A chatbot for an immigration practice should not be judged the way you would judge one for an online shop. The enquiries are sensitive, the rules change often, and one badly worded sentence can sound like legal advice. So before you buy one, look at six things: what job it will actually do, where its answers come from, how it handles personal data, when it hands a case to a person, how it fits the way your team works, and how it is priced.
This article sets out the criteria and the questions you can take into every vendor meeting. It is not legal advice: check the regulatory points below with your own adviser and with the rules that govern your profession.
One clarification up front: Altamira does not sell a general-purpose chatbot. We build an enquiry-qualification system, and the section near the end explains how it differs. Read this article as criteria for evaluating any vendor, ourselves included.
First, decide what job you want it to do
"Chatbot" is used for very different tools, and the risk changes with the job. Before you compare vendors, decide which of these you need:
- Answering general questions from website visitors (usual documents, how a first consultation works, indicative fees).
- Collecting case details before a person speaks to the enquirer (type of procedure, situation, deadlines, language).
- Qualifying the enquiry, meaning assessing it against your criteria so you know who to deal with first.
- Booking an appointment in the right person's calendar.
- Handing over the cases an automated system should not touch.
A system that only collects details and books appointments carries far less risk than one that answers open questions about requirements. If a vendor sells you "all in one", ask which part they would start with and why.
Where the answers come from
This is the most important question for an immigration practice. A system that generates free text can produce answers that read well and are wrong, and in this field requirements, deadlines and fees change. Ask the vendor to explain:
- Whether the system answers only from text you have approved or generates answers on its own.
- What it does when it does not know, and whether it says so rather than improvising.
- Who updates the content when a rule or requirement changes, and how quickly.
- Whether you can see every conversation and correct the system.
A practical test: before you sign, prepare twenty real questions from your clients, including some awkward ones ("will I be granted residence?", "what happens if my permit has expired?"), and ask the vendor to run them through the system in front of you. Watch whether it promises outcomes, invents requirements, or hands over to a person when it should.
What an automated first contact should and should not say
An automated first contact should collect information and point to the next step. It should not assess the viability of a specific application or predict its outcome. Check with your adviser, and with your professional body if you belong to one, which professional-conduct and advertising rules apply to you before you decide what the system may say on your behalf. Then put those limits in writing in the system's instructions, and use your twenty questions to check that they hold.
Transparency: people must know they are talking to an AI
The EU AI Act entered into force on 1 August 2024. Since 2 August 2026, Article 50(1) requires providers of AI systems designed to interact directly with people to make clear that the person is interacting with an AI system, unless that is obvious from the context. Under Article 99, breaches of the Article 50 transparency obligations can be fined up to 15 million euros or 3% of worldwide annual turnover, whichever is higher. Ask the vendor how the notice works in their product and which part is your responsibility as the practice. Your adviser can tell you how it applies in your case.
Personal data: what weighs most in immigration
Immigration enquiries often include nationality, administrative status, family details and, sometimes, grounds for international protection that can reveal political opinions, religion or ethnic origin, and could fall within the special categories of data in Article 9 GDPR. Whether they do depends on the case, and it is a question for your data-protection officer or adviser. What you can ask the vendor:
- Where the data is hosted and which sub-processors handle it, including the provider of the AI model.
- Whether data leaves the European Economic Area and, if it does, on what safeguards (Chapter V GDPR).
- Whether they offer a data-processing agreement under Article 28 GDPR that you and your adviser can review before signing.
- How long conversations are kept, how they are deleted, and what happens to them when the contract ends.
- Whether they are used to train models, the vendor's or anyone else's.
- What the person is told at the start about who is processing their data, why and for how long (Articles 13 and 14 GDPR).
There is a design question too. Article 22 GDPR restricts decisions based solely on automated processing that produce legal or similarly significant effects on a person. If the system is going to discard enquiries or refuse appointments by itself, ask your adviser whether that article is relevant to you; one cautious way to design it is for a person to decide any rejection. Finally, keep the stakes in view: under Article 83(5), the most serious GDPR infringements can be fined up to 20 million euros or 4% of total worldwide annual turnover, whichever is higher.
When and how a case passes to a person
A good system knows when to stop talking. Ask for the handover rules in writing and check that they cover at least:
- Enquiries with a near deadline, such as a recent notification from the authorities or a formal request for documents: these should reach a person as soon as possible, not wait in a queue.
