Kevin Harbauer is both the CTO and CISO at Compex Legal Services. But his mission is singular. 

At Compex Legal, Kevin is focused on evolving the technology, product, and security foundation of the 50-year-old legal services company, which supports complex, high-volume medical record workflows.

In the world of legal record retrieval, where "good enough" doesn't cut it, this is easier said than done. 

For Compex Legal Services, the challenge isn’t just about moving faster. It’s about increasing efficiency while maintaining ironclad consistency across a high-stakes, phone-heavy workflow that has traditionally relied on tribal knowledge.

I connected with Kevin to discuss how he’s broken through the hype of AI to find real operational leverage in the contact center. In this candid Q&A, Kevin breaks down the "scaling wall" that led them to Replicant, the non-negotiable role of data security in legal tech, and why he believes the best AI strategy starts with a narrow focus on measurable goals rather than chasing full autonomy.

Erin Pemberton: What was happening at Compex that made you start seriously looking at AI?

Kevin Harbauer: We hit a scaling wall that wasn’t going to be solved by hiring faster or adding another layer of management. Record retrieval is still a phone-heavy workflow…lots of follow-up calls, lots of variation in how people ask for things, and a lot of time spent on tasks that are repetitive but high-stakes. We also had a growing gap between what our clients expected in turnaround time and what the industry could realistically do with traditional methods.

At the same time, quality was becoming harder to keep consistent. We have talented field expeditors, but the “best way” to handle a call lives in people’s heads. If you want speed, quality, and consistency at scale, you need better instrumentation and more leverage than call notes and coaching alone

Erin Pemberton: There’s a lot of AI noise right now. What made this feel worth a closer look instead of just another tool to evaluate?

Kevin Harbauer: Two things. First, this is one of those workflows where small improvements compound quickly. If you reduce the number of calls it takes to get a request accepted, clarify what the custodian needs, or avoid a simple mistake that triggers rework…you’re not just saving minutes, you’re collapsing days.

Second, conversational AI isn’t interesting to me as “automation for automation’s sake.” It’s interesting when it can create a more consistent experience for custodians and a more predictable outcome for our clients. If the AI helps us ask the right questions every time, capture the right details, and reduce avoidable back-and-forth, that’s not hype…that’s operational leverage.

Erin Pemberton: When you dug in, what mattered most from a technical standpoint? Integration, data, control, reliability, something else?

Kevin Harbauer: Reliability and control were table stakes. If you can’t trust it to behave consistently, you can’t put it anywhere near a workflow tied to legal timelines and sensitive data.

After that, integration mattered a lot…not “can it connect to something,” but can it fit into the real process without forcing us to redesign everything around the tool. We needed call recording, structured capture of what happened, and the ability to tie outcomes back to our case and custodian workflows.

And then data handling. In our world, privacy and auditability aren’t optional. You need clear boundaries on what’s stored, how it’s accessed, and how you prove what happened on a call when someone asks later.

Erin Pemberton: Legal record retrieval isn’t exactly forgiving. What did you need to feel confident about in order to put AI into this workflow?

Kevin Harbauer: We needed confidence that it would reduce risk, not introduce new categories of failure. That meant a few practical things:

• Predictable behavior: No improvising on policy-critical topics…fee discussions, authorization requirements, release forms, identity verification, that kind of thing.
  ‍
• Traceability: If there’s a dispute, we need to be able to go back to the call recording and see exactly what was said and what data was captured.
  ‍
• Guardrails and escalation: It has to know when to hand off to a human, especially when a custodian is frustrated, confused, or asking something out of band.
  ‍
• Privacy and security alignment: It must fit cleanly into how we handle sensitive information…least privilege, access controls, retention, and a defensible audit trail.

I’m comfortable with AI assisting humans early. I’m cautious about AI acting alone unless the failure modes are well understood and tightly constrained.

Erin Pemberton: You’re still early, so what tells you this is headed in the right direction so far?

Kevin Harbauer: The early signal is not “wow the AI sounds human.” It’s operational. We’re seeing more consistency in call handling…less variance in how details get captured and fewer calls that end with “we’ll call you back because we missed something.” The recordings are also improving coaching. Instead of generic feedback, we can review real calls, identify where the breakdown happened, and reinforce what “good” looks like with evidence. That helps field expeditors improve faster.

Custodian experience is another signal. When the interaction is clearer and more structured, custodians spend less time repeating themselves, and we spend less time chasing missing details. Over time, that should translate into fewer touches per order and a shorter path from request to records delivered.

Erin Pemberton: If another CTO in a regulated or complex industry asked you how to approach conversational AI, what would you tell them to focus on, and what would you suggest they ignore?

Kevin Harbauer: I’d tell them to focus on the workflow first. Pick a narrow, high-volume process where outcomes are measurable and where the current pain is obvious…cycle time, rework, quality drift, training burden. Then design the AI role as a constrained system inside that workflow, not a general-purpose assistant. 

What to focus on:

• Clear success metrics: touches per case, time to completion, first-call resolution rate, error rate, handoff rate, custodian satisfaction signals.
  ‍
• Guardrails and escalation paths: define what it can do, what it cannot do, and when it must hand off.
  ‍
• Auditability: recordings, logs, and a way to answer “what happened and why” without guessing.
  ‍
• Security and privacy alignment: don’t bolt this onto your environment. Treat it like any other system that touches sensitive data.
  ‍
• Change management: the hardest part is usually adoption…coaching, scripts, and getting humans to trust and use the system correctly.

What to ignore:

• Demo charisma: a great demo voice doesn’t mean it will survive production edge cases.
  ‍
• Overpromises of full autonomy: in regulated workflows, “human-in-the-loop” is often the right design for longer than vendors want to admit.
  ‍
• Generic ROI calculators: your ROI will come from specific bottlenecks, not from broad claims about automation.

Erin Pemberton is a Senior Customer Marketing Manager at Replicant. 

Schedule time with an expert to learn more about how Replicant can transform your contact center with AI.