A small firm can look modern in a pitch deck and still run on one person’s laptop, a shared mailbox password, and documents that live in email. Clients will not see that until something breaks. Your duty of confidentiality does not wait for a convenient IT budget cycle.
Assess the firm as it operates, then use this order: identity, documents, communications, continuity. New practice software is last unless the current system cannot produce a file.
The real bottlenecks
The bottleneck is rarely “we need AI.” It is that three people can open the same mailbox, former staff still have VPN or Microsoft 365 access, and nobody can say which copy of a document is the client file.
The second bottleneck is intake: callers who get voicemail, web forms that land in a personal inbox, and no owner for after-hours. That is a client-experience problem and a malpractice-adjacent operations problem.
Client data without a science project
Put work product in a system with unique accounts and folder permissions, not a tangle of personal OneDrive and desktop folders named “FINAL2.” If you use Microsoft 365, complete the Microsoft 365 security checklist before you add more sharing shortcuts.
Encryption at rest is not the same as “only the people on the matter can open it.” Review guest links. Disable public anonymous sharing for client folders. When a person leaves, removing access should be a same-day checklist, not a hope.
Communications
Pick one official path for new matters and make it survive lunch, court, and a partner who is out. That usually means a business phone system with voicemail-to-email, a recorded greeting that is true, and a rule for who returns calls.
Do not text clients from personal phones as the undocumented official channel. If SMS is part of intake, it needs a practice-owned number and a retention plan you can explain.
A staged rollout
- Stage 1: MFA, unique logins, password manager, offboarding list.
- Stage 2: Document location of record and sharing rules.
- Stage 3: Phone and intake reliability.
- Stage 4: Backup and a one-page “if Microsoft 365 is down” card.
- Stage 5: Only then evaluate case-management or document-automation purchases.
Questions for vendors
- Where does client data reside, and who can access it at the vendor?
- How do we export every matter if we leave in 12 months?
- What is the support path during filing deadlines, not only business hours on the west coast?
- Which features require extra licenses we have not quoted?
This guide does not certify competence under professional-conduct technology rules. Confirm duties with counsel. Related implementation help, including Crazy Smart Consulting, is optional and disclosed — not an award.