- Complex cases, or cases of high value to the practice.
- Any moment when the person asks to speak to a human, without having to insist.
- Questions the system cannot answer.
Also ask who receives the alert, through which channel and with what context: the person taking the case should not have to ask everything again from scratch.
Languages
Many of your clients do not write in Spanish. Ask which languages the system works in, who checks quality in each, and how it handles legal and administrative terms. Run the twenty-question test in the languages your real clients use, not only in Spanish and English.
Fit with the way you work
A chatbot that leaves enquiries in a separate inbox creates work rather than removing it. Ask:
- Whether it writes to your CRM, and which fields it fills in (reason for enquiry, language, score, transcript).
- Whether it books into your calendar and respects your team's hours and assignments.
- Whether it works with your CRM today or is "coming soon". Ask to see it working, not in a slide deck.
- Which channels it really supports (web, email, WhatsApp) and which are only on the roadmap.
How it is priced
Pricing models vary: per conversation, per qualified enquiry, a flat fee, or a mix. Ask for an itemised written quote covering setup, the monthly fee, usage-based charges and exit terms. Ask how duplicates and spam are treated, whether a monthly cap is available, what the minimum term is, what notice cancellation requires, and how you export your data if you leave.
A quick checklist for comparing vendors
| Criterion | What to ask for | Red flag |
|---|---|---|
| The job it does | A concrete description of the tasks it covers and those it does not | "It does everything" with no detail |
| Source of answers | Which texts you have approved, and what happens when it does not know | Free-form answers with no limits or review |
| Limits on advice | Written rules on what it must not say, tested with your own questions | It promises outcomes during testing |
| Transparency | A clear notice that it is an AI, from the first message | It presents itself as a person |
| Personal data | Hosting, sub-processors, transfers, retention and a processing agreement | Vague answers, or "we are GDPR compliant" and nothing more |
| Handover to a person | Written rules, with an alert and context | The system carries on until the person drops off |
| Integration | A demonstration with your CRM and calendar | "Coming soon", or manual work |
| Commercial terms | Itemised quote, minimum term, exit and data export | Unclear charges or no data portability |
How to test it before you decide
Before go-live, record your starting figures: median first-response time, the share of enquiries that end in an appointment, and the weekly hours your team spends on enquiries that never become a case. Agree in writing what result would make you call the pilot a success. And start with a single channel or a single language, so you can compare cleanly and roll back if needed. Do not take on trust any improvement a vendor promises; measure it in your own data.
How we approach it, so you can compare
Altamira is not a chatbot that answers legal questions. It is a qualification system: a widget the visitor chooses to open, which asks a few short questions chosen by the practice; the AI scores the enquiry against the criteria we have agreed with you, drafts a personal reply and logs the contact in your CRM. Replies to high-value enquiries wait for your approval before they are sent; the others are drafted and sent automatically according to those criteria, and you can require approval on every message if you prefer. Our core infrastructure is hosted in the EU, and we offer a data-processing agreement for your adviser to review. HubSpot is the CRM we work with today; others are scoped project by project. Replies go out by email: we do not offer WhatsApp today.
Frequently asked questions
Can a chatbot replace the intake person in my practice?
That should not be the goal. A realistic split is that the system collects details and orders the enquiries, while people deal with the cases that deserve it and keep the relationship with the client.
Do I need the person's consent before the AI asks them questions?
You need a lawful basis for the processing, and you must tell the person clearly at the start of the conversation who is processing the data, why, for how long, and that they are interacting with an AI. Whether that basis is consent or something else depends on your case, and your adviser should sign off the wording the vendor proposes.
What if my clients prefer WhatsApp?
That is common in Spain, and it is a fair reason to ask. Ask the vendor whether the channel works today, how prior consent and the approved message templates that the platform requires for first contact are handled, and what data passes through it. Ask to see it working before you count on it.
Who is Altamira?
Altamira Automation is the service of Altamira Strategic Partners SLU, an IT consultancy in Málaga, Spain. It is a new business, incorporated in 2026.
Conclusion
The best chatbot for an immigration practice is not the one that talks the most, but the one that knows what it must not say. Before you buy, decide which job you need done, check where its answers come from, insist on clarity about data handling and the rules for passing a case to a person, and measure a small pilot against your own figures. And take the regulatory questions to your adviser before go-live, not after.
If you would like to test your criteria with someone, take our free assessment.