An AI assistant on your own website: what I'm considering before launch

An assistant that isn't working yet

Eora greets visitors to my website by telling them I'm busy and that she is standing in for me digitally. That's only half true. Busy I am, but so far Eora is a demonstration. She shows what a conversation would look like, and doesn't yet answer any real questions. The actual AI is planned for a later stage.

I could have switched her on sooner. The technology isn't the problem; I've been programming since my school days, and these days with AI support. The problem is the question of what such an assistant is allowed to say on a lawyer's behalf. So I decided to set the rules first and flip the switch afterwards. I'm sharing my thoughts here because they apply to any law firm considering an AI chatbot on its website.

What I expect from Eora

The task is small and clearly defined: Eora should answer questions about me. Which areas of law, which topics, how to reach me, what the website says. A language model is well suited to questions like these, because the answers are all on my own pages. The assistant only has to find them and put them into her own words.

What I don't expect: legal advice. Eora is not to assess a dismissal, calculate a deadline or evaluate a data protection breach. Anyone who asks gets the response that this requires a conversation with me. That boundary is the most important part of the concept for me. A language model is happy to answer anything. On a lawyer's website, that is exactly what it must not do.

The Hamm judgment

How serious that boundary is was shown by a decision of the Higher Regional Court of Hamm in May 2026. The case concerned a clinic for aesthetic treatments whose website chatbot described the two managing directors as specialist physicians, with specialist titles that don't even exist. The court saw this as an unlawful commercial practice and ordered the company to cease and desist. The reasoning is relevant for every law firm: the chatbot is not a third party. What it says is attributed to the company as if the company had spoken itself. The court allowed an appeal to the Federal Court of Justice (BGH), because the attribution of chatbot statements raises new legal questions. I have discussed the decision in more detail in a separate post.

For me that means: if Eora claims I'm a certified specialist in IT law, then I have claimed it. Saying "that was the AI" doesn't help. Whoever uses a chatbot takes responsibility for its answers.

The limits I set for her

My first rule follows from the judgment: Eora may only reproduce what is on my website. No knowledge from her training, no guesses about prices, success rates or titles. If the answer isn't on my pages, she should say so instead of inventing something. Language models tend to fill gaps with plausible-sounding text. On a lawyer's profile, any invented qualification would be a competition law breach.

The second rule: Eora is an assistant, not an adviser. She may point to the contact form, but must not give an assessment of an individual case. The third rule: she must be switchable off without breaking the website in the process. If she behaves oddly or I can no longer check her answers, I want to be able to silence her with a single action. With my admin tool I learned that AI works fast, but needs clear rules and someone keeping an eye on it. That applies all the more to an assistant in contact with clients.

Data protection before the first question

A chatbot on a law firm's site receives questions that visitors would otherwise ask no one. They type in their employer, their dismissal, their diagnosis, because it feels like a conversation. These inputs leave the website when an external language model answers. As a data protection officer, I see this as the second big issue alongside liability.

So I plan to ask for consent before the first question and to say openly that the input goes to an AI provider. The conversation should take place only in the visitor's browser and not be stored permanently on my side. And Eora should point out that confidential matter details don't belong in a chat window. That sounds like a lot of text for a small assistant. I consider it the price a law firm has to pay when it places a language model between itself and its visitors.

What small law firms can take from this

The temptation is understandable. A chatbot looks modern, saves phone calls and is available around the clock. The provider promises it can all be set up in an hour. My impression is that the setup is the smallest part. The real work comes before: which questions should the assistant answer, from which sources, and what happens with everything else? Anyone who doesn't answer these questions leaves them to the language model. And that, as the Hamm judgment shows, has no qualms about handing out titles.

That's why Eora remains a preview for now. Not because I think AI on websites is wrong, but because I have to accept my assistant's answers as my own. Before she speaks, I want to know what she says.