Few operations have as much repetitive work done by such expensive people as a law firm. Checking court publications, registering cases, answering status questions, gathering documents, chasing pending items: all necessary, all recurring, and much of it done by people who should be practicing law. It is the kind of routine where AI agents work well, and also the sector where a wrong design costs the most, because the error can be a missed deadline or a breach of secrecy.
This guide is for those who decide and implement, at a law firm, in a legal department or at a judicial assets company: what fits in an agent, what does not, where approval is mandatory and how to start with secrecy and a trail from day one.
This text is an operations and decision guide, not a legal or professional ethics opinion. How each rule applies to your operation is for whoever answers for ethics and data protection in your organization to assess.
The line that organizes everything: facts for the agent, judgment for the lawyer
One criterion decides every process. The Estatuto da Advocacia, the statute that governs the legal profession in Brazil, reserves to lawyers, among other activities, legal consulting, advice and direction (Law 8.906/1994, art. 1º, II). The recommendation of the Federal Council of the OAB (the Brazilian Bar Association) on generative AI, from November 2024, points the same way: professional judgment should not be exercised by an AI system without human supervision, and no activity reserved to the legal profession should be delegated to it (item 3.1).
In practice, that becomes a simple test. If the result of the task is a fact, it tends to fit in the agent: the publication came out, the document is missing, the case was registered, the installment is due. If the result is an opinion about the client's rights, it belongs to the lawyer: it is worth appealing, the settlement is good, the clause is acceptable. The agent can prepare everything that comes before the opinion, and that is where most of the hours are.
In August 2026, the plenary of the Federal Council approved legal action against AI companies that perform acts reserved to the legal profession and stated that case analysis, defining legal strategy and being retained by the client are activities of the legal profession. For those who design agents, the consequence is the same: AI comes in as a tool supporting the lawyer, not in the lawyer's place.
The processes that fit in an agent
Nine routines show up in almost every firm. In each one, what changes is the part the agent takes on and the point at which a person steps in.
1. Intake and triage of new cases
The agent receives the contact through the website, email or WhatsApp, collects the facts and the initial documents, runs the conflict check against the client base and routes it to the right practice area and partner. It does not assess the merits, indicate the chance of success, propose fees or accept the case. It introduces itself as an automated assistant, because the OAB recommendation asks that the other party know they are talking to a machine (item 2.4). And it serves those who came to the firm: soliciting cases is something else, which the Estatuto treats as a disciplinary offense (art. 34, IV).
2. Publications, court notices and deadlines
The routine with the highest value and the most expensive errors. The agent reads the day's publications, links each one to its case, identifies the act and proposes the deadline and the person responsible. A person confirms the deadline, always, before it goes into the calendar. The gain is not eliminating the check; it is eliminating the reading, the triage and the typing, so that checking becomes confirming. A publication the agent cannot link or classify with confidence goes to its own queue, not into silence.
3. Case registration and updates
The registration comes from the initial petition, the service of process or the case assignment: parties, case number, court, subject, amount in dispute, client and person responsible. The agent reads the document, fills in the system and then updates the case file with every development. Since the error is reversible and the volume is high, the right mode is usually to review afterwards, by sample. The exception is any field that generates a deadline, which goes back to the previous rule.
4. Case status and client service
A good share of the messages to the lawyer is routine: how is the case going, what is the next step, is a document missing. The agent answers on the spot, with the information in the system, and transfers when the question is about the merits. The boundary fits in one sentence: reporting that a decision came out is routine; explaining what it means for the case is consulting. A client who asks for a person talks to a person, as the OAB recommendation provides (item 4.3). The periodic report follows the same logic: the agent assembles it, the lawyer reviews and signs.
5. Calculation and checking
Updating amounts, calculating the judgment amount, checking the calculation of the opposing party or the court expert. The agent gathers the data, applies the criteria the lawyer defined (index, start date, base), delivers the calculation breakdown and points out where the other side diverges. Two precautions: choosing the criterion is a legal decision, so the agent applies it and does not choose it; and the math runs in a deterministic tool called by the agent, not in the language model, which is not a calculator.
6. Due diligence and document review
In contract audits, corporate transactions or portfolio analysis, the agent reads the volume and fills in the team's checklist: parties, term, guarantees, termination, missing documents, discrepancies between versions. Each extracted item points to the document and the passage it came from, so the lawyer checks instead of rereading. Risk assessment and conclusions stay with the lawyer.
