Lawyers · AI Act

Lawyers — AI Act: legal AI and professional secrecy

Lawyers are adopting AI tools for research, drafting, and case law analysis. Under the AI Act, these uses generally fall under limited risk; high risk targets AI designed to assist a judicial authority. This guide clarifies qualification, reliability, and confidentiality.

DPO / CISO team — Data Comply One Updated on 15 June 2026

In brief

  • Regulation: AI Act.
  • Lawyers deploying AI tools are deployers; the software publisher is the provider.
  • Qualify use cases.
  • Supervise reliability.
  • Protecting confidentiality.
  • For limited-risk uses, the AI Act primarily translates into transparency obligations.

Regulatory deadlines

The key dates of this regulation.

August 2024

Entry into force

In force

February 2025

Ban on prohibited practices

In force

August 2025

General-purpose AI models (GPAI) & governance

In force

August 2026

High-risk system obligations (Annex III)

In force

August 2027

High-risk embedded in products (Annex I)

Upcoming

What does the AI Act cover?

The AI Act classifies as high-risk any AI designed to assist a judicial authority in the research and interpretation of facts and law. Tools used by the lawyer themselves (research, drafting) generally fall under limited risk (transparency).

The reliability and confidentiality of injected data remain major points of attention.

Is the 'Lawyers' sector concerned?

Lawyers deploying AI tools are deployers; the publisher is the provider. Internal uses do not, in principle, constitute high risk.

Professional secrecy requires particular vigilance regarding data transmitted to tools.

Detailed obligations

Qualify use cases

Confirming the limited risk of search and drafting tools.

Supervise reliability

Managing the risk of errors and verifying outputs.

Protect confidentiality

Control the case file data transmitted to tools, in compliance with professional secrecy.

Ensure transparency

Inform, where applicable, of the use of AI.

Sanctions & risks

For limited-risk use cases, the AI Act translates mainly into transparency obligations. The most tangible risk is a breach of professional secrecy through a poorly controlled tool, with associated disciplinary exposure.

Application timeline

  • 1Entry into force. 1 August 2024.
  • 2Transparency. Progressively applicable.

Common mistakes in the sector

  • 1Presumed reliability. Reusing AI outputs without verification.
  • 2Exposed secret. Injecting case file data without oversight.
  • 3Absent transparency. Failing to disclose AI usage.
  • 4Charter missing. Using AI without an ethical framework.

Practical case

A law firm uses an AI-powered legal research tool. A limited-risk use case, it systematically reviews outputs, restricts the case data transmitted, and adopts a policy reconciling AI use with professional secrecy.

Compliance roadmap

  1. 1

    Inventory. Mapping AI tools.

  2. 2

    Qualify. Confirm limited risk.

  3. 3

    Supervise. Verifying outputs.

  4. 4

    Secure. Protect injected data.

  5. 5

    Charter. Establish a charter respecting professional secrecy.

Frequently asked questions

An AI assisting a judicial authority qualifies as such; law firm tools generally fall under limited risk.

Back to the Lawyers guideLawyers & GDPR

Take action on AI Act

Free assessment or a chat with an expert dedicated to lawyers.

Start my free assessment Talk to an expert

They already trust us

See how organisations in the lawyers sector secured their compliance with DCO.

See testimonials