Mobile AI Legal Assistant: RAG Search and Risk Detection
Over 30% of inquiries to legal firms are routine questions that can be automated. A properly built RAG system reduces lawyer workload by 40% and cuts response time by 3x. Imagine a user asking in chat: "What is the statute of limitations for a loan agreement?" If your AI assistant answers incorrectly, the consequences can be fatal. We develop such systems from scratch, starting not with a model but with the jurisdiction and constraints. Our experience: 5+ years in LegalTech, 20+ implementations for iOS and Android. We guarantee that answers always include references to specific articles of law.
How an AI Assistant Finds the Right Legal Norms?
Three fundamental distinctions you cannot ignore when designing. Jurisdiction matters. An article of the Russian Civil Code and a similar norm in Kazakhstan may give directly opposite answers to the same question. Before any answer, the system must know the user's jurisdiction — either from a profile or explicit selection. RAG, not fine-tuning. An LLM fine-tuned on previous editions of legislation will confidently cite norms that have already been repealed. The correct approach is Retrieval-Augmented Generation with an up-to-date database of regulatory acts. The document is split into chunks, indexed via a vector store (pgvector, Pinecone, or Weaviate), and on query, relevant fragments are retrieved and passed into the LLM context. The source is always indicated in the answer: According to Art. 196 of the Civil Code of the Russian Federation (current version). Disclaimer is part of UX, not a footnote. Before the first query, explicit confirmation that the user understands this is not legal advice and does not replace a lawyer. Without this confirmation, the interface does not open.
Why We Choose RAG Over Fine-Tuning?
| Approach | Advantages | Disadvantages |
|---|---|---|
| Fine-tuning | Faster inference | Becomes outdated when laws change; expensive to retrain |
| RAG + vector store | Always up-to-date base; transparent sources | Dependent on indexing quality |
RAG wins on safety and currency — that's why we use it in every project. Inference speed is compensated by query optimization. Additionally, we reduce infrastructure costs by using a shared base for multiple clients.
How Is High-Risk Query Detection Implemented?
Criminal questions, questions about specific criminal cases, medical-legal intersections — a separate class. A classifier (fine-tuned BERT or keyword-based for MVP) determines the category before the LLM call:
| Risk Level | Example Query | Action |
|---|---|---|
| informational | what is statute of limitations | AI answer |
| moderate | how to draft a claim | AI answer + disclaimer |
| high | how to avoid criminal liability | AI answer + lawyer recommendation |
| criticalRedirect | active criminal case, arrest | Only redirect to a lawyer |
At criticalRedirect — only emergency redirect to a live lawyer, no AI answer.
What Data Is Encrypted and How?
Legal consultations are sensitive data. They must not be stored in cleartext. On iOS, chat history is encrypted via AES-GCM (CryptoKit) before writing to Core Data. The key is in Keychain, tied to biometric authentication. On Android, similarly via EncryptedSharedPreferences or Room with SQLCipher. Server side: all requests to LLM are logged without user identifiers (only session hash), data in vector store — public regulatory acts, no personal data.
Mobile App Structure
On iOS — MVVM with Combine, on Android — ViewModel + StateFlow. The chat is implemented as a message list with support for rich content: quotes from regulatory acts, links to sources, buttons with a call to "Consult with a lawyer". When suggestsProfessional == true, a card with a button to contact a lawyer appears in the UI. This monetizes through partnerships with legal services and simultaneously reduces legal risks for the app owner.
What's Included in the Work and Timeline Estimates
- Architectural documentation (diagrams, API specification)
- Integration with a partner legal service (on request)
- Setup of disclaimer flow and risk detection
- Admin instructions for updating the act database
- 14 days of post-deployment support
MVP with RAG on a single jurisdiction, basic chat, and disclaimer flow — 3–4 weeks. Full system with multi-jurisdictional base (RU/BY/KZ), automatic legislative base update, risk classifier, integration with partner legal service, history encryption, and iOS + Android support — 2–3 months. Timelines depend on the volume of the regulatory base being indexed.
Get a consultation from an engineer — we will select the optimal configuration for your project. Order a free demo access to evaluate the assistant's performance on your data.