the product.
• Internal notes. Notes never reach the visitor or the agent, so they are the place for "possible conflict, do not reply until checked".

How should legal intake work in a chatbot?

Collect only what a person needs to call back, state what the chat is and is not, route the lead to where your intake lives, and send urgent matters to a phone. The matter itself waits for the consultation.

A consent line that fits the field: "By sharing your details you agree that Reyes Law may contact you about your enquiry. This chat is not legal advice and does not create an attorney-client relationship." That wording also matches Texas's point that written materials and software are not the practice of law when they "clearly and conspicuously state that the products are not a substitute for the advice of an attorney".

Timing. PepoChat's lead capture can ask before the first message, when the agent needs a follow-up, or right before a handoff. For a firm, before the handoff is usually right: simple questions get an answer without a form, and anyone who needs a lawyer leaves an address. The lead generation guide weighs the three timings.

Routing. When a contact is first captured, new lead notifications can email every member of the workspace (on Starter and Growth), post to Slack, or call a signed webhook that Zapier, Make, n8n or your own endpoint turns into a record in your intake system. There is no native connection to legal practice software; the webhook is the bridge.

Urgent matters. A language model cannot be trusted to judge urgency, so give it a rule: a court date, a deadline, an arrest, being served, a protective order or an emergency means the office number and an immediate handoff.

Conflicts and acceptance stay with people. The bot runs no conflict checks and must never say the firm will take a case. Its job ends at "someone from the firm will review this and contact you", which is why the intake set stops before the other party's name.

Can a law firm chatbot book consultations?

Yes, from a real calendar: the visitor picks a slot in their own time zone and the firm receives a confirmed booking rather than a request to call back.

PepoChat's booking connects to a PepoSmart scheduling calendar. You switch on up to 12 meeting types, write a "when to offer this" note for each, and add up to 2,000 characters of scheduling instructions. When a visitor asks to talk to someone, the agent checks availability over the next 14 days, offers slots in the visitor's local time, asks for a name and email unless the visitor has verified one, and books; PepoSmart re-checks the slot, assigns a host and sends the confirmation and reminders.

Two rules matter for firms. Paid event types are never offered by the agent, so a paid initial consultation is either booked by a person or set up as a free "consultation request" slot with payment handled afterwards. And the meeting type notes keep the bot off matters you do not take: "Only for family law matters in Ohio" stops a Texas criminal case from booking the family lawyer. The appointment booking guide covers timezones and round-robin hosts.

What happens after hours?

The chatbot answers what your website answers at any hour, collects an address from anyone who needs a lawyer, and tells people honestly when a person will reply.

PepoChat's team availability setting has three options: a team that answers in the chat; a team that answers during business hours, outside which the agent uses your away message, asks once for an email and hands over; and "No one answers live chat, we follow up by email", for a firm where nobody watches an inbox, where the agent never promises a person. The away message takes 300 characters, enough for "Our team replies by email within one business day. If your matter cannot wait, call our office line and leave a message, which is checked each morning." The post on 24/7 support without a night shift covers the morning routine, and the guide to AI receptionists covers phone calls.

The hosted chat page gives the agent its own link for your email auto-reply and signature.

What instructions should a law firm give its chatbot?

Brief it like a new receptionist with a short list of hard rules, then test the rules with the questions a real visitor would ask. In PepoChat the two agent instructions fields are "How to sound and behave", up to 4,000 characters, and "Never do this", up to 2,000. The base rules already keep the agent on your content and make it offer a person when it cannot help; your text shapes tone and adds refusals.

How to sound and behave
You are the Reyes Law AI assistant, not a lawyer. Say so in your first reply.
Answer questions about the firm, our practice areas, consultations, fees as published, office hours and what to bring.
Be warm and brief. When someone describes a legal problem, do not comment on it; offer to book a consultation or take their details so an attorney can call.
If someone mentions a court date, a deadline, an arrest, being served papers or an emergency, give our office number and hand the conversation to the team at once.

Never do this
Never give legal advice, apply the law to a visitor's situation, or say whether they have a case.
Never predict an outcome, a timeline or a settlement.
Never quote a fee that is not on the fees page.
Never say or imply that the firm represents the visitor or has accepted their matter.
Never ask for the facts of a matter, the other party's name or documents.
Never say or imply that you are a person.

Then open the test drawer and try to break it; test chats are free, but bookings run for real, so use a test slot. The instruction examples post has more patterns. These six questions are the minimum for a firm, worth running again whenever you add a knowledge source.

How do you know the chatbot is working?

Measure what the bot was allowed to do: intake completed, consultations booked, how quickly a person followed up, and whether it ever crossed a line.

• Intake completion: the share of conversations that end with an email address on the Contacts page or a booking.
• Consultations booked: read from the calendar, split by meeting type.
• Time to first human reply after handoff: from the escalation email to the first callback, inside and outside hours separately.
• Line-crossing incidents: a weekly read of escalated and resolved conversations for anything that resembles advice, a prediction or an unpublished fee. The target is zero, and every miss becomes a new "Never do this" line or a Q&A pair.

Analytics labels every conversation with a topic, so the most asked topics tell you which practice page to write next.

What to do next

Write or tidy the pages the bot will answer from, read your bar's current guidance on generative AI and the vendor's privacy notes, then set up the assistant with the instructions above, lead capture before handoff, the consent line, a retention period and the six test questions. Every feature is on the free plan, including booking, lead capture and data retention, so you can create a free PepoChat workspace and run the whole test before a prospective client sees it; the pricing page lists the paid plans for when the volume justifies them.