AI agents for lawyers: what an agent can do in a law firm, from inbox to signature (and where it has to stop)
An AI agent reads the PEC (Italy's certified email), understands the filing, updates the calendar and drafts the message. But a rule computes the deadline, and nothing is sent without a signature. We explained it to the lawyers of AIGA Avellino, in the courthouse, on 13 November 2026: how it works, how to govern it and who is responsible when it gets it wrong.
An AI agent in a law firm can read the PEC that just arrived (Italy's certified email, the channel courts use for notifications), work out what kind of filing it is, put the deadline in the calendar and draft the message to the client. Two steps, though, do not belong to the model: the deadline is computed by a rule the firm wrote, and nothing is sent until the lawyer signs.
I explained it on 13 November 2026 in the Aula Magna «Livatino» of the Avellino courthouse, in southern Italy, at the conference L'algoritmo nel diritto. L'innovazione e le garanzie processuali ("The algorithm in the law. Innovation and procedural safeguards"), organised by the Avellino section of AIGA, the Italian Association of Young Lawyers: free admission, three continuing education credits. I was there with lawyer Armando De Lucia, a member of AIGA's National Department for Artificial Intelligence and Electronic Proceedings, with whom I host the podcast Innovazione Sotto Processo. As always, I brought the machine and he brought the rules.
Two days earlier, in Caserta, we had run an open model on a laptop with no internet. In Avellino there was no lab: twenty minutes for the technical part, spent on the question that in Caserta had taken three lines. What changes when AI stops answering and starts doing. It concerns every firm: since 23 October 2026 the training organised by Italian professional bodies has to include the use of artificial intelligence (Article 47 of Legislative Decree 179/2026).
What is the difference between a chatbot and an AI agent?
A chatbot answers, an agent acts: it uses the firm's tools, meaning email, calendar and archives, to complete a task within the limits you set. In the room I showed it as a five-step ladder, from the AI you have used for years without calling it that, up to the agent.
| Step | What it does |
|---|---|
| 1. The AI you do not see | One thing only: the spam filter, the spell checker |
| 2. The chat | Knows a lot in general, nothing about your firm |
| 3. The chat with documents | Answers from your documents, and cites the source |
| 4. The assistant | Knows the firm's procedure |
| 5. The agent | Uses the firm's tools, and stops for the signature |
The higher you climb, the more rules you need. A useful definition is Anthropic's, in Building effective agents, dated 19 December 2024: in workflows, model and tools follow paths written in advance in code; in agents, the model directs its own steps and its own use of tools. The same text recommends finding "the simplest solution possible". For a law firm that means starting from the written paths. I explained the difference between an agent and an automation at length in AI agents: what they are and what they are for.
Calling it an agent is not enough, though. An "improve my prompt" button is still a chat. A list of ready-made instructions is a chat where the vendor decided the logic. A model that thinks for a long time before answering is a better model. It is an agent when it uses your tools, under your rules.
And this is not science fiction. In my own work I have agents that use the computer for me, mouse included, and in the room I put it this way: it is already happening, and it will reach law firms in the next few years. On the legal market the first ones are here: platforms such as Harvey and Legora already present themselves as agents for legal work, with connections to a firm's tools (Harvey and Legora pages read on 13 November 2026).
What can an AI agent do in a law firm?
It can follow a repetitive job from start to finish and stop before the one step that is not its own. The example I brought to the room is a diagram, not a product: it starts from a PEC and ends at the signature, in six steps.
| Step | What happens | Who does it |
|---|---|---|
| 1. Reads the PEC | Opens the notification that arrived | A tool |
| 2. Understands the filing | Parties, type of filing, date | The model |
| 3. Computes the deadline | With the firm's rule, always the same | A rule |
| 4. Updates the calendar | Deadline in the calendar and in the case file | A tool |
| 5. Prepares the draft | The email to the client | The model |
| 6. Stops | The lawyer checks and signs | A person |
Out of six steps the model does two: understanding and writing. Three more are tools and rules the firm configured once, and the last is a person. It is a mixed flow, and the part that matters is who configures it: the firm, not the vendor.
A PEC contains client data. So an agent like this needs an in-house model or an adequate contract: the three options for the data, and who guarantees confidentiality in each, are in the write-up of the Caserta lab.
Why should AI not compute the deadline?
Because a language model generates text, it does not run a computation: it draws each word from the most probable ones and, depending on its settings, it can answer the same request differently. A deadline has to come out the same on the first PEC and on the thousandth.
I ran the test on 8 November 2026 on a local open model, Qwen3.5 9B with Ollama, on my laptop. It is not about a deadline but about a citation, and the mechanism is the same. I gave it the same sentence to complete three times, at temperature 0.8: "Secondo la Corte di Cassazione, Sez. III civile, sentenza n. …" (the opening of a citation of Italy's Supreme Court). It wrote "n. 15202 del 15/11/2019", then "n. 26225 del 25 ottobre 2023", then "n. 13364/2018". It knows the shape of a citation, but it searched no archive: three identical requests, three different rulings. An invented ruling is not a malfunction, it is how a model works without sources.