7. Contracts
A first draft from the approved template, a comparison of the counterparty's version against the playbook of accepted positions, a list of the clauses outside the standard. The negotiation and the final version belong to the lawyer.
8. Fee collection
A reminder before the due date, a copy of the invoice, payment status and renegotiation within the partners' policy. Above the approval limit, the case goes to a person. It is a delicate message for the client, and the tone deserves the same design as the flow.
9. Research and knowledge base
Finding precedents, templates and the firm's previous filings, and summarizing what is long. The risk here has a name: the citation that does not exist. The OAB recommendation calls for special attention when researching legal scholarship and case law with AI, recalling the duties in art. 77 of Brazil's Code of Civil Procedure, especially the truthfulness of what is presented in court (item 3.2), and for a full review of every AI output before it goes into a case (item 3.7). The design that meets this: the agent only cites what it retrieved from a real source, with a link to the document, and the lawyer checks before using it.
What stays out of the agent
Some tasks do not go to the agent, however good it is. Listing them up front avoids the argument in the middle of the project.
- Strategy and opinion on the merits. Whether to appeal, whether to settle, whether the argument holds. It is legal consulting and direction, reserved to the lawyer.
- Signing and filing. What goes to court is reviewed in full and filed by the lawyer. The agent can prepare a draft; it cannot be the last to touch it.
- Accepting the case and fees. Being retained by the client is an activity of the legal profession, and a conflict of interest is the partner's decision.
- Negotiating with the opposing party. Offer and counteroffer go through the lawyer, even when the agent drafts the message.
- Difficult conversations with the client. An unfavorable decision, a family case, a criminal case. The reason here is less about rules and more about the relationship: that conversation belongs to the lawyer.
- One-off, low-volume work. When each case is different from the last, the cost of designing the agent does not pay off, and the lawyer resolves it faster alone.
No item on the list is a technical limitation. It is a division of responsibility, and that is what allows the firm to use agents without exposing the lawyer.
Where human approval is mandatory
Human supervision in legal is not a global switch. It is a decision per action, in three modes that coexist in the same agent: approve first, review afterwards and hand over. The human-in-the-loop guide details all three; applied to a law firm, they look like this:
| Agent action | Mode | Why |
|---|---|---|
| Propose a deadline from a publication | Approve first | A deadline error is expensive and a matter of professional liability. |
| Prepare text that goes to court | Approve first, with full review | The OAB recommendation calls for a review of every AI output before it goes into a case. |
| Send a document outside the firm | Approve first | Secrecy: what has left does not come back. |
| Open a new case after the conflict check | Approve first, by the partner | Accepting a client is a decision of the legal profession. |
| Renegotiate fees outside the policy | Approve first | An amount above the defined approval limit. |
| Answer a factual status question from the client | Review afterwards, by sample | Low risk and high volume. |
| Register a case and update its status | Review afterwards, by sample | A reversible, detectable error. |
| Answer a client's question on the merits | Hand over to the lawyer | It is consulting, not routine. |
Two details decide whether this works. The approval request arrives ready (the publication, the act identified, the proposed deadline and the reason), so that whoever approves confirms instead of investigating. And the approval queue has an owner and a deadline, because a procedural deadline stuck in an approval queue is the worst of both worlds.
Integration with the firm's systems
The list is usually the same: the case management software (case files, parties, status updates and deadlines), the publications source, email, the document repository, time tracking, finance, the CRM and WhatsApp.
The first job is to classify each one into the four levels of integration (ready connector, documented API, accessible database, legacy with no API), because the schedule is that of the worst level. Then, three precautions specific to the sector:
- Start with reading. An agent that looks up the case file and answers status questions already changes the routine, and it gets through the security review faster. Writing comes later, one operation at a time, with approval.
- Permissions per client and per case file. The agent serving client A does not read client B's case file, nor an area isolated by an information barrier. A system credential with broad access breaks that design; the integration respects the permissions of whoever asked, or is restricted to the minimum.
- Idempotency. The same publication processed twice cannot create two deadlines. Every write needs a prior check or an idempotency key.
Professional secrecy and the LGPD
Breaching professional secrecy without just cause is a disciplinary offense (Estatuto da Advocacia, art. 34, VII). That is why the question of where the client's data goes comes before the question of what the agent does. The OAB recommendation calls for special attention to data that could make the client identifiable (item 2.1) and for diligence in choosing the vendor, which should protect the information, adopt security measures and allow the data not to be used to train its systems (item 2.2).
