Before signing with an AI intake vendor, get three things in writing: where the data is hosted, what the system retains after a conversation ends, and how the tool discloses that the visitor is interacting with software. Those three answers tell you more about GDPR AI client intake risk than any badge on a vendor's homepage. Conversation quality, CRM sync and dashboards all sit on top of that foundation.
This guide is written for immigration firms actively comparing vendors. It covers the rules that may be in scope, the questions that separate a serious vendor from a reseller, and how to run the evaluation without turning it into a six-month procurement project.
One framing note: this is not legal advice. The rules below are described neutrally. Whether and how any of them apply to your specific intake flow is a question for your own data protection adviser or DPO.
Why intake deserves a stricter evaluation than a generic chatbot
Immigration intake is not a generic contact form. Depending on how you design the flow, a first conversation can surface nationality, country of origin, family composition, employment status, visa history and, in some case types, information touching on health or legal proceedings — all collected before anyone has become a client.
A useful question to put to your own intake process: which of those categories does your current form or phone script already capture, and at what point? The answer tells you how much personal data an automated version would be handling on day one.
That is why data privacy immigration law firm questions belong at the start of the vendor conversation rather than at the end of it. The same tool that shortens your response time also becomes a new processing point, a new storage location and a new disclosure surface. That is manageable, and it is not a reason to keep intake manual. It does mean the evaluation runs on different criteria than a generic chatbot purchase.
Two regulations to put in front of your adviser
GDPR
Two provisions are worth raising explicitly when you brief your adviser.
Article 22 restricts decisions based solely on automated processing that produce legal or similarly significant effects on a person. The practical question for your evaluation: does the tool decide anything about a prospect — eligibility, rejection, routing to a "not viable" bucket — or does it collect and organise information for a human to decide on? Ask vendors to describe this in concrete terms rather than marketing language, then take the answer to your adviser.
Article 83(5) sets the ceiling for the most serious infringements at up to 20 million euros or 4% of total worldwide annual turnover, whichever is higher. That ceiling is a reasonable argument for giving intake automation a proper procurement process rather than a credit card and a weekend.
The EU AI Act
The AI Act entered into force on 1 August 2024. Since 2 August 2026, Article 50(1) requires providers of AI systems designed to interact directly with people to make clear that the person is interacting with an AI system, unless that is obvious from the context. Breaches of the Article 50 transparency obligations can be fined up to 15 million euros or 3% of worldwide annual turnover, whichever is higher.
For your shortlist, this becomes a narrow, checkable question: how does the tool disclose its nature to the visitor, and can you see that disclosure in a live environment before you buy? A GDPR compliant chatbot that obscures what it is creates a transparency question on top of a data question.
Regulatory texts can be amended. Confirm the current position with your own adviser rather than relying on a vendor's summary, including this one.
Seven questions to ask vendors on your shortlist
Use these more or less verbatim. The quality of the answers is the evaluation.
- Where is the core infrastructure hosted, and which sub-processors touch the data? "EU-based company" and "EU-hosted infrastructure" are different claims. Ask for both, separately.
- What is retained after a conversation ends, and for how long? Transcripts, extracted fields and model inputs can sit in different places with different retention settings.
- Does the system carry memory between conversations? A tool that recalls a previous visitor's answers behaves differently, from a privacy standpoint, than one treating each conversation as self-contained.
- Is the conversation visitor-initiated, or does it trigger on its own? This affects both the visitor experience and how you describe the processing in your notice.
- How is the AI disclosure presented? Ask to see it running, not on a slide.
- Where does the data go next? A CRM handoff moves personal data into a second system with its own hosting, retention and access controls. That system needs the same questions.
- Can we configure what the system asks about? For immigration intake, the ability to not collect certain categories of information can matter as much as the ability to collect them.
Comparison: how to read the answers
| What you ask | A weak signal | A stronger signal |
|---|---|---|
| Hosting | "We're GDPR compliant" with no location detail | A specific statement about where core infrastructure sits, with sub-processors addressed separately |
| Retention | "We don't keep anything" with no specifics | A documented description of what is stored, where, and for how long |
| Conversation memory | Vague references to "learning from your visitors" | A clear description of whether earlier conversations inform later ones |
| AI disclosure | Buried in a privacy policy link | Visible in the interface, demonstrable before purchase |
| Decision-making | "It qualifies leads automatically" | A clear line between gathering information and human decision |
| CRM integration | "Integrates with everything" | A named integration that is live today, with others assessed case by case |
On that last row, a useful follow-up is simply: which integrations are running in production right now, and which are roadmap or middleware-dependent? Ask the vendor to put the distinction in writing.
Where Altamira sits against the same checklist
So you can compare us on the same criteria you apply to everyone else:
- Visitor-initiated. The Altamira fit-check widget is visitor-initiated: the conversation starts when a visitor opens it.
- Core infrastructure hosted in the EU. We say core infrastructure deliberately. We do not claim that all data and all sub-processors sit inside the EU, and we would rather you ask us for that distinction than assume it.
- Objection handling uses approved scripts. Responses draw on a library of approved response scripts, not on memory of earlier conversations.
- HubSpot is the CRM integration running today. Other CRMs are reviewed case by case, depending on whether they accept outside connections.
- We are a new business. Altamira Automation was incorporated in 2026 and is based in Malaga, Spain. Better you hear that upfront than discover it mid-procurement.
If your adviser needs documentation in a form we do not yet have, that is worth surfacing during a fit check rather than after a contract.
The counterweight: what delay may be costing you
Compliance caution has a counterweight, and it is worth stating precisely. A 2011 Harvard Business Review study by Oldroyd, McElheran and Elkington sent test web leads to 2,241 US companies. In that study, only 37% of companies replied within an hour, 24% took more than 24 hours, and 23% never responded at all. Among companies that responded within 30 days, the average first response took 42 hours. Firms that contacted a lead within an hour were nearly 7 times as likely to qualify it as firms that took longer, and more than 60 times as likely as firms that took 24 hours or more.
That is US data from 2011, and it measures qualification odds rather than revenue. It is not a prediction about your firm. It does frame a question worth running against your own numbers: what is your median time from enquiry to first human reply, and what share of enquiries never receive one? If you cannot answer that today, measuring it is a sensible first step — independent of any vendor decision.
FAQ
Does an AI intake tool make our firm a controller or a processor? That depends on who determines the purposes and means of processing in your specific setup. It is a determination for your adviser, not your vendor.
Can we use AI intake for sensitive case types? That turns on what the system collects, what it retains and how you have documented the processing. A practical starting question for vendors: can we restrict which categories of information the tool asks about?
Is an EU-hosted tool compliant by default? Hosting location is one input among several. Retention, disclosure, access control and the downstream CRM all form part of the picture, and the assessment belongs with your adviser.
Does this apply to other AI compliance law firm software? The same evaluation logic transfers to document automation, drafting assistants and case management AI: hosting, retention, memory, disclosure, decision-making.
Choosing an intake vendor as an immigration practice is a data governance decision wearing a sales-tooling costume. The two questions — does this convert enquiries into consultations? and can we describe precisely what it does with personal data? — are worth keeping separate and answering both before you sign. If a vendor deflects the second set of questions, that is information you can weigh. Immigration firm data security is not a feature bolted on after launch; it is the architecture you select at the outset, and the evaluation stage is the point at which you still have full leverage to ask for detail.
If you are mid-evaluation and want a direct, technical conversation about how an AI intake flow would map onto your current process — including the parts we cannot do — book a short, free fit check at altamiraautomation.es. Bring your compliance questions; those are the ones worth the call.