That is why the third step in the diagram does not belong to the model. The computation is done by a program, with the firm's rules written once, and the model keeps what it is good at: reading a filing written in natural language and pulling out parties, type and date. With one limit to keep in mind: the rule computes correctly only if the date it receives is the right one. That is another reason the last step is a person who checks.
How do you govern an AI agent in a law firm?
Like a trainee lawyer: few keys, a written procedure, nothing leaving without your signature and a record of what it did.
- Limited keys. It sees only what the task needs.
- A written procedure. The instructions belong to the firm, not to the vendor.
- Nothing sent without a signature. PEC and ordinary email wait for the lawyer.
- Everything logged. Every step can be reconstructed.
This is not bureaucracy. A document that comes from outside, such as the attachment to a PEC, can contain hidden instructions for the model. It is called prompt injection and it is the first entry in the OWASP list for applications built on language models, which states that "it is unclear if there are fool-proof methods of prevention". In the OWASP list for agentic applications of 9 December 2025, the first risk is precisely the hijacking of the agent's goal. I saw what happens when an agent has access to everything with an autonomous agent I uninstalled straight away.
The example I always give is passwords. If an agent queries the password store and that request ends up with an outside provider, to me that is a security incident, and every password has to be changed. Limited keys are for this: an agent cannot leak what it cannot see.
At Castaldo Solutions the rule is the same one I showed in the room. My agents prepare email drafts, and none of them sends: sending is mine. It is why I keep saying that the agent prepares and the person speaks.
Who is responsible if the AI agent gets it wrong?
If an AI agent gets it wrong, the lawyer is responsible: AI speeds up and organises the work, responsibility stays with whoever signs. That is the answer of lawyer Armando De Lucia, who in Avellino set this question as the third stop of the legal part and closed his slide of seven rules like this (translated from the Italian): «Human in command: AI speeds up and organises, responsibility stays with the lawyer». The legal and ethical side is his: here I report the rules and his slides, not a legal opinion.
- Article 13 of Italian Law 132/2025 allows AI in the intellectual professions only for instrumental and support activities, with the professional's intellectual work prevailing, and requires telling the client which systems are used.
- The CCBE guide of 2 October 2025, from the Council of Bars and Law Societies of Europe, asks for independent verification of what AI produces.
- The CCBE technical guide of 27 March 2026 covers agents in its section on future developments: it does not yet consider them mature enough to assess their impact on professional obligations, but warns that lawyers will encounter them anyway.
The courts are already showing what happens when verification is missing. Damien Charlotin's database, updated to 12 November 2026, counts 2,292 decisions worldwide on AI-invented or distorted content in filings and proceedings, 15 of them Italian. An agent acting on its own can take a similar error one step further, which is why it stops before the signature.
What rules does a law firm using AI need?
Seven rules, on the slide lawyer Armando De Lucia presented at the AIGA conference in Avellino: they cover data, sources, rules in place of the model, the agent's keys, the notice to the client, where the data runs and training. I report them as he wrote them, translated from the Italian slide:
- No client data in the free chat or in personal accounts.
- Every citation is checked against the primary source.
- What must always be the same is done by a rule.
- The agent has limited keys and does not send without a signature.
- Written notice to the client at every new engagement.
- Before the tool, decide where the data runs.
- Whoever uses the tool is trained, and the training is documented.
The third and the fourth are the agent's rules, and they are the same ones you reach starting from the technology: it is where my talk and his meet. The first and the sixth are about where the data ends up, the choice to make before buying anything. The fifth is about the notice to the client, which Article 13 covers.
On what cannot be delegated, Armando told the room that arguing before judges, talking to the client and catching certain nuances stay with the lawyer. How I cut to twenty minutes a talk that had forty in Caserta, from the side of the person who prepared it, is on my personal website.
Frequently asked questions
Are there already AI agents for lawyers?
Yes. There are platforms on the market that present themselves as agents for legal work, with connections to a firm's tools, such as Harvey and Legora (vendor pages read on 13 November 2026), and an agent can also be built in-house with an open model and free software. The name is not enough, though: a button that improves your prompt or a list of ready-made instructions are still a chat. It is an agent when it uses your tools, meaning email, calendar and archives, under the rules your firm wrote.
Can an AI agent send a PEC (certified email) on its own?
Technically yes, if you give it the credentials to do so. The firm's rule is not to give them: the agent prepares the draft and stops, and PEC and ordinary email wait for the lawyer. It is the fourth of the seven rules presented at the AIGA conference in Avellino on 13 November 2026: the agent has limited keys and does not send without a signature. On the legal side the reference is Article 13 of Italian Law 132/2025, which allows AI in the intellectual professions only for instrumental and support activities, with the professional's intellectual work prevailing: how it applies to sending a message is for the lawyer to judge, not for me.
Who is responsible if an AI agent gets a deadline wrong?
The lawyer, according to the seven rules Armando De Lucia presented in Avellino, which close with «Human in command: AI speeds up and organises, responsibility stays with the lawyer». On the technical side the risk is reduced like this: the deadline is not left to the model, which generates text rather than running a computation and can answer the same question in different ways. A rule written by the firm computes it, and before anything goes out a person checks the date read from the filing, the deadline and the draft.
