AI Voice Agents for Law Firm Intake: Privilege Starts at Hello

An AI voice agent for law firm intake qualifies a caller on practice area, jurisdiction, filing deadline and conflicts before an attorney spends time on the matter. The harder part is that what the caller says is confidential from the first sentence, so where the call data travels matters as much as what the agent asks.

Key Takeaways

• A caller is confidential before the firm agrees to anything.
• The conflict check is supposed to come first. Callers do not wait.
• You cannot prove an agent never gave advice. Limit what it can say.

The first call decides which cases a firm ever gets to work on. Everything downstream is shaped by a conversation that usually happens with whoever picked up the phone. We build Dograh, an open source voice agent platform, for calls where what the caller says cannot leave the firm's own systems.

What the first call actually has to decide

Four separate decisions come out of that one call, and none of them are the conversation the caller thinks they are having.

The firm needs to know the practice area, because a family law caller who reaches a personal injury firm is a referral and not a case. It needs the jurisdiction, because the answer changes by state and sometimes by county. It needs to know how long ago the incident happened, because the filing deadline may already have passed. And it needs to know whether the firm is already acting for somebody on the other side of the matter.

Human intake staff do this well when they are available. Accidents do not happen during office hours, and the caller who reaches voicemail usually calls the next firm on the list.

A voice agent can hold that conversation instead. It is the problem we wrote about in the verify-before-you-talk ordering for collections work, where the law dictates what the agent may say and in what order. Legal intake has a harder version.

The caller is confidential before you agree to take the case

Confidentiality starts when the caller starts talking, not when somebody signs a retainer.

That is the part most intake automation skips. Someone who calls, describes an accident, and never hears back is still a person whose disclosures are protected. The firm took on a duty by listening.

Courts have started to work out what that means when software is in the room. In United States v. Heppner, No. 25-cr-00503-JSR, a judge in the Southern District of New York held that material produced by running privileged information through a public AI platform was not protected, writing that "a public-facing AI platform owes no duties of loyalty or confidentiality to its users."

Read that carefully before applying it. Heppner involved a defendant putting his own situation into a public tool, not a law firm routing calls through a contracted vendor, and it does not hold that using a vendor waives privilege. What it shows is the test a court applies, which is whether the third party in the chain owed a duty of confidentiality at all, and that depends on architecture. Other federal courts in 2026 went the other way in civil matters, finding no waiver where nothing was disclosed to an adversary, so how privilege and work product interact with generative AI is still unsettled. A split is not a reason to relax. It is a reason not to let a client's case be the one that settles the question.

The conflict check has to run before you know enough to run it

The rule says check for conflicts before you take in case details, and a phone call makes that almost impossible to do in that order.

Conflict screening means matching the caller and every adverse party, including any related companies, against the firm's existing client list. Guidance on how firms run conflict checks is consistent that this belongs at the front of intake, before anyone is booked in.

Here is what actually happens on the call. Someone says "Hi, I was rear-ended on the 405 last Tuesday and I think the other driver had been drinking." That is the opening sentence, volunteered, before any question was asked. The firm now holds case facts and an allegation about a named party it may already represent. No conversational design prevents this, because the caller does not wait to be asked.

So stop trying to gate the conversation on the check. Fire the lookup as soon as you have identifying details, run it alongside the conversation rather than in front of it, and build the abort path properly. A conflict hit should stop the call and purge what was captured, not steer politely into a different topic. The system cannot prevent the disclosure. It can make it recoverable.

That lookup has to fit inside the same turn budget as any voice agent. A short lookup against a colocated database can be held silently and the caller notices nothing. A slower one needs the agent to say something while it resolves, so the line is not sitting in dead air. Past a certain point the caller assumes the call dropped and starts talking over the agent, and that barge-in corrupts the next exchange too.

