AI Receptionist for Law Firms

What is the real risk for a law firm?

The main risk is a caller telling a machine about their divorce, their arrest or their business dispute, and that information going to a vendor you have not vetted. How robotic the voice sounds matters far less. A law firm's duty of confidentiality does not pause because the first voice on the line is software.

The Council of Bars and Law Societies of Europe, the CCBE, published a guide on generative AI for lawyers on 2 October 2025. The guide says lawyers should refrain from entering personal, confidential or client-related data into such tools unless appropriate safeguards are in place, such as confidentiality terms, zero data retention, a data protection agreement or a system the firm controls. As eucrim reports it, the guide also warns that AI systems may keep client data without the user knowing. That guide is about lawyers using such tools in practice. A prospective client's description of their matter is client-related information, so the same caution applies to a receptionist that records or transcribes it. We found no published Cyprus Bar Association guidance specific to AI receptionists, so ask the Bar and your own adviser before you go live. This page is general information and not legal advice.

What should it do, and what must it never do?

Keep the job narrow: take details, route urgent matters and book consultations. Give it a written list of things it must refuse.

Collect the minimum. If you ask for the other party's name to run a conflict check, you are collecting a third person's data as well, so ask for it in the consultation, not on the first call.

Which data protection rules matter most?

Several GDPR points weigh more for a law firm than for a plumber. They are general points, not an assessment of your firm.

• Processor contract. Article 28 requires a contract with any processor that handles personal data for you. It must require the processor to act only on your documented instructions, bind its staff to confidentiality, apply security measures, follow conditions for sub-processors and delete or return the data when the service ends.
• Special categories. Article 9 bans processing by default for categories that include health data, political and religious beliefs and sexual orientation, subject to listed exceptions. Callers volunteer these things. Script the receptionist to avoid asking, and decide how it should handle unprompted detail.
• Criminal matters. Article 10 restricts processing of data about criminal convictions and offences to official control or authorized by law with safeguards. A firm with a criminal practice should take specific advice before any call data reaches a third-party AI.
• Penalties. Under GDPR Article 83, breaches of the core principles and of Article 9 can bring fines of up to EUR 20 million or 4% of worldwide annual turnover, whichever is higher. Breaches of controller and processor duties, including Article 28, can bring up to EUR 10 million or 2%.
• Recording. Cyprus Law 92(I)/1996 makes it an offence to monitor or record a private communication, with penalties of up to 10 years in prison or EUR 100,000, unless the caller and the recipient have both given prior express approval. Section 99 of Law 112(I)/2004 also bars storing communications without the users' consent, while leaving room for lawful recording as evidence of a business transaction. How these apply to a firm recording its own calls is a question for a Cyprus lawyer, so take advice, tell every caller first and keep recordings only as long as needed.

What does it cost?

The monthly price is small beside the risk, so spend your effort on terms, not on price. From each vendor's pricing page in November 2026: Goodcall's Starter plan is USD 79 a month for 100 unique customers, and Smith.ai's Starter plan is USD 300 a month for 30 calls, with live staffing and AI-first, hybrid and human-first handling options listed. We have compared published figures and have not tried either product. Our cost breakdown converts both to cost per call.

An illustrative sum for the upside, using invented figures to be replaced with yours: 60 enquiry calls a month, 15 missed, and 1 in 4 of those would have instructed you. That is about 4 matters. At an average fee of EUR 800, which is an assumption and not a market figure, that is EUR 3,200 a month in fees you did not capture. If your practice is mostly urgent or distressed callers, those numbers will not matter, because a person should answer those calls.

What to ask a vendor before you sign

• Will you sign a data processing agreement that meets Article 28, and who are your sub-processors?
• Where are calls, transcripts and summaries stored, and for how long? Can I delete them on request?
• Is our data used to train any model, yours or a third party's?
• Who at your company can access call content, and is access logged?
• Can the receptionist be limited to fixed scripts and a fixed list of refusals?
• How does it transfer to a person, and what happens if nobody answers the transfer?
• What happens to our data and phone number if we leave?

If a vendor cannot answer these in writing, do not use it for a law firm.

Greek, English and the quality of the transcript

Test the receptionist in Greek and English with real names, place names and legal terms. Names are where speech recognition fails most, and a wrongly spelled name or number is a lost client. Read transcripts for the first month. Make the receptionist read back the name and number before the call ends.

A safe rollout

1. Start with overflow and after hours only. Daytime calls stay with a person.
2. Write the refusal list and test every item.
3. Say it is an AI in the greeting. Article 50 of the EU AI Act has applied since 2 August 2026 and puts this duty on the provider of the system, so check that your vendor does it, and say it anyway.
4. Set an emergency route to a named lawyer's mobile for deadlines and arrests.
5. Review every transcript for the first two weeks, then a sample each week.
6. Review the arrangement after 30 days, including a record of any call that went wrong.

For the general picture, read AI receptionist for small business. For the human side of the same problem, see our guide to websites and SEO for law firms in Cyprus, and if you want help scoping a safe pilot, ask about our AI automation service.