A legal AI workflow needs both useful records and careful control of confidential material. Define what the tool may do, what counsel reviews and where its inputs and outputs are stored before choosing a logging design.
The Unique Compliance Landscape for Legaltech
Separate professional confidentiality, privilege or work-product protection, disclosure duties and AI classification. Ask responsible counsel to determine which rules apply to the actual jurisdiction, client matter and tool use.
Privilege Architecture for Legaltech AI
Design the workflow around counsel's decisions about confidential material. Restrict who may submit, inspect or export it, and review the vendor's handling terms before sending client documents.
The supervision requirement
Assign a qualified reviewer for the task and make their authority to correct or reject output clear. Preserve what they actually reviewed; a nominal sign-off or 'privileged' label does not guarantee legal protection.
What to document to support privilege claims
Record the purpose of the work, the responsible counsel, access decisions and the review that took place, as appropriate to the matter. Counsel should decide what supports a protection claim without needlessly duplicating confidential advice in general logs.
Discovery Obligations and AI System Records
Agree a records-management plan with responsible counsel. Separate normal retention, legal preservation and disclosure review; these are different decisions, and GDPR access requests are not the same process as litigation discovery.
What records may be discoverable
Inventory prompts, outputs, source documents, model versions and review records that the workflow creates. Counsel should assess which records may need preservation or disclosure and which may be protected; do not assume all AI records share one status.
Litigation hold for AI system records
Define how an authorised preservation instruction suspends relevant deletion schedules, including vendor-held records where applicable. Record the instruction's scope, owner and release process so normal cleanup cannot silently remove material that must be kept.
Designing records that survive discovery
Test whether authorised staff can retrieve records with provenance, timestamps and version references intact. Keep an export manifest and separate disclosure review from retrieval; successfully exporting a file does not determine whether it should be disclosed.
EU AI Act Compliance for Legaltech
Annex III point 8(a) concerns AI intended to assist judicial authorities, or used on their behalf, in researching and interpreting facts and law and applying law to specific facts, as well as similar use in alternative dispute resolution. It does not automatically cover every law firm's contract review, filing preparation or legal research. Assess intended purpose, Article 6 conditions and the ancillary-task exceptions.
The privilege vs. logging tension
Use protected references where a general log does not need the full document or legal advice. Define which reviewers may resolve those references and test that incident investigation does not bypass confidentiality controls.
FAQ
Does attorney review make every model interaction privileged? No. Protection depends on the applicable law, purpose and facts. Have counsel assess the workflow and the records rather than promising protection from a review gate alone.
Review updated 1 October 2026: the AI Omnibus entered into force on 27 July 2026. The high-risk requirements in Chapter III Sections 1-3 apply from 2 December 2027 for Article 6(2)/Annex III systems and 2 August 2028 for Article 6(1)/Annex I systems, subject to the Act's transitional provisions. Other obligations have separate application dates.
EU AI Act: consolidated text, 27 July 2026 | European Commission: AI Omnibus entry into force | GDPR: Regulation (EU) 2016/679 | European Commission AI Act Service Desk: administration of justice