top of page

Generative AI in law firms: the rules to apply now

Writer: Alexandre KOERFER
Alexandre KOERFER
9 hours ago
6 min read
Wooden shelf filled with old bound books

Generative AI tools have entered law firms faster than internal rules have. Yet the applicable framework already exists: professional secrecy, the duty of competence, the GDPR and, since 17 March 2026, an ethics guide on AI from the Conseil national des barreaux (CNB, the French national bar council) [1]. Here are the rules to apply now, text by text.

Professional secrecy also applies to AI tools

As the Criminal Division of the Cour de cassation (the French Supreme Court) noted in a judgment of 3 March 2026, Article 66-5 of the Law of 31 December 1971 protects by professional secrecy, ‘in all matters, whether in advisory work or in litigation’, consultations, correspondence, notes of meetings and, ‘more generally, all documents in the file’ [2]. Article 2 of the RIN (Règlement intérieur national, the national rules of the French legal profession) specifies that this secrecy is ‘a matter of public policy’ and that it is ‘general, absolute and unlimited in time’ [3]. It covers, in particular, clients' names and the lawyer's diary [3].

The CNB's practical guide of September 2024 draws the consequence: lawyers ‘must never communicate data covered by professional secrecy’ to a generative AI tool [4]. This includes clients' names, the confidential information they have entrusted and case strategy [4]. The Council of Bars and Law Societies of Europe (CCBE), in its guide of 2 October 2025, likewise recommends entering no personal, confidential or client-related data without safeguards [5].

The CNB also flags the risk of indirect identification: an amount, an internal project name or distinctive wording may be enough [4]. It recommends limiting input to strictly necessary data and pseudonymising, for example by replacing names with fictitious initials [4].

Competence and prudence: every output must be checked

Article 1.3 of the RIN requires lawyers to show their clients ‘competence, dedication, diligence and prudence’ [3]. Applied to AI, this duty has two aspects: understanding the tool's limitations and checking what it produces.

The CNB calls on lawyers to ‘rigorously evaluate the output to detect errors or hallucinations’ [4]. The CCBE points out that these tools can invent court decisions and that relying on unverified outputs exposes lawyers to sanctions and to liability claims [5]. The CNIL recommends never reproducing the outputs of these systems as they stand [6].

The risk is no longer theoretical in France. On 18 December 2025, the tribunal judiciaire (court of first instance) of Périgueux noted that case-law references cited ‘do not appear to correspond to published decisions’ and invited the applicant and their counsel to check their sources [7]. At the end of December 2025, the administrative court of Orléans found that several of the precedents relied on did not exist [7]. A minimum check consists of:

  • tracing every decision cited in an official database, with its court, date and number;

  • rereading every legal text cited in its current version;

  • having a lawyer review any generated passage before it is sent to the client or filed.

GDPR and choice of tools: the firm remains responsible

The GDPR applies to every firm, whatever its size. Processing carried out by means of AI must comply with its principles: purpose limitation, data minimisation, storage limitation, security and data subjects' rights [4].

The CNIL (the French data protection authority) invites any organisation deploying a generative AI tool to consider its own role and that of the provider, and then, depending on the case, to enter into a data processing agreement or a joint controllership arrangement [6]. If the firm connects the tool to its own document base containing personal data, it is also a controller for that processing [6]. Where data is likely to be transferred outside the European Union, its processing by the recipient must be subject to appropriate safeguards [6]. Finally, the CNIL recommends involving the data protection officer and, where applicable, carrying out a data protection impact assessment (DPIA) [6].

The CNB notes that the data entered is transmitted to the vendor, often an American one, and is sometimes used to improve its models [4]. It adds that an option to refuse such reuse, in the absence of any means of verification, does not remove the risk of a breach of secrecy or of the GDPR [4]. The CCBE and CNIL guidance leads to the following checks:

  • read the vendor's terms of use to find out how the data entered is used [5];

  • obtain contractual guarantees: a confidentiality clause, no retention of data, a data processing agreement [5];

  • where relevant, favour processing within the European Union or in an environment controlled by the firm [5];

  • opt out of the reuse of usage data and of history logging where the tool allows it [6];

  • submit no personal or confidential data to a consumer service [6].

Informing the client

The CNB guide adopted on 17 March 2026 addresses the information owed to clients and the setting of fair and balanced fees where AI is involved in the firm's work [1]. The CCBE recommends being transparent with clients, particularly where an informed client would be likely to object to the use of the tool or to express reservations [5]. It notes that some clients may ask for no AI to be used on their matter [5].

Internal policy and training

Article 2.3 of the RIN requires lawyers to ensure that secrecy is respected ‘by the members of staff of their firm and by any person who cooperates with them’. It adds: ‘They are answerable for any breaches of secrecy thus committed’ [3]. Unregulated use of AI by an associate or an assistant therefore engages the lawyer's responsibility.

The CNB recommends an IT charter or internal guide specifying when and how the tools may be used [4]. It presents training as essential for all members of the firm: writing prompts, the tools' limitations, detecting bias and hallucinations, and checking reliability [4].

At European level, Regulation (EU) 2026/1744, which entered into force on 27 July 2026, rewrote Article 4 of the EU AI Act (Regulation (EU) 2024/1689): providers and deployers ‘shall take measures to promote the development of AI literacy’ among their staff [8].

Our recommendations

  • Prohibit in writing the entry of client names, documents and any information covered by professional secrecy into a consumer tool.

  • Take stock of the tools actually used in the firm, read their terms and, with the DPO, put the necessary contractual commitments in place.

  • Disable history and data reuse wherever possible, and check this setting for each account.

  • Require human verification of every reference cited before anything is sent or filed.

  • Adopt an AI use policy, circulate it to all staff and organise regular training.

If you would like to review the use of AI in your firm, the Tao Sense free assessment is a first step.

Sources

Comments

Commenting on this post isn't available anymore. Contact the site owner for more info.
bottom of page