Any firm handling privileged or sensitive client information is right to ask hard questions before letting a machine answer its calls. The bar for confidentiality in a professional services firm - particularly in law - is not the same bar as a retail hotline, and it shouldn't be treated as if it were.
What a firm must ask before adopting this
Four questions matter more than any others. Where is call data stored, and for how long? Who - which humans, at which companies - can access transcripts and recordings? Is the system built to a recognised security and compliance standard, or does it rely on assurances rather than certification? And critically, what happens to that data if the relationship with the provider ends?
Any AI receptionist provider unwilling to give clear, specific answers to all four should be treated as a non-starter, regardless of how polished the product demo looks.
Encryption and access are not the same thing
Encryption gets discussed often and access control far less often, which is backwards. Data encrypted at rest and in transit is table stakes; almost every serious provider can tick that box. The harder, more important question is who inside the provider's own organisation can see client conversations, under what circumstances, and whether that access is logged and auditable.
A firm should be able to ask, and get answered in writing, exactly how many people could theoretically listen to a recording of a client disclosing something sensitive, and what technical and contractual controls prevent that from happening casually.
GDPR compliance is a floor, not a differentiator
Every legitimate provider operating in the UK will claim GDPR compliance. That claim is the minimum legal requirement, not evidence of a mature security posture. What separates a genuinely robust system is whether it was built around compliance from the first line of code, or whether compliance was retrofitted onto a general-purpose voice product after the fact. The difference usually shows up in the details: how granular the data retention controls are, whether a firm can enforce its own deletion schedule, and whether the provider will sign the kind of data processing agreement a firm's own clients would expect to see.
Where this leaves a cautious firm
None of this is a reason to avoid AI receptionists. It's a reason to pick one built specifically for professional services, where confidentiality was a design requirement rather than an afterthought - fully encrypted, GDPR-compliant by default, with access controls a firm can actually interrogate and verify, not just take on faith.