Guide · Lawyers & AI
Lawyers and AI: professional secrecy, confidentiality and good practice
Generative AI can serve as an assistant in a law firm, but it suspends no professional obligation. The lawyer must protect professional secrecy, control the data sent, choose the tool and plan with care, then check answers before using them. In 2026 the CNB (French National Bar Council) published an ethics guide dedicated to these issues.
AI can assist the lawyer, not replace them
Research, summaries, document analysis, drafting or rewording: there are many possible uses. The CNB explicitly supports bringing generative AI into the profession while recalling the protection of professional secrecy, the GDPR, competence, prudence and independence. The principle remains the same: the lawyer stays in control of the work and must check what they use in their professional practice.
Professional secrecy means thinking beyond the client’s name
Article 66-5 of the French law of 31 December 1971 covers in particular consultations, correspondence, meeting notes and, more generally, the documents in the file. In an AI tool, the risk is therefore not limited to the client’s name: facts, strategy, documents, financial information or elements allowing indirect identification may also be confidential.
Before sending anything, you must determine whether the AI provider really needs this information. When identity adds nothing to the task, minimisation or pseudonymisation can reduce exposure.
Five questions to ask before using AI on a case
A case-law summary and the analysis of a case document do not carry the same level of risk.
Do not confuse the visible interface with the technical flow: identify the provider, the account and the information sent.
Check the terms on content use, retention, access and data protection.
Remove unnecessary information and check indirect identifiers too.
The lawyer must check the facts, references, reasoning and scope of the answer before any use.
Pseudonymising does not guarantee professional secrecy
Pseudonymisation can limit the exposure of identifiers, but a case can remain recognisable from its context or contain confidential information regardless of any identity. It should be seen as one measure among others, not as a certification of ethical compliance.
The AI’s answer must remain a draft to check
AI can produce non-existent references, confuse versions of a text, overlook an exception or offer convincing but wrong reasoning. Checks must be proportionate to what is at stake: verifying sources, ensuring the applicable law is up to date, consistency with the documents and final approval by the lawyer.
How NYMETRA fits into this framework
NYMETRA can be a technical building block in this approach: review of information before sending, pseudonymisation in the firm’s environment and local restoration where the mapping allows. The version the request needs is sent directly to the AI provider chosen by the client.
This mechanism is neither a guarantee of professional secrecy, nor a GDPR certification, nor an endorsement by the CNB or a Bar. It must fit within the professional’s own rules, controls and obligations.
Good use of AI in a law firm rests on three complementary levels: choosing a suitable service, limiting the data actually sent and keeping human professional control over both inputs and outputs.