How can a law firm use legal AI without putting sensitive data at risk? The choice of tool is essential: it must protect professional secrecy, limit the use of data and allow the firm to keep control of its files.
How the tool is used matters just as much. Before using an AI, it is necessary to know where the data is stored, who can access it and whether it is used to train models.
What AI changes for the firm’s data
Artificial intelligence can make legal research, drafting, contract analysis and the organisation of work easier.
But as soon as it processes personal or confidential data, the firm must check how that information is used and protected.
The Federal Act on Data Protection (FADP), in force since 1 September 2023, also applies to processing carried out with AI.
The issue therefore goes beyond the mere choice of software. It is necessary to know which data is used, why it is used and which measures protect the clients and the firm.
When the GDPR and the AI Act apply
The GDPR protects personal data. The European AI Act, for its part, imposes rules on artificial-intelligence systems according to their level of risk.
These two texts can apply at the same time.
A Swiss law firm is not automatically subject to the GDPR or the AI Act. The GDPR can in particular apply when a firm offers services to persons located in the European Union or monitors their behaviour.
The AI Act can also cover certain uses when an AI system or its results are used in the European Union.
In Switzerland, the FADP remains the main framework for the processing of personal data.
The basic rules to follow with AI
Using AI does not change the main principles of data protection.
The firm must in particular:
- define clearly why the data is used;
- have a legal basis for its processing;
- collect only the data that is actually necessary;
- inform the persons concerned when this is required;
- allow the exercise of the rights of access, rectification, objection or erasure;
- build data protection into the tool from the design stage.
These rules are particularly important with AI, because some systems remain difficult to understand or explain.
When a data protection impact assessment is needed
A data protection impact assessment may be necessary when processing presents a high risk for individuals.
The GDPR provides for this obligation in Article 35. In Switzerland, Article 22 FADP also provides for a prior assessment when processing may result in a high risk for personality or fundamental rights.
This can in particular concern:
- the processing of a large volume of data;
- particularly sensitive data;
- profiling;
- important automated decisions.
An impact assessment must describe the processing, identify the risks and provide for concrete measures to reduce them.
Training and analysis: the difference
It is important to know what happens to a document sent to an AI.
When a document is used to train a model, its content can be used to improve the system. This can create a risk for the confidentiality of the data.
When a document is used only to produce an answer, this is called inference. The file is analysed in order to answer a request, without being built into the model.
For legal professionals, it is preferable to choose a solution that does not use client files to train its models.
This rule must be clearly stated in the provider’s contract.
The questions linked to intellectual property and the use of data are set out in more detail in our article on the ownership of legal data.
Where the data is hosted
The location of the servers is an important element in the choice of a solution.
Hosting in Switzerland or in the European Union can make it easier to keep control of the data and limit certain transfers to third countries.
For lawyers, notaries, banks and other professions subject to strict confidentiality duties, this point is particularly important.
The contract with the provider must also specify:
- that the provider processes the data only on behalf of the firm;
- that it acquires no rights over the files;
- that it may not use the data to train its models;
- that access to the data is limited and secure.
Security audits or certifications can also help to check the reliability of the provider.
Hallucinations and bias: always check the answers
An AI can produce an answer that appears correct while it contains an error. This is called a hallucination.
It can also reproduce certain biases present in its training data.
In law, each important statement must therefore be capable of being checked against a reliable source.
AI remains an assistance tool. It replaces neither legal analysis nor the professional’s validation.
Our article on AI-assisted legal analysis presents this verification method in more detail.
The firm remains responsible
Using an external provider does not automatically transfer responsibility for the processing.
The firm must keep a clear policy on the use of AI by its staff.
It is useful to define:
- which tools may be used;
- which types of data may be sent to them;
- who may use these tools;
- which checks must be carried out before using an answer.
Training the teams is also important in order to avoid errors and poor practices.
Questions to ask before choosing an AI
Before adopting a tool, the firm must start from its actual use.
A tool used only to rephrase public information does not present the same risks as a tool that analyses confidential contracts.
Before choosing a solution, it is necessary in particular to check:
- which data will be processed;
- for what purpose it will be used;
- where it will be stored;
- who will be able to access it;
- whether the data is used to train models;
- which processors are involved;
- which security measures are applied;
- whether the tool integrates properly with the firm’s software.
For individuals, the issues are different. They are presented in our guide to legal AI for individuals.
What Silex provides
Silex is an AI assistant designed for Swiss law. How it works is presented on the product page.
According to Silex, its clients’ data is not used to train the models.
Internal documents are analysed in Silo, a space designed for working on the firm’s files without integrating their content into the AI’s training.
Silex is hosted in Switzerland by Infomaniak. Its commitments on security and professional secrecy are presented on a dedicated page.
The answers are also accompanied by sources so that the lawyer can check them before using them.
Integrating AI into the firm’s tools
AI is more useful when it integrates directly into the tools already used by professionals.
The integration of Silex into WinLex and SkyLex makes it possible, for example, to start a search without leaving the file.
The partnership between Silex and MCR Solutions also aims to integrate legal research into the tools used by legal professionals.
The partnership between Silex and EXPERTsuisse concerns audit, tax and fiduciary professionals.
The bank Bordier & Cie also uses Silex for legal research.
The various plans are presented on the pricing page, and the solutions page sets out the uses according to the professions.
In short
A legal AI can be used safely if the firm keeps control of its data and of how it is used.
The essential points are simple:
- define why the data is used;
- limit the data sent to the tool;
- check where it is stored;
- prohibit its use to train the models;
- carry out an impact assessment when the risk is high;
- check the answers produced by the AI;
- keep the final validation in the hands of a professional.
To see how these principles are applied to legal files, you can book a demo.
