A 5 to 20 person NZ law firm on Microsoft 365 has three admin systems worth building on it: matter intake with the conflict check built in, the compliance register that practice software keeps badly, and AML and CDD document collection with a filed audit trail. All three are workflows around the practice management system, not replacements for it, so they run on SharePoint lists and Teams at $0 in licences. Dataverse, at NZ$32.40 a user a month, enters only when the firm wants row-level security on the register.
What the practice management system does, and what it does not
Matters, time, billing, trust accounting, documents: the practice management system does those, and a firm under 20 staff should not rebuild any of them. What it does not do well is the paperwork the Law Society and the AML supervisor actually ask about: was the conflict check done and recorded before the engagement letter went out, where is the CDD for this client and who verified it, which undertakings are open, whose CPD is short. Those live in a spreadsheet, an inbox, and a partner's memory. That is the gap.
The same three-build shape, for engineering consultancies and accounting practices. What the practice management system itself costs across the New Zealand market, Actionstep, LEAP, Smokeball and the rest, is covered separately in what law practice management software costs a small NZ firm.
The three builds, in the order they pay back
| Build | What it does | Home | Build cost, | Licence |
|---|---|---|---|---|
| 1. AML and CDD collection | Per client: which documents are required, which have arrived, who verified them and when; reminders to the client until complete; everything filed in the client's folder with an audit trail the supervisor can read | SharePoint list and library, Outlook, Forms | $4,000 to $8,000 | $0 |
| 2. Matter intake with the conflict check | One form opens the matter: parties entered, checked against the client and party register, result recorded; engagement letter from the template; the matter created in the practice system by hand or by connector if it has one | SharePoint lists, Teams approvals | $4,000 to $8,000 | $0; a premium licence for the flow owner only if the practice system's connector is premium |
| 3. The compliance register | Conflicts, undertakings, trust authorities, file reviews and CPD as rows with owners and dates; the Monday view of what is open; the partner's page | SharePoint list, or Dataverse for row-level security | $4,000 to $8,000 | $0, or NZ$32.40 for the few who open a Dataverse register |
AML first because it has a regulator and an audit, and because the reminder flow saves the most hours in the first month. Intake second, because the conflict check is the step that cannot be skipped and today can be. The register third, once the first two have produced clean data to register. Prices from the services page and Microsoft's NZ list.
Security, because it is the first question a partner asks
Nothing leaves the tenant. Lists, libraries and Dataverse tables sit under the same Microsoft 365 retention, sensitivity labels and audit logs as the firm's email and documents, which is more than can be said for the spreadsheet on the shared drive or the third-party tool billed per seat in US dollars. Who can see a sensitive matter is configuration: SharePoint permissions by folder for the documents, and, where the firm wants it row by row, Dataverse security roles for the register. That is the one place I would spend the NZ$32.40 in a law firm, and only for the people who open the register.
What to leave alone
- Time, billing and trust accounting. The practice system's job, with the audit that comes with it. A rebuild is a regulatory risk with a nicer front end.
- Document assembly if the firm already has a precedent system. SharePoint templates and a flow cover a small firm's engagement letters; they do not replace a precedent library.
- A client portal under about ten active client logins: a shared SharePoint folder per client, not Power Pages at NZ$323.60 a month; the cut-off is here.
When Power Platform is the wrong answer: if the practice management tool already handles matters, billing and trust accounting well, do not rebuild any of that as a Power App. Power Platform earns its price on the admin around the practice tool, chasing a document, following up an enquiry, flagging a compliance date. If switching on a feature you already pay for solves the problem, I will recommend that on the call, and a sole practitioner with no staff is usually better served by that same feature than by a $4,000 build.
The licence logic for the flows is in what Power Automate actually costs, and whether any of this should be a Power App at all rather than a List with a form is answered in Microsoft Lists, a Power App, or a Form.
What NZ law firms actually run
From the NZ small business software census, Kove's observed-signal tables on 5,357 NZ firms with a website on file, collected June to September 2026:
| Signal | Firms identified | Result |
|---|---|---|
| Website platform | 129 legal services firms | WordPress 74%, other platforms 26% |
Legal services firms run WordPress more than any other sector group Kove has a signal for, three in four sites. The licensing question that decides a build's cost sits apart from that: every Microsoft 365 Business plan already carries the seeded Power Platform rights a document-collection or intake flow runs on, at no extra cost, until the flow touches a premium connector such as a third-party Xero one (plus the vendor's own licence). A firm that buys Power Apps Premium for every fee earner because a consultant suggested Dataverse has spent thousands a year on a database the matters live in already, in the practice management tool.