In practice, five controls resolve most of it:
- The minimum necessary. The model receives the excerpt it needs, not the whole case file. Identifiers that do not change the answer are removed before anything leaves.
- Retention and training in writing. What the model provider keeps, for how long, who accesses it and whether it uses the content for training. When secrecy requires it, a provider with no retention or a model on your own infrastructure.
- Segregation between clients. What belongs to one client does not appear in the answer to another. It is the per-case-file permission from the previous section, seen from the secrecy side.
- Sensitive data. Labor, social security and family cases often carry health data, which the LGPD (Brazil's data protection law) treats as sensitive. The post on governance and the LGPD covers the controls.
- Transparency with the client. The OAB recommendation provides that the lawyer formalize to the client, in writing and before starting, the intention to use AI, explaining its purpose, limits, risks and security measures, and obtain express consent (items 4.1.1, 4.2.1 and 4.3.1). It is worth reviewing the fee agreement template before the pilot, not after.
Audit trail: reconstructing any answer
When a client questions a piece of information, when a partner wants to know why a deadline was proposed the way it was, or when an ethics question comes up, the firm needs to show what happened and who decided. For each execution of the agent, record:
- the document or the publication it read;
- the version of the agent and of the instructions that were live;
- each system query, with parameters and return;
- what it proposed, and with what justification;
- who approved, changed or refused it, and when;
- what was sent to the client, and through which channel.
Two precautions are usually missing. The trail is also confidential data, with the same access and retention rules as the case files. And it is raw material for quality: every deadline changed and every answer refused becomes a test case for the next version. The post on observability details what to record.
Where to start and how to measure
The first agent should not be the most ambitious one, but the one that proves the way of working with low risk. Five criteria help choose:
- Daily volume. A routine that happens every day, not once a quarter.
- A factual result. By the test in the first section: a fact, not an opinion.
- Checkable errors. It can be reviewed by sample, or approval is quick because the proposal arrives ready.
- Accessible data. The system has an API, an export or a connector; if not, that needs to be in the schedule.
- A metric that already exists. Or one that can be measured for a few weeks before the agent comes in, because without a baseline no result is demonstrable.
Client status updates, case registration and triage of new contacts usually pass all five. Publications and deadlines have the highest value and come in early, but always in approve-first mode.
| Case | Baseline | What to measure with the agent |
|---|---|---|
| Client status updates | How many routine questions arrive per week, and who answers them. | Share answered without the lawyer, time to answer, transfers by reason. |
| Case registration | Time between the case assignment and the complete registration. | Registration time and errors found in the sample review. |
| Triage of new cases | Time to the first reply to a prospective client. | Time to reply, referrals to the right practice area, time to reach the partner. |
| Publications and deadlines | Time between the publication and the deadline confirmed in the calendar. | That time, proposals confirmed without changes, and changes by reason. |
If the firm tracks hours, part of the baseline already exists: the senior team's hours logged to administrative or non-billable activity. Record that number before day one. The text on why projects die in the PoC explains why the metric comes before the build.
Legal departments and judicial assets companies
The principles hold outside the law firm, with other routines. In the legal department, the agent receives and classifies requests from the business areas (contract, consultation, notice), routes them by type and value, prepares the first draft from the approved template and consolidates the reports from outside firms into a single view. At judicial assets companies, it comes in at the first contact with the holder of the credit, in document collection and in checking case status for the analysis team. In both cases, the decision (signing, setting aside a provision, buying the credit, setting the price) stays with a person.
How Runflow works in legal
Runflow's agents take on the routine that today falls on the lawyer: organizing and preparing cases, client status updates with a handoff when the merits are involved, triage of new cases with routing to the right practice area and partner, knowledge base lookups, deadline tracking and alerts, fee collection. Nothing on the merits goes out without review: the agent handles the routine, the lawyer signs. The platform covers building, operating and measuring each agent, with per-client isolation, no training of models on your data, self-hosting when secrecy requires it, sanitization of sensitive data before the model, human approval where the risk demands it and an audit trail of every execution.
Demarest and PX Ativos Judiciais are among those already operating with Runflow agents in legal. At PX, the first contact moved from phone calls to WhatsApp: first-contact conversion went from 4% to 10%, with roughly R$ 1.5 million converted over the year without growing the team. In the free assessment, we map where the lawyer's hours get lost and which routine the first agent takes on. The details for the sector are on the legal page.
