DentroChat
← Blog

AI for Law Firms: AI on Client Files, Legally

Written byPaul Plessing
Reviewed byPaul Petritsch
A client matter file in DentroChat marked In the EU, with checks for EU processing, no model training and citations verified in the source

AI for law firms always starts with the same problem: can you upload a client file to an AI tool without breaking professional secrecy or the GDPR? Yes, you can, as long as the provider keeps the data in Europe under an Art. 28 GDPR Data Processing Agreement and does not use your uploads to train its models, and a lawyer checks the legal citations at the end. We built DentroChat for this so your chats and files stay on European servers and never get used for training, which means you can summarize a long file or write a first draft without leaking client secrets.

Can a law firm use AI on client files?

Yes, if the firm controls where the data goes and a lawyer checks what comes back. The Council of Bars and Law Societies of Europe (CCBE) explains this in its guidance on generative AI for lawyers. Confidential client data should only go into an AI tool when the provider agrees in writing that your data is not kept or used to train models. You also have to check every AI output against the original sources before relying on it, because AI models still invent statutes and court decisions that sound real.

Lawyers are under a lot of pressure to work faster on routine files. The CEPEJ 2024 evaluation report counted an average of 180 lawyers per 100,000 inhabitants across Europe (based on 2022 numbers), so there is plenty of competition in almost every market. Saving an hour on a summary helps, although it is obviously not worth it if a client loses trust in how you handle their documents.

Why client data needs more care than normal business data

Client files usually have the worst things a person or a company is dealing with, like a divorce, a criminal investigation, or a contract dispute they cannot afford to lose. Lawyers hold this under professional secrecy, which stays in place even after the case is over. In England, Wales and Ireland, legal professional privilege covers much of the same ground.

You have to treat an AI vendor the same way you treat any external IT provider that could theoretically read your files. Before uploading a client document, check a few basic things:

  • Where the servers are located and which company actually owns the provider.
  • Whether you get a Data Processing Agreement under Art. 28 GDPR and a clear rule that your data will not train their models.
  • Whether you can delete your files and chats yourself once a matter is closed.

What the rules say in different European countries

Every national bar has its own take on this, so you still need to check your local rules. Here is what is happening in a few places right now:

  • EU: Since 2 February 2025, Art. 4 of the AI Act says organisations using AI have to make sure their staff know how to use it properly. That applies to law firms too.
  • Germany: The Federal Bar Association (BRAK) put out guidance on AI in December 2024 that focuses on confidentiality under § 43a(2) BRAO, binding external service providers under § 43e BRAO, and the lawyer’s duty to check every result.
  • Italy: Law 132/2025, Art. 13, says lawyers can use AI for support work, and they must tell the client in clear language which AI tools they use.
  • Spain: The General Council of Spanish Lawyers (CGAE) published its White Paper on AI and the Legal Profession in January 2026 finding that 60% of Spanish lawyers already use AI tools, and reporting by El Confidencial shows that internal AI protocols have become standard across major Spanish firms.

A practical checklist for your firm

  1. Write down a short rule on which AI tools your people are allowed to use, and which cases should never touch AI.
  2. Keep a simple list of the tools you use and what you use them for.
  3. Take client names and identifying details out of documents when you do not need them in the prompt. The CCBE expects full anonymisation if anyone uses a public model.
  4. Look up every court decision and statute number in the original source before putting it into a letter or filing.
  5. Tell your clients if your national bar or local law says you have to.

Where DentroChat fits in

DentroChat runs on servers in Europe and does not use your chats or files to train AI models. Uploaded files stay in your workspace until you delete them. If you run a firm with several people, DentroChat Business gives you a Data Processing Agreement and an audit log. We also list every subprocessor on our subprocessors page so your data protection officer can see who is involved without having to email us first.

DentroChat is a general AI chat and not a legal database, so it will not replace your own legal check on a file. If you want more detail on how document uploads work on our side, we wrote that up in AI for confidential documents.

Frequently asked questions

Can a law firm use ChatGPT on client files?

Regular consumer accounts often use prompts to improve the models depending on what settings you clicked, and they do not give you the Data Processing Agreement a law firm needs under GDPR. Always read the contract and data settings before putting a real file in.

Do lawyers have to tell clients they use AI?

That depends on where you practice. In Italy the law requires it. In Germany, the BRAK guidance recommends being open with clients, even though there is no strict rule forcing you to tell them every time. Check what your own bar association says.