AI Act: new obligations for law firms
The AI Act does not exempt law firms either. Starting from August 2, 2026, obligations regarding AI literacy and, for specific scenarios provided, transparency are indeed applicable. Therefore, law firms that use artificial intelligence systems will also have to adopt internal measures aimed at ensuring use that complies with the regulations, the violation of which can lead to sanctions.
In particular, law firms are classified as “deployers”, i.e., professional users of AI systems developed by third parties, and therefore will have to adopt suitable procedures to protect client data, monitor possible risks, and guarantee a responsible use of the tools.
First of all, it will be necessary to proceed with the census of the software used by the firm, identifying all platforms equipped with functionalities based on artificial intelligence, such as, for example, ChatGPT or Copilot.
Once the tools have been identified, it will be appropriate to distinguish between internal and external activities.
Internal activities can include, for example, doctrinal and jurisprudential research. They can also include the analysis of documents and the preparation of contracts and other deeds. In these cases, the professional’s responsibility is central. The results produced by AI cannot be adopted automatically. Instead, they must undergo careful verification and critical review by the professional.
External activities, on the other hand, refer to situations in which the use of AI comes into contact with clients or other subjects. In such situations, transparency obligations take on a particular role. If a subject interacts directly with an AI system, they must be adequately informed of this. When content intended for the public is generated or manipulated by AI, it must comply with the transparency obligations set out in the regulations.
Even the documents relating to the conferral of the professional mandate may require specific clauses aimed at regulating the possible use of AI tools, clarifying that their use does not entail any exemption from professional liability.
Secondly, the firm will have to guarantee an adequate level of AI literacy for its staff.
To this end, it will be advisable to document the training through a specific internal register, indicating the personnel who have completed the training, any updates carried out, the topics and risks addressed during the courses, and the relevant dates.
The objective is to ensure that the people who use AI systems in the performance of their activities know not only the potential of the tools, but also the risks connected to their use and the related regulatory obligations.
Particular attention must be paid to the protection of data and confidential information of clients. The use of AI tools cannot in fact translate into the indiscriminate disclosure or insertion of personal data or information covered by confidentiality obligations.
Firms must therefore adopt internal procedures establishing what information can be entered into the various systems and under what circumstances. The use of professional or corporate versions of AI services can offer greater guarantees in terms of data management, but does not eliminate the need to carry out a prior assessment of the tool and its settings.
The sanctioning framework envisaged by the AI Act can reach, depending on the violation and the subject involved, particularly high amounts, designed mainly for large entities, such as up to 15 million euros or 3% of global turnover. For small and medium-sized law firms, however, any measures taken by the Data Protection Authority or the possible consequences from their respective Bar Associations for the violation of professional and deontological obligations are also relevant.
The AI Act does not aim to prohibit or discourage the use of artificial intelligence in law firms. On the contrary, the objective is to allow its conscious and responsible use, ensuring that the adoption of new technologies does not lead to a reduction in professional standards.
