AI Voice Agents for Law Firms: Call Recording, Consent & Confidentiality Checklist

AI voice agents for law firms can answer intake calls, capture information, transcribe conversations,

and route callers to staff. But recording a call, producing a transcript, processing it with AI, storing it,

and sharing it with vendors are separate activities that require separate review.

Related LuMay legal voice guides: Compare multilingual AI receptionists for law firms, use the legal CRM integration checklist, and see when an AI receptionist should transfer a call to a human.

The applicable rules depend on the jurisdictions involved, the nature of the conversation, the firm's

professional obligations, and how its technology stack handles the data. A recording disclosure

alone should never be treated as proof that the entire workflow is legally or ethically appropriate.

Why Call Recording Is More Complicated Than "One-Party vs. All-Party Consent"

A common shortcut is to classify states as either "one-party consent" or "all-party consent." That

distinction can help with initial screening, but it does not resolve every legal intake call.

At the federal level, 18 U.S.C. Section 2511 contains circumstances in which interception is permitted

when one party has given prior consent. State laws can impose different or stricter requirements. 18

U.S.C. Section 2511

For example, Florida law generally permits interception when all parties have given prior consent,

subject to statutory exceptions. Washington similarly prohibits recording certain private

communications without the consent of all participants. Florida Statutes Section 934.03

Massachusetts defines interception around secretly hearing or secretly recording communications

without prior authority from all parties, while Pennsylvania also contains provisions requiring all-

party consent in many circumstances. Massachusetts General Laws Chapter 272 Section 99

A law firm therefore needs more than a state map.

• The caller's location.
• The firm's location.
• The employee or remote intake worker's location.
• The location where recording or processing occurs.
• Contractual or platform requirements.
• Jurisdiction-specific court interpretations.

Launch blocker: If the firm has not determined how its consent rule applies to the jurisdictions in which

calls may originate or be handled, recording should not simply be enabled nationwide.

1. Map Every Data Operation Before Reviewing Consent

Start by documenting what actually happens after the phone rings. Do not treat "recording" as a catch-all term.

This mapping should cover the full vendor chain, including telephony, speech-to-text, language

models, analytics, CRM integration, storage, and monitoring services.

LuMay's current Voice Agent product page describes voice workflows that can connect to APIs,

replay calls, configure guardrails, and hand calls to people. These capabilities make the workflow

design - not merely the greeting - important to privacy review.

Review the LuMay Voice Agent platform

2. Identify Which Jurisdictions May Apply Before Writing the Disclosure

The firm's legal team should define a jurisdiction matrix before approving a recording script.

At minimum, capture:

• Caller location when reasonably available.
• Office or attorney location.
• Remote employee location.
• Recording system location if relevant.
• Call type: prospective client, existing client, witness, opposing party, vendor, or other

participant.

Do not configure a system around the assumption that the firm's home state automatically controls

every call.

A conservative operational design may apply the firm's highest approved consent standard across a

broad group of calls. That can simplify operations, but counsel should decide whether that approach

is appropriate for the firm's specific practice.

Owner: Firm counsel, ethics counsel, or another attorney responsible for the deployment.

Evidence to retain: Written jurisdiction matrix, legal review date, approved call types, and approved

disclosure/consent rule.

3. Separate AI Disclosure, Recording Notice, Consent, and Data Processing

These concepts should not be collapsed into a single sentence.

A caller may need to understand several different facts:

1. They are interacting with an automated or AI-assisted system.

1. The call may be recorded.
2. The call may be transcribed.
3. Information may be processed using third-party systems.
4. Information will be stored or routed to firm personnel.

Whether every item legally requires separate consent depends on the applicable law and

circumstances. Operationally, however, keeping them conceptually separate makes the workflow

easier to audit.

New York City Bar Formal Opinion 2025-6 addresses AI tools that record, transcribe, and summarize

attorney-client conversations. Under the New York rules it analyzes, attorneys should obtain client

consent before recording and should evaluate confidentiality, privilege, accuracy, and supervision

issues associated with AI-generated transcripts and summaries. NYC Bar Formal Opinion 2025-6

That opinion is New York professional guidance, not a nationwide recording rule.

Illustrative Opening Disclosure

Example script: "Thank you for calling [Firm Name]. I am an automated intake assistant. With your

permission, this call may be recorded and transcribed so our legal team can review your inquiry. Do you

agree to continue with recording and transcription?"

This is an example only. The actual language and consent mechanism should be reviewed for every

jurisdiction and workflow in which it will be used.

