Client confidentiality and AI: where a draft can live, and where it cannot

A lawyer pastes the draft of a claim into a chat window and asks it to “polish the tone”. It takes ten seconds and the result is good. The question almost nobody asks at that moment is where the draft went: which server received it, how long it keeps it, and whether anyone can ever read it.

That is not a technical question. It is a professional-secrecy question, and its legal answer is clear even though the technology changes every quarter: there is no technology exception. What a lawyer must keep confidential is equally confidential whether it is written in a notebook or typed into a text box.

This article is the practical companion to our guide to AI in law firms. That one covers what works and what is smoke. This one covers a single thing: where a draft can live, and where it cannot.

What the rules say

The duty comes from several places at once. Article 542.3 of the Organic Law on the Judiciary (LOPJ) obliges lawyers to keep secret the facts and information they learn through any form of professional activity. The General Statute of the Spanish Bar (Estatuto General de la Abogacía Española) frames it as both a duty and a right of the professional, covering facts, communications, data, documents and proposals. Organic Law 5/2024 on the Right of Defence reinforces the confidentiality of lawyer-client communications.

None of these distinguishes between media. Nor does the EU AI Act (Regulation (EU) 2024/1689) create a special permission: it does not ban AI in legal work across the board, but it does not make lawful everything it fails to prohibit. And when a tool processes personal data — a draft claim always contains some — the GDPR and Spain’s LOPDGDD apply: legal basis, purpose, minimisation, security, international transfers and, above all, the relationship with the vendor.

Responsibility cannot be delegated. If the draft leaks, the firm answers to its client, not the chat provider.

Four places a draft can end up

The useful distinction is not “AI yes / AI no”. It is where the text sits after you press send. In practice there are four situations, from worst to best.

1. A consumer tool on a personal account. The most common and the worst. The terms are those of an individual user: the provider may keep conversations, review them to improve the service and, depending on product and settings, use them to train models. The firm has signed nothing and can prove nothing. No client data belongs here — not even “anonymised by hand”, which almost always leaves a trace.

2. A paid professional tool nobody has reviewed. A better starting point, since business plans usually exclude training on your data. But “usually” is not a contract. If nobody has read the terms, you do not know how long it retains data, who has internal access, or where it is processed.

3. A vendor with a signed data processing agreement. There is an Article 28 GDPR processor contract, a known data location, defined retention periods and an express commitment not to train on your content. This is the reasonable minimum for real matters.

4. An isolated environment per firm. Each firm’s data is held separately from every other customer’s, with traceable access and configurable retention. This is what material of particular sensitivity calls for: criminal files, family litigation, transactions carrying anti-money-laundering reporting duties.

The practical line runs between 2 and 3. Below it, the draft has no home of its own; above it, it does.

Five questions your vendor must answer

You do not need to be technical. You need the answers in writing.

1. Is my content used to train models? The acceptable answer is no, and it belongs in the contract, not in a FAQ page that can change.
2. Where is it processed and stored? Inside the European Economic Area or, if not, under what international-transfer safeguard.
3. How long is it kept, and can I delete it? Indefinite retention is a risk. Deletion should be real, including backups within a reasonable window.
4. Who inside the vendor can see my conversations? “Nobody, except support with my authorisation” is an answer; “to improve the service” is not.
5. Is there a signed processing agreement and a list of sub-processors? Without them the firm is not compliant with Article 28 GDPR, however good the vendor is.

If any answer is “we don’t know” or “it depends”, you have found level 1 or 2 with better marketing.

The collision with record-keeping

One nuance gets forgotten. Spain’s Ley 10/2010 on anti-money-laundering requires ten-year retention of due-diligence records, as we explain in our article on KYC for law firms. That means some client data cannot simply be erased on request, and the firm must know what lives where. An AI tool that absorbs those documents with no retention policy creates one more copy to protect, for ten years, outside your control. The firm’s GDPR obligations apply to that copy too.

A rule that fits on a card

Before pasting anything into an AI tool, the lawyer should be able to answer three things in five seconds: under what contract does this tool operate, how long does it keep the text, and could I show that to my client? If the answer to any is “I don’t know”, the draft does not go in.

And the firm should write it down. A one-page policy — which tools are authorised, for what kind of material, with what review — prevents more trouble than any sanction later. The AI Act also expects sufficient AI literacy among staff who use these systems; a written policy is the cheapest way to start evidencing it.

How we approach it at Mandato

We start from the same question. In Mandato the AI works inside the case file, on that matter’s own documents, and what it produces is presented as a proposal for the lawyer to review. Where the data lives and under what safeguards is published on our security page, which is exactly where it should be. We are not asking you to take our word: apply the five questions above to any vendor, ourselves included.