AI in a law firm – what works, what does not and how to protect professional secrecy

The tasks that work best are those where AI prepares the material and a lawyer makes the decision. What they have in common is that the output can be checked quickly against the source document.

Tasks that require up-to-date knowledge of case law and interpretations fare worse. Polish case law is published selectively and in anonymised form, and AI models are trained mainly on English-language texts. A model may also confidently cite the reference number of a judgment that does not exist.

The table below sorts typical uses by maturity and risk. The assessment applies to general-purpose tools such as Microsoft 365 Copilot and the business versions of ChatGPT and Claude.

Free and personal accounts in AI tools operate on consumer terms. The provider may store conversations and, depending on the settings, use them to improve its models. Pasting a client’s contract there may breach professional secrecy and the GDPR, because the firm loses control over who processes the data and how.

Business versions work differently. In Microsoft 365 Copilot, the provider acts as a data processor under a data processing agreement (DPA). Prompts, responses and documents are not used to train models, and Copilot respects user permissions.

There are also exceptions worth knowing about. According to Microsoft’s documentation, queries sent to the Bing search engine when Copilot searches the web are not covered by the DPA. A law firm should therefore consider switching off web search, or have a clear rule not to use client data when it is on.

The professional bodies have already taken a position. On 12 June 2026, the Polish Bar Council added a provision on technological tools, including AI, to the Code of Ethics for Advocates (Zbiór Zasad Etyki Adwokackiej i Godności Zawodu). An advocate may use them only in a supporting role and may not give up their own assessment of the output.

The new rules prohibit entering information covered by professional secrecy into tools that do not provide adequate protection. The advocate remains personally responsible for the content of a document. They are generally not required to tell the client about using AI, but must name the tools and the purpose of their use if the client asks.

In 2025, the National Chamber of Legal Advisers (KIRP) published recommendations for legal advisers. They cover, among other things, choosing a tool, protecting professional secrecy and data, overseeing the output and situations in which it is worth informing the client. When implementing AI in a firm that employs both advocates and legal advisers, it is worth basing the internal rules on both documents.

The AI Act does not require client consent for a law firm to use AI in its internal work. Contract review and draft documents are not high-risk systems. That category covers, among other things, systems used by courts to assess facts and law, not a law firm’s supporting tools.

However, two obligations apply to almost every law firm. Since 2 February 2025, firms have had to build their staff’s AI knowledge, most simply through training and written rules. From 2 August 2026, a chatbot on a law firm’s website must tell users that they are talking to AI.

Be careful with recruitment. If a firm uses AI to pre-screen candidates, e.g. for trainee positions, it enters high-risk territory. Obligations for such systems will apply from 2 December 2027. In Poland, the AI market is supervised by the Commission for the Development and Safety of Artificial Intelligence (KRiBSI), which gains its inspection powers on 28 October 2026.

For a law firm that works on Microsoft 365, Copilot is the natural starting point. It works in Word, Outlook, Teams and SharePoint on the documents a lawyer has access to. This is both its greatest strength and its greatest risk.

If a folder of case files is open to the whole firm, Copilot will find those files for anyone who asks the right question. So before go-live, permissions must be reviewed and access divided by matter and team. This matters especially where there is a conflict of interest and teams must not see each other’s files.

The licence cost is easy to work out. A firm that gives Copilot to 15 lawyers on the Business plan will pay 15 × USD 21 × 12 months = USD 3,780 a year at list price. Compare this with the cost of a lawyer’s hour and check in a pilot how many hours a month the tool actually saves. We have listed the next implementation steps below.

An AI agent is a program that carries out several steps of work on its own, e.g. it takes in a contract, compares it with the firm’s checklist and prepares a risk table. It makes sense when you carry out the same type of analysis dozens of times a month: lease agreements, non-disclosure agreements, legal due diligence on companies before a transaction.

Such an agent can be built, for example, in Copilot Studio, which is billed according to actual usage (in so-called credits) rather than per-person licences. The prerequisites are written analysis rules and a set of test contracts assessed by a lawyer. Without them, you cannot check whether the agent works well.

A typical mistake is building an agent before the templates are in order. If each team has a different version of the model contract, the agent will compare against the wrong one.

When the first review of a contract takes less time, hourly billing no longer reflects the value of the work. Some firms are moving to a fixed fee per task or a fixed monthly fee. This is a business decision, not a technical one, but it is worth making it deliberately before your clients make it for you.

Corporate clients increasingly ask in their requests for proposals whether and how the firm uses AI. Prepare a short, factual answer: which tools, in which version, on what data protection terms and who checks the output.

AI also helps with the firm’s administration: time entry narratives for billing, statements for clients and revenue reports by matter. This is work that does not require access to confidential client information, so it is an easier place to start.

The plan below assumes a law firm working on Microsoft 365. In a different environment the steps are the same; only the tools change.

The most important thing is that the rules for using AI are written before the pilot, not after it. Otherwise lawyers will develop their own habits, which will be hard to change later.