Do not assume that merely continuing to speak always constitutes valid consent.

4. Do Not Start Capture Before the Workflow Is Supposed to Start

A perfectly written disclosure is ineffective if recording has already begun.

Technical testing should establish precisely when:

• The telephony provider begins audio capture.
• A recording buffer is created.
• Speech-to-text processing starts.
• Audio is sent to another vendor.
• Logs or analytics begin storing content.

The consent event should occur before prohibited capture or processing begins when that is

required by the approved legal design.

Record the consent evidence with:

• Timestamp.
• Call identifier.
• Disclosure version.
• Caller response.
• Jurisdiction or routing profile.
• System version.

That creates a more defensible record than a database field that merely says consent = yes.

5. Build a Real Refusal Path

The agent needs explicit behavior for callers who decline recording.

A refusal should not cause the system to continue recording while merely displaying "recording

disabled" to staff.

The engineering team should test that the full chain responds correctly:

• Recording stops or never starts.
• Transcription stops when required.
• Downstream AI processing stops where applicable.
• Unsupported vendors receive no prohibited content.
• The caller is offered an approved alternative.

Illustrative Refusal Script

Example script: "No problem. I will not continue with the recorded intake workflow. I can transfer you to an

available team member or arrange an approved callback."

If the firm cannot technically honor the refusal, that is a launch issue - not a script-writing issue.

6. Limit What the AI Collects From Prospective Clients

Legal intake creates a special confidentiality problem: callers may disclose sensitive information

before the firm decides whether to represent them.

ABA Model Rule 1.18 states that even when no attorney-client relationship results, a lawyer generally

may not use or reveal information learned from a prospective client except as the rules permit. It

also addresses situations in which significantly harmful information can create conflicts. ABA Model

Rule 1.18

The accompanying comment advises lawyers to limit an initial consultation to information

reasonably necessary to determine whether to undertake the representation. Comment on ABA

Model Rule 1.18

An AI receptionist therefore should not invite the caller to "tell me everything." Collect in stages.

Stage 1: Minimal Screening

Capture only enough information to determine:

• Practice area.
• Basic jurisdiction.
• Approximate date.
• Existing representation.
• Basic names needed for preliminary conflict screening.

Stage 2: Controlled Intake

After the firm-approved gates are satisfied, collect only the additional facts required by the intake

playbook.

Read How AI Legal Intake Works

7. Understand Confidentiality, Privacy, and Privilege as Different Concepts

These terms should not be used interchangeably.

Confidentiality includes lawyers' professional duties regarding information relating to

representations and, under Rule 1.18, certain prospective-client information.

ABA Model Rule 1.6 requires lawyers to make reasonable efforts to prevent unauthorized disclosure

of or access to information relating to representation. ABA Model Rule 1.6

Privacy can involve statutes, contracts, platform practices, consumer expectations, and other legal

requirements governing personal information.

Attorney-client privilege is an evidentiary doctrine whose application depends on the

communication and circumstances.

An intake system should therefore never tell a caller: "Everything you tell me is automatically

privileged."

The safer design is to avoid making privilege determinations and route questions about legal

protections to an authorized attorney.

8. Review Every Vendor That Can Touch the Call

A voice agent is usually a supply chain, not a single system.

Before launch, identify every entity that can receive:

• Raw audio.
• Partial audio.
• Transcripts.
• Summaries.
• Caller metadata.
• Contact information.
• Uploaded documents.
• CRM records.

ABA Formal Opinion 512 says lawyers using generative AI must consider duties including

competence, confidentiality, communication, and supervision. Its confidentiality discussion

emphasizes understanding how the technology handles information before confidential material is

exposed to it. ABA Formal Opinion 512

ABA Rule 5.3 also requires lawyers with managerial or supervisory responsibilities to make

reasonable efforts concerning nonlawyer assistance, including outside service providers. ABA

Model Rule 5.3

Vendor Review Checklist

• Whether customer data trains shared models.
• Whether humans can review recordings or transcripts.
• Subprocessor identities.
• Data residency.

• Encryption in transit and at rest.
• Access-control options.
• Logging capabilities.
• Retention defaults.
• Deletion process.
• Backup retention.
• Incident-notification process.
• Export procedures.
• Contract termination procedures.

Review LuMay AI Security & Governance

9. Configure Access Around Need, Not Convenience

A transcript from a prospective client should not automatically be visible to everyone with a CRM

login.

Use role-based controls for:

• Intake staff.
• Attorneys.
• Conflict teams.
• Administrators.
• Vendor support.
• Developers.
• Quality-review personnel.

