Legal framework for document handling

Article 66-5 of the law of December 31, 1971, defines the scope of confidentiality for legal documents, covering all consultations, correspondence, and meeting notes, as well as any other documents in a file. The National Internal Regulations describe this confidentiality as general, absolute, and unlimited in time.

Use of digital tools and third-party access

Inserting a draft of conclusions into an online conversational assistant involves sharing its content with third parties, including the service provider, its subcontractors, and sometimes the teams that improve the model. Most terms of use for public offers allow the reuse of conversations for training purposes unless explicitly disabled.

Legal risks and disciplinary concerns

The criminal liability for transmitting confidential information is determined by judges and depends on the circumstances, according to Article 226-13 of the Penal Code. Disciplinary risks are immediate, as emphasized by the National Council of Bars since 2024, which advises lawyers not to submit confidential information to tools they cannot control.

Jurisdiction and data control issues

The contract between a law firm and a service provider does not address jurisdictional issues. While some argue that a European-based contract with encryption is sufficient, the applicable law for the service provider remains a challenge. Major model developers are American, and the Cloud Act of 2018 allows U.S. authorities to request data from providers, regardless of where it is stored.

Local installation as a potential solution

For two years, open language models with published weights can run on desktop servers. If installed in a firm’s premises or on a machine controlled only by the firm, these models do not transmit data externally. The query, attachments, and response remain on the firm’s disk, making the legal situation simpler.

Limitations of local models

Despite the benefits, local models are less performant than the largest online models for certain tasks, such as long reasoning or legal research. They are, however, useful for summarizing documents, comparing contract versions, and finding clauses in large files.

Security and maintenance requirements

A local model on a poorly protected machine is no more secure than an online service. The same security requirements apply, including access control, logging, encrypted backups, and updates, just as for the firm’s other information systems.

Maintenance and access control

If a service provider accesses the server remotely, it may have access to the data. The firm’s contract with the provider must include confidentiality clauses, traceability of interventions, and ideally, open access on a case-by-case basis.

AI Act and its impact on law firms

The European AI Regulation, modified in 2026, has delayed some obligations for high-risk systems. However, two points apply to law firms using generative AI assistants: staff training and transparency when disseminating AI-generated content.

Choosing the right AI model

Before selecting an AI model, firms should ask: what information is currently being inputted into these tools? For which tasks is the best model needed, and for which can a more modest model suffice? A local model may be used for confidential work, while an online model can be used for research without client data.

Client trust and data location

Clients will ask who, outside the firm, can access their data. Generative AI does not eliminate professional secrecy but raises the question of where the file documents are physically located, forcing firms to be more transparent about data handling.