AI in a small law firm: what the Law Society expects
General information, not legal advice. The New Zealand Law Society's generative AI guidance for lawyers is the document to read, and a lawyer who is unsure should read it in full.
- Confidentiality and privilege. Putting client details or privileged material into an external AI tool may breach privilege and confidentiality obligations.
- Check the terms. Some providers reuse what you type in and keep ownership of the output. The contract terms must not put you in breach of your duties.
- Check the output. You stay responsible for AI-generated work, including fact-checking it and every case citation.
- Privacy Act 2020. The provider may see inputs and outputs, and data may go offshore. The guidance flags information privacy principle 12, disclosure outside New Zealand.
- Clients. At a minimum, consider whether to seek client consent before using their data, and tell clients how their service will be delivered.
That is why I keep client data inside the firm's Microsoft 365 tenant where I can. If your staff already use AI tools, a one-page rule on what may and may not go into them is the cheapest fix.
What it costs
- Workflow Review: $3,500, credited against a build started within 90 days. Most builds are scoped on the free 30-minute call without it.
- Each of the three builds above as a single app or automation: $4,000 to $8,000.
- Licences: $0 on standard connectors. A premium connector such as a third-party Xero one (plus the vendor's own licence) puts its owner on Power Automate Premium, NZ$24.30 a month, one licence, not one per staff member.
Every price is fixed and agreed before I start, with nothing added later for scope you did not ask for. Full tier detail on the services page.
Common questions
What can a small law firm build on Power Platform?
The three that pay first: matter intake (one form that opens the matter, runs the conflict check against the client and party register, and files the engagement letter); the register that practice software does not keep well, covering conflicts, undertakings, trust account authorities and CPD; and AML and CDD document collection with reminders and a filed audit trail. All three run on Microsoft 365 with SharePoint lists and Teams, licence cost $0, unless a premium connector is in the flow.
Does a law firm need Dataverse?
For a firm under 20 staff, usually not. Matters, time and billing live in the practice management system; the Power Platform builds are the workflows and registers around it, which SharePoint lists handle. Dataverse at NZ$32.40 per user per month earns its place if the firm wants row-level security so that only the matter team sees a sensitive matter's records, which some firms decide is worth it for the register.
Is client data safe in a Power App?
The data never leaves the firm's Microsoft 365 tenant: SharePoint lists and Dataverse sit under the same retention, audit and access controls as the firm's email and documents. That is the argument for building here rather than in a third-party tool billed per seat in US dollars. Security roles, sensitivity labels and audit logging are configuration, and they are part of the build.
What does it cost?
Each of the three is a single-process build at $4,000 to $8,000, two to four weeks. Licences are $0 on standard connectors; if the firm chooses Dataverse for the register's row-level security, NZ$32.40 per user per month for the people who open it, which for the register is usually the partners and the practice manager, not every fee earner.
How do I stop chasing clients for the same document twice?
A list of what is outstanding per client per matter, and a flow that emails the request, reminds on a schedule, and stops the moment the file lands in the client's folder. That is the first of the three builds, and the mechanics are in how to stop asking for the same document twice.
Can lawyers use ChatGPT with client information?
Carefully, and not on a consumer account. General information, not legal advice. The Law Society's guidance says entering client details or privileged material into an external AI tool may breach privilege and confidentiality obligations, and that lawyers should at least consider whether client consent is needed. OpenAI says it may use what you type into its plans for individuals (Free, Plus and Pro) to train its models unless you switch that off, and that by default it does not train on ChatGPT Business, ChatGPT Enterprise or its API. Even so, the Privacy Act 2020 still applies, data may go offshore, and the provider's terms must not put you in breach of your duties. Check the current OpenAI data-use page and the Law Society guidance, and use fictional data for testing.
The same client-pipeline problem shows up in other professional services: a mortgage broker tracking applications by stage in this post, and the specific mechanics of chasing an outstanding document without asking twice in this one.
Where to start
Tell me how CDD documents are collected today and where the conflict check is recorded. One free 30-minute call and you get the first build priced, and a plain answer on whether the register needs Dataverse's row security.