Law firm AI chatbots are permitted in every Canadian province and US state — but the firm is fully responsible for what the bot says and what it stores. Four duty clusters govern them: unauthorized practice of law (the bot must not give legal advice), communications rules (disclaimers and truthful marketing), confidentiality (prospective-client information in chats is protected), and records obligations (transcripts must be retained, secured, and destroyed on a defensible schedule).
The stakes are asymmetric: a well-configured bot creates negligible new risk while capturing leads around the clock, whereas a carelessly configured one can generate advice-like statements, leak prospective-client information, or make prohibited marketing claims — all attributable to the firm. The good news is that compliance is a configuration problem with known solutions, not an open legal question.
No regulator on either side of the border has banned legal chatbots. What regulators have done is make clear that technology does not dilute existing duties: the Law Society of Ontario, the Federation of Law Societies' Model Code, and multiple US bar technology opinions all treat AI tools as supervised nonlawyer assistance. This guide — part of our AI Chatbots for Law Firms hub — maps each duty to concrete chatbot configuration decisions for both Canadian and US firms.
The line is fact-application. Providing general legal information — what a power of attorney is, how the firm's consultation process works, typical steps in a claim — is permitted marketing communication. Applying law to a specific visitor's facts — "based on what you've told me, you have a strong case", "your limitation period expires next March", "you should refuse the breathalyzer" — is legal advice, and a chatbot delivering it raises unauthorized-practice exposure and, because no lawyer reviewed it, competence problems under rules like ABA Model Rule 1.1 and its Canadian counterparts.
US firms face state UPL statutes and Model Rule 5.5; the firm also answers for the bot under Rule 5.3 (responsibilities regarding nonlawyer assistance), which state bar AI opinions since 2023–24 have repeatedly extended to generative tools. Canadian firms face the same structure through law society acts (only licensees may practise law) and the Model Code's supervision and competence rules, with several law societies having issued generative-AI guidance emphasizing lawyer review and responsibility.
Configuration consequences: restrict the bot to a firm-approved knowledge base, prohibit outcome prediction and claim valuation in its instructions, and hard-code a human handoff on advice-seeking phrases. Our guide to training a chatbot on your firm's content covers the guardrail build in detail.
A compliant legal chatbot carries four disclosures, shown at conversation start and reinforced when triggered:
Marketing accuracy rules also apply to the bot's own claims: it cannot promise results, misstate credentials, or claim specialization the firm's regulator has not certified. Every scripted answer is an advertisement — review it like one. Canadian firms should note that several law societies restrict terms like "specialist" to certified programs (Ontario's Certified Specialist designation, for example), and Quebec practice adds French-language requirements to public-facing communications under the Charter of the French Language — which includes a chatbot serving Quebec visitors. US firms in states with advertising pre-approval or record-keeping rules should keep dated copies of the bot's scripted answers the same way they archive website versions.
The moment a visitor types "my husband emptied our joint account last Tuesday", you are holding prospective-client information. In the US, ABA Model Rule 1.18 protects information from prospective clients even when no retainer follows, and it can disqualify the firm from acting against that person in the same matter. Canadian law societies impose parallel prospective-client confidentiality duties under the Model Code, and courts apply conflict principles to intake information regardless of the channel it arrived through.
Practical requirements that follow:
Privacy statutes overlay all of this: PIPEDA and provincial equivalents in Canada, and state regimes like the CCPA/CPRA in the US, both requiring notice, purpose limitation, and safeguards for chat data. See our companion piece on chatbot privacy compliance for law firms.
Direct answer: treat transcripts connected to an opened matter as part of the client file — retained for your jurisdiction's file-retention period, commonly 7–10 years and longer for minors, estates, and some injury matters — and treat non-client transcripts as intake records, typically retained 1–3 years for conflict-checking evidence and then securely destroyed under a written schedule.
Three retention principles keep you defensible in both countries:
Transcripts are double-edged: they are your best evidence that disclaimers displayed and guardrails fired, and simultaneously a confidentiality liability if leaked. The policy goal is keeping exactly what protects you, exactly as long as it protects you.
Jurisdictional nuance matters here. Canadian law societies publish file-retention guidance that varies by province — Ontario and British Columbia guidance commonly points to 10+ years for many file types, with longer periods where minors or estates are involved — and Quebec's Law 25 adds destruction and de-indexing expectations on top. US firms should anchor to their state bar's record-keeping rules (trust-accounting records often carry their own 5–7 year minimums) and to malpractice statutes of repose, which effectively set the floor for how long intake evidence stays useful. When in doubt, map chatbot transcripts to the same category as telephone intake notes: whatever your policy does with those, it should do with these.
A compliant chatbot is not a constrained chatbot — it is a better one: firms that implement these controls also score higher on the quality metrics in our chatbot analytics guide, because the same discipline that satisfies regulators produces accurate, trustworthy answers. LexScale.ai builds every deployment to this checklist as part of our law firm AI services.
LexScale.ai builds, trains, and maintains AI chatbots exclusively for law firms across Canada and the United States — including practice-area training, intake scripting, compliance disclaimers, CRM integration, and monthly conversation audits. Most firms are live within 14 days.
Book a free strategy call to see exactly what an AI chatbot would capture on your website, or explore our full AI growth services for law firms.
Free Tools & Resources
AI SEO for Law Firms · AI Website Design for Law Firms · Free AI Visibility Grader · AI for Every Practice Area
Ready to grow your firm with AI?