Checklist: using AI safely in law firms and fiduciary offices
For: Law firms, notaries, fiduciary and audit firms
Updated: 2026-10
AI can save law firms and fiduciary offices a lot of time but touches professional secrecy and data protection directly. Use becomes safe with clarified secrecy duties, tools with a contract and no training on client data, minimised data, checking of every statement and citation, transparency towards clients, and a policy with training.
In many law firms and fiduciary offices, staff already use AI tools for drafts, translations or summaries. Unlike most sectors, though, the information involved is subject to special secrecy protection and often contains sensitive personal data.
This checklist describes the organisational and technical steps for responsible use. It does not replace a professional-law assessment; that remains with the firm and, where relevant, the competent professional body or supervisor.
The checklist
- 01
Clarify secrecy duties
Record which duties apply: the criminally protected professional secrecy for lawyers, notaries and statutory auditors, and contractual and statutory confidentiality in the fiduciary field. From this follows under which conditions external providers may be involved at all.
Done when: The applicable secrecy duties and the conditions for involving providers are recorded in writing.
- 02
Approve only suitable tools
For client matters, use only tools with a company account, a contract, training on inputs excluded, a known processing location and a clear retention period. Consumer accounts are off-limits for client data.
Done when: A list of approved tools with review results exists, and personal accounts are excluded for client data.
- 03
Minimise client data
Give a tool only as much as the task needs. Remove or replace names, addresses and identifying details where possible, especially in sensitive matters.
Done when: The policy contains examples of which details to remove before use.
- 04
Check processing location and disclosure abroad
Clarify where the provider processes data and which sub-processors are involved. For third countries without adequacy, appropriate safeguards and a documented assessment are needed.
Done when: Processing locations and the basis for disclosure abroad are documented per tool.
- 05
Check every statement and citation
AI outputs are drafts. Judgments, statutory provisions and citations are checked against the primary source, because language models can produce convincing but invented citations. Deadlines and dates are never taken from an AI output.
Done when: The duty to check is recorded, with an explicit rule for citations and deadlines.
- 06
Transparency towards clients
Decide how clients are informed about AI use, for example in the terms of engagement. A chatbot on the website is labelled as AI and does not give professional answers.
Done when: Terms of engagement or client information include a provision on AI use.
- 07
Policy and training
Introduce a short usage policy with approved tools, data rules and the duty to check, and train all staff, including assistants and trainees. Document attendance.
Done when: The policy is in force, and training is documented with attendance.
- 08
Incidents and review
Set a reporting route in case client information has gone into an unapproved tool, and review the rules on a fixed cycle.
Done when: The reporting route and review date are set and linked to the data breach process.
Common mistakes
- —Client data in consumer accounts of AI tools where training is active.
- —Citations or judgments taken unchecked from an AI output.
- —AI features in existing practice or accounting software switched on without review.
- —A website chatbot giving professional answers and thereby creating expectations of advice.
- —Rules only for lawyers but not for assistants, trainees and external staff.
What this checklist does not cover
- —This checklist is not legal advice. The professional-law assessment in each case remains with the firm and the competent professional body or supervisor.
- —It covers the use of AI tools, not liability for advisory errors.
- —Fiduciary and audit firms may face additional duties from anti-money laundering law or audit oversight.
- —It reflects the position as of October 2026.
Parent service: EU AI Act & Compliance Advisory
Matching offers
AI usage policy and vendor review for companies
The package puts AI use in your company into clear shape: an initial inventory of all AI tools, a short, understandable usage policy, a review of the key AI vendors for data use and contracts, a quick approval process and kick-off training that also evidences the measures under Art. 4 AI Act.
Internal AI assistant with source citations for your own documents
An internal AI assistant answers questions based on your own documents — manuals, policies, contracts, project files — and cites the source for every answer. What matters are permissions, so each person only sees what they may see, evaluation of answer quality and a deliberate choice of model and data residency.
FAQ
May lawyers use AI tools at all?
In principle yes, provided professional secrecy is preserved: suitable tools with a contract, minimised data and providers bound to confidentiality. The assessment in each case lies with the firm.
Why is checking citations so important?
Language models can produce convincing but invented judgments and citations. In several countries, courts have reprimanded filings containing such citations.
Does the AI Act apply to Swiss law firms?
Only where there is an EU nexus, for example when AI output is used in the EU. Regardless, professional secrecy and the Swiss data protection act are decisive.
Where does AI help law firms most?
With drafts, summaries of public sources, translations and internal search across their own templates and documents — each checked by a professional.
More checklists
Checklist: website relaunch for law firms and fiduciaries
A law firm relaunch succeeds when practice areas and people are clearly structured, old addresses are cleanly redirected, content is factual under professional rules, the contact form is designed for confidentiality, structured data and local details are correct, and indexing and enquiries are measured after launch.
EU AI Act conformity: a checklist for the first pass
A workable first pass through the EU AI Act has six parts: know which AI runs in the business, determine your role for each system, classify under Article 6, check transparency duties separately, ensure AI literacy, and file everything so it can be found under scrutiny.
High risk or not: reasoning an Annex III classification properly
High-risk classification follows a fixed order: first the deployment area under Annex III, then whether the system plays a substantive role in the decision, then the exemption in Article 6(3). Each of those steps has to be documented with reasoning.