Guide · Small law firms

How small law firms can triage client email with an AI assistant, safely

And why it should never send without you. · 7 October 2026

In a small firm, the inbox is the practice. A new enquiry, a client chasing a contract, opposing counsel proposing a date and a court notice can all arrive in the same hour, and the person sorting them is usually the lawyer who should be doing the legal work.

An AI assistant can take a real share of that sorting. It can also cause real damage if it is set up to act on its own. This guide covers where the line sits, and how to set things up so the assistant prepares and you decide.

Triage is sorting, not answering

Triage means deciding, for each message, what it is, how urgent it is and who needs to deal with it. For most small firms, incoming mail falls into a handful of groups:

• Time-critical: court or tribunal notices, limitation and filing dates, completion deadlines, anything with a response window.
• Needs a lawyer's judgement: questions about a client's position, proposed changes to terms, settlement offers, anything from opposing counsel.
• New enquiries: prospective clients describing a problem, which also need a conflict check before anyone engages with the substance.
• Routine admin: scheduling, document requests, "did you receive my email", invoices and receipts.
• For information: copies, newsletters, automatic notifications.

Getting each message into the right group, with the important facts pulled out, is most of the value. Writing the reply is a separate step, and it is the step where the risks are.

What an assistant can do well

• Summarise long threads. A four-page back-and-forth becomes a short summary: who wants what, what has been agreed and what is still open.
• Pull out dates and deadlines. It can list every date mentioned and what it relates to, so you can check them against your diary. Treat this as a prompt to check, not as your diary system.
• Notice what's attached. "The client sent a revised draft; it differs from the version you sent on clause 7" is far more useful than "1 attachment".
• Prepare new-enquiry details. It can extract the names of the parties and the other side so you can run your conflict check before replying.
• Draft routine replies. Acknowledgements, scheduling, chasing a missing document: short, low-risk messages that you would otherwise type from memory.
• Prepare a first draft of a substantive reply, for you to rewrite, check and own.

What it should never do on its own

• Give legal advice to a client or prospective client.
• Accept an instruction, agree terms or confirm that you act for someone.
• Agree to a deadline, an extension or a meeting on your behalf.
• Write to opposing counsel, a court or any third party.
• Forward documents or add recipients.

Each of these creates a commitment, or can disclose something, that you cannot take back. None of them should depend on software getting it right.

Why nothing should be sent without you

A draft that is wrong costs you a minute to fix. An email that is wrong can cost a client, a privilege or a complaint. The common failure modes are well known:

• Wrong recipient. Reply-all, an autocompleted address or a forwarded thread that includes the other side.
• Wrong attachment. An earlier draft, the internal version with comments, or another client's document.
• Confident errors. AI models can state a date, a figure or a rule that sounds right and isn't.
• Unintended commitments. "We'll have this to you by Friday" is a promise, whoever typed it.

So the rule is simple: the assistant drafts, and a person sends. Before anything leaves the firm, the lawyer responsible should see the exact text, the exact recipients and the exact attachments that will go out, and approve that specific message. If the draft changes after approval, it needs approving again.

Setting it up safely

Give the assistant its own address

Rather than handing an AI tool the keys to your whole mailbox, give the assistant its own email address and copy it in (CC) on the threads you want help with. It sees what you choose to share, its work is visible in the thread, and you can stop at any time by not copying it in.

Check how the tool handles client data

Before any client information goes in, find out in writing:

• whether your data is used to train models, and whether you can switch that off;
• where it is stored and processed, and which other companies process it;
• how long it is kept, and how you delete it;
• who at the provider can access it, and under what circumstances.

Know your professional obligations

Your duties of confidentiality, competence and supervision apply to AI tools as they do to staff and other software. In the United States, the American Bar Association's Formal Opinion 512 (July 2024) discusses these duties for generative AI, including when a client's informed consent may be needed before their information is put into a tool. Other regulators have issued their own guidance. Check what applies where you practise, and consider saying in your engagement terms how you use AI tools.

Keep separate matters separate

An assistant working on one client's matter should not be drawing on another client's documents. Ask how a tool keeps matters apart, and keep the threads you share with it focused.

Keep a record

You should be able to see what the assistant read, what it drafted and what you changed and sent. That record is how you supervise it, and how you answer the question if a client ever asks.

A simple daily routine

1. Copy the assistant in on new client threads as they arrive, or forward the ones you want help with.
2. Ask it for a morning list: deadlines first, then anything that needs your judgement, then routine items with draft replies ready.
3. Check every date against your diary, and run conflict checks on new enquiries.
4. Read, edit and approve the routine drafts. Rewrite the substantive ones in your own words.
5. Send only what you have approved, exactly as approved.

Checklist

• The assistant has its own address, and sees only threads you share.
• It drafts; it never sends without your approval of the exact message.
• Recipients and attachments are part of what you approve.
• You know whether client data trains models, where it's stored and how to delete it.
• You've considered client consent and your regulator's guidance.
• Matters are kept apart.
• There's a record of what was read, drafted and sent.

This guide is general information, not legal or regulatory advice.

Also read: Giving an AI assistant its own email address: a setup checklist for small firms