Where supported, retain logs showing who viewed, exported, altered, or deleted sensitive records.

Privileged or highly sensitive calls may require stricter handling than ordinary scheduling calls.

10. Define Retention Before Accumulating Thousands of Recordings

Keeping every audio file forever "just in case" creates unnecessary exposure.

The firm should establish approved retention periods for:

• Raw recordings.
• Transcripts.
• AI summaries.
• System logs.
• Failed or abandoned intake records.
• Prospective-client information.
• Accepted-client records.

Deletion rules also need exceptions for matters subject to legal holds, preservation duties, pending

disputes, investigations, or other applicable requirements.

Do not configure automatic deletion without determining whether another obligation requires

preservation.

11. Require Human Escalation for High-Risk Situations

The AI should recognize situations where automation should stop or narrow its role.

• Caller requests an attorney.
• Possible conflict match.
• Threats or immediate safety risks.
• Imminent filing deadlines.
• Statute-of-limitations uncertainty.
• Highly sensitive allegations.
• Unclear consent.
• Recording objection.
• System failure.
• Unsupported language.
• Repeated transcription uncertainty.
• Requests for legal advice.

Explore LuMay Legal Agents and Intake Flow

12. Hypothetical Legal-Intake Call Flow

Consider a prospective client calling a law firm from another state.

Step 1: Initial disclosure

The voice agent identifies itself as automated and presents the firm's approved

recording/transcription disclosure.

Step 2: Consent decision

The caller affirmatively agrees. The system records the approved disclosure version, timestamp,

caller response, and call ID.

Step 3: Limited screening

The agent asks for the caller's name, location, general matter type, approximate date, and names

necessary for preliminary conflict screening. It does not request a complete narrative yet.

Step 4: Conflict signal

A possible match appears. The AI does not announce that a conflict exists or does not exist. It stops

deeper factual questioning and routes the record to authorized personnel.

Step 5: Approved storage

Only the approved recording, transcript, consent record, and minimum intake data enter the

designated systems.

Step 6: Attorney handoff

An authorized staff member or attorney reviews the record and determines the next step.

This staged design reduces unnecessary disclosure while preserving a usable intake trail.

Review 7 Legal Intake Questions for an AI Receptionist

13. Compact Launch-Testing Checklist

Before production launch, test each item with real system traces - not only interface screenshots.

• [ ] Jurisdictions and call types mapped.
• [ ] AI identity disclosure approved.
• [ ] Recording disclosure approved.
• [ ] Consent mechanism approved.
• [ ] Audio capture timing verified.
• [ ] Transcription start time verified.
• [ ] Consent evidence stored.
• [ ] Refusal actually disables restricted processing.
• [ ] Human-transfer path tested.
• [ ] Conflict workflow tested.
• [ ] Minimum-data rules configured.
• [ ] Vendor subprocessors documented.
• [ ] Model-training terms reviewed.
• [ ] Role-based access tested.
• [ ] Audit logs tested.
• [ ] Retention/deletion schedule approved.
• [ ] Legal-hold exception tested.
• [ ] Incident process documented.
• [ ] Failure and uncertainty paths tested.
• [ ] Attorneys know when human review is mandatory.

Do not launch: If the system cannot reliably honor the firm's approved consent, refusal, access, retention,

or escalation rules.

14. Governance Should Continue After Launch

Call behavior changes over time.

Vendors update models. Prompts change. Integrations change. New offices open. Staff move

across jurisdictions. Retention settings can be modified accidentally.

Schedule periodic reviews covering:

• Disclosure wording.
• Consent success and refusal handling.
• Transcription accuracy.
• Unauthorized access attempts.
• Vendor/subprocessor changes.
• Retention failures.
• Human escalation failures.
• New jurisdictions.
• New call types.
• Prompt and workflow changes.

Read AI Voice Intake for Personal Injury Law Firms

Next Steps for Law Firms

Before turning on recording, build a documented chain from disclosure -> consent -> limited intake

-> approved processing -> controlled storage -> human review.

Have the firm's responsible attorneys approve the legal rules and scripts, and have technical teams

prove that the deployed system follows those rules under normal calls, refusals, failures, and cross-

state scenarios.

LuMay Voice Agents supports configurable voice workflows, system integrations, guardrails, call

review, and human handoff. Those technical capabilities can support a governed design, but no AI

product by itself determines whether a law firm's deployment satisfies applicable legal or

professional obligations.

Explore LuMay Voice Agents