Open Source Alternative to Vapi / Retell

Self-hosted voice agent platform — no per-minute fees

dograh-hq/dograh

Star on GitHub

Where the call data goes decides the question

The question is not how sensitive the information feels. It is whether the duty attached to it can be handed to somebody else by contract.

That test sorts every deployment option, and it lands differently for legal work than for the industries next door.

At one end a vendor runs the whole stack and the audio passes through their systems. That is defensible when no third-party disclosure duty attaches to the content at all. Appointment reminders with no case detail fit there. Intake does not.

In the middle you hold accounts directly with the speech and language providers while a platform orchestrates the call around them. That replaces an inherited chain of subprocessors with agreements you signed yourself, which is the right answer when the duty is delegable and every layer will sign. Be clear about what it does though. Bringing your own keys moves the contract, not the data.

At the far end everything runs on infrastructure you control, using models you can actually host. That becomes necessary when disclosure itself destroys the protection, because at that point no contract can put it back.

Legal intake sits at the far end. Health information has a purpose-built instrument for delegation, and a covered entity with a signed agreement from every layer has a real answer. Privilege has no equivalent. Nobody wrote one. And where a data incident can be disclosed and remediated, a waiver hands the file to the other side permanently. Healthcare ends up self-hosting too, by a weaker route, because the agreements exist but are needed everywhere at once.

The professional rules already point this way. The reasonable-safeguards factors under ABA Model Rule 1.6 ask a lawyer to weigh whether outside vendors with access to client data have adequate security, and where that data is stored and who can reach it. Those are architecture questions written into an ethics rule.

This is why we built Dograh to be self-hosted by default, with the option to run open models on your own infrastructure so no part of the call leaves it. The same reasoning drives why on-prem wins in regulated work.

A prompt will not stop the agent giving legal advice

Every regulated industry has one sentence its agent must never produce. In legal work it is any version of "you have a case."

Most teams handle this with an instruction in the system prompt and consider it solved. It is not solved. A prompt is a soft constraint on a system that generates language probabilistically, and it gives way predictably. A caller who asks the same question a third time after two refusals will often get an answer on the third ask. So will someone who has just been injured and asks the agent to be honest with them.

The most common failure is subtler than either of those. The model obeys the literal instruction, avoids the forbidden phrase, and delivers the forbidden meaning anyway. It will not say "you have a case." It will say "this sounds like exactly the kind of matter the firm takes on." Keyword filtering never catches that, because nothing on the list was said.

The control that holds is structural. Split the call flow so that high-risk turns are not generative at all. At those moments the agent plays from approved wording rather than composing a reply. You are removing its ability to speak freely at the one turn where that is the risk.

The proof only works if you own the transcripts

At some point somebody asks the firm to show the agent never gave legal advice, and searching transcripts for a phrase is not an answer.

You cannot prove a negative about a generative system. There is no way to show a model never produced a particular meaning across ten thousand calls, because meaning is not searchable the way strings are. So change what you are proving. If the risky turns are not generative, you no longer have to prove the model stayed silent. You prove which turns it could speak on at all.

That evidence pack is concrete. It is the call graph with each node classified by risk, showing which turns play fixed wording. It is a node identifier stamped on every turn, so any sentence traces back to the point in the flow that produced it. It is a classifier run over the full set of transcripts rather than a sample, with a recorded decision on each flag. And it is the abort log, every conflict hit and every handoff, with timestamps.

All of that assumes the transcripts are yours. If the calls live in a vendor's dashboard, you are asking that vendor to audit itself, and you cannot run your own analysis across the whole corpus. The proof requirement and the privilege requirement arrive at the same architecture from opposite directions, which is usually a sign the architecture is right.

So decide the deployment tier before you choose a voice stack, because that is the decision you cannot reverse later. Monitoring is worth building, and it will not undo a disclosure that already happened. Get the data path right first, then the conflict abort, then constrain the turns that carry legal risk. A firm that works in that order can run intake around the clock without betting a client's case on a question the courts have not finished answering.