Law firms and legal advice
What AI can genuinely do in a law firm, where professional confidentiality draws the line, and how to set up use in a way that survives scrutiny.
What this is about
A substantial part of legal work is text work with clear rules: reviewing files, ordering facts, capturing deadlines, comparing contracts, structuring submissions. That is exactly where AI is strong.
The advice itself, the assessment of a matter and every statement to a client or a court remain the responsibility of the qualified professional.
What works well
| Task | Value | Checked by |
|---|---|---|
| Summarising a file | high | Case handler |
| Structuring a submission | high | Qualified professional |
| Comparing contract clauses | high | Qualified professional |
| Extracting deadlines from documents | medium | Diary control, twice |
| Finding case law | medium | Mandatory against the database |
| Answering a legal question | low | Unusable without a source |
Introducing it in a firm
- 01
Choose a task, not a tool
Start with something frequent, with a checkable result and no judgement required. File summaries and contract comparison qualify.
- 02
Professional conduct check before the first document
Processing agreement, the provider's confidentiality obligation, server location, exclusion of use for training. Only then does the first client document go in.
- 03
Fix the review step
Who checks what, to what depth, and how is that documented? Answering that in advance is the difference between an aid and a risk.
- 04
Settle client information
Whether and how clients are told belongs in the engagement letter, not in a later discussion.
Metrics that hold
| Quantity | How collected |
|---|---|
| Time per file summary | Before and after, same type of file |
| Correction rate by the professional | Share of paragraphs changed |
| Bad citations found per 100 | Sample against the database |
| Share of rejected outputs | Too uncertain, goes to manual handling |
- No client data in tools without a checked agreement.
- Never set a deadline from an AI extraction alone. Four-eyes stays.
- Never pass an output on as advice without a professional having checked and owned it.
- Document the reviewed state, not only the result.
The professional conduct frame
Three regulatory circles apply at once and must be kept apart.
| Circle | Subject | Core question |
|---|---|---|
| Professional conduct | Confidentiality, outsourcing | May this provider be engaged? |
| Data protection | Personal data | Is there a legal basis and a processing agreement? |
| AI Act | The system itself | Which risk class, which deployer duties? |
Confidentiality. Bar rules in Germany (§ 43a BRAO) and Austria (§ 9 RAO) impose confidentiality, backed by criminal sanction. Engaging a service provider is permissible where the provider has been bound to confidentiality and informed of the consequences, and where the engagement is necessary. § 43e BRAO regulates this explicitly for Germany; comparable requirements follow from the Austrian rules and bar guidance.
What that means in practice:
- A written confidentiality undertaking from the provider, not merely a processing agreement.
- Exclusion of any use of inputs for training, contractually and technically evidenced.
- Server location and sub-processors named and checked.
- Access rights in the tool set so that matters stay separated.
- A register of which matters were handled with which tool.
Data flow of a typical task
Client document
→ filed in the practice management system (record)
→ extracted to text, locally or at the checked provider
→ model call with a matter reference, without names where possible
→ output as a draft, marked as such
→ review by the qualified professional, documented
→ release or rejection, logged
The "without names where possible" step is the single most effective lever: pseudonymising before the model call reduces risk substantially and is almost always possible for contract analysis and drafting structure.
Evidence
For later scrutiny by a bar, a regulator or a client, four items per matter:
| Item | Why |
|---|---|
| Tool and version | Shows which build was used |
| Categories of data entered | Not the content, the categories |
| Reviewer and timestamp | Evidences human responsibility |
| Extent of changes | Shows it was reviewed rather than waved through |
See Logging and Data processing agreements.
The checklist for client work
FREE ACCOUNT
Checklist: AI in client work
Confidentiality, the duty to check and billing in one sheet to work through before the first use in a matter.
Checklist3 items
Related courses and sources
Austrian Bar
The representative body publishes what professional conduct rules require. For AI in client work that is the authoritative source, not the tool vendor.
For Austrian law firms: authoritative on professional conduct, not the tool vendor.