Is it safe to use artificial intelligence with my clients' data in a law firm?

It's one of the first questions law firms ask us, usually before price. The short answer is that the risk isn't artificial intelligence itself, but where the data ends up and who checks what the tool produces. Both are decided when you choose the tool.

What does professional secrecy cover, and what has it to do with AI?

Spain's General Statute of the Legal Profession (Royal Decree 135/2021) defines secrecy very broadly: it covers all facts, communications, data, information, documents and proposals a lawyer learns, issues or receives in practice (Article 22.1). And it doesn't stop with the lawyer, who must ensure that staff and anyone else cooperating with them respect it too (Article 22.4).

An AI provider reading a matter's email or documents is cooperating with the firm in that sense. So the useful question isn't "can I use AI?" but "can this provider guarantee the same secrecy as my team?". You find that in the contract, not in the marketing.

What does the GDPR say if data goes through an AI provider?

When a third party processes personal data on the firm's behalf, it is a processor, and the GDPR requires a contract with specific guarantees (Article 28):

• it processes the data only on your instructions
• its staff are bound by confidentiality
• it applies appropriate security measures (Article 32)
• it helps you handle your clients' rights
• it deletes or returns the data at the end

If data leaves the European Economic Area, the transfer needs safeguards as well (Articles 44 onwards). The Spanish data protection authority (AEPD) has a guide on processing that embeds AI. It covers these third-party relationships, data minimisation and impact assessments.

Is pasting text into ChatGPT the same as using a contracted tool?

No. The difference is in the terms, not the model:

Using a personal chat to prepare a document with a client's data means, in practice, taking that data out of the firm without a contract. Tasks without personal data, like organising ideas or polishing generic wording, carry a different risk.

What does the Bar itself say?

On 10 April 2026, Spain's General Council of the Bar approved its third deontological circular, on documents prepared with the help of generative AI. It treats AI as an auxiliary tool under human supervision. Lawyers should know the tool well, never use an output without reviewing it fully, check it against reliable legal sources and document when and why AI was used. Unverified errors can lead to professional liability.

Its White Paper on AI and the Legal Profession, from January 2026, says the same thing: AI complements the lawyer's work, and responsibility for what is filed stays with the lawyer.

What if the AI gets it wrong?

The best-known mistake is invented case law, which has already led to fines for lawyers in the Canary Islands. Three rules prevent it:

• Don't cite what isn't in a source. Citations come from your legal database or the official case-law search, never from what the model "remembers".
• Calculations with rules, not the model. Severance and deadlines are calculated with programmed, tested rules.
• Lawyer approval before anything goes to a client, the other side or a court.

Will I lose the personal touch with my clients?

Not necessarily. What gets automated is the preparation: reading the email, filing it in its case, gathering the data and leaving a draft. The lawyer decides what is said and how, and the client keeps dealing with them. Used well, the effect is usually the opposite: the lawyer replies sooner because the morning isn't spent sorting email.

Before using AI with client data, check this

1. A data processing agreement signed with the provider, with confidentiality for its staff.
2. No training on your data, in writing.
3. Processing in the EU, or transfer safeguards if not.
4. Only the data needed. Pseudonymise names and ID numbers when the task doesn't need them.
5. Per-person access and a log of who did what with which data.
6. Lawyer approval of everything that leaves the firm.
7. Your clients' privacy clause reviewed to include the new recipients.

How we do it at Amud

The digital employee we set up for a law firm works inside its own accounts: its email, its folders and its practice management software. It uses models through business services that don't train on the data, with EU AI providers and pseudonymisation when the case calls for it. We sign an NDA and a data processing agreement, and every action is logged with who approved it. See how it works in an employment law firm in this case study and what it does day to day in automation and AI for law firms.