AI for legal and professional services
Privilege and client confidentiality.
Research
Context
Law firms, accountants and consultancies handle information under professional secrecy. AI can speed up document-heavy work, but only if privilege and client trust hold.
Law firms, accountants, consultancies and notaries work under professional secrecy, yet run AI on vendor systems they cannot inspect. Lindstead helps them decide which client work may touch which AI. Where secrecy demands it, Lindstead runs open-weight models on infrastructure the firm controls.
Case study (anonymised): Private AI for due diligence review at a law firm A European full-service law firm, around 250 lawyers.
Need a first decision? The AI Sovereignty Scan covers readiness, regulation and hosting in ten working days.
Professional firms use AI at nearly twice the EU rate
Professional services firms adopt AI faster than most of the European economy, and the gap widened in 2025.
In 2025, 37.9% of EU legal, accounting and consultancy firms used AI, against 20.0% of all enterprises.
Share of enterprises using at least one AI technology, %
¹ NACE M69-M71: legal and accounting activities, activities of head offices, management consultancy, architectural and engineering activities, technical testing and analysis. Eurostat does not publish legal services separately. ² All enterprises: all activities except agriculture, forestry, fishing, mining, quarrying and the financial sector. ³ NACE M73-M75: advertising and market research, other professional, scientific and technical activities, veterinary activities. Scope: EU27, enterprises with 10 or more persons employed. AI use covers text mining, speech recognition, language generation, image recognition, machine learning, process automation, autonomous robots and generation of pictures, video or audio.
Source: Eurostat, Artificial intelligence by NACE Rev. 2 activity (isoc_eb_ain2), EU survey on ICT usage in enterprises, updated 15 June 2026
View data table
| Category | Series 1 | Series 2 |
|---|---|---|
| All enterprises² | 13.5% | 20% |
| Manufacturing | 10.6% | 17.3% |
| Real estate | 15.5% | 24.8% |
| Legal and accounting¹ | 29.2% | 37.9% |
| Advertising and research³ | 33.7% | 48% |
| Information and comms | 48.7% | 62.5% |
Series 1: 2024. Series 2: 2025. Unit: %
Challenges
The sector gained almost nine percentage points in one year. It sits well above manufacturing and real estate, though behind media, research and ICT. The question is no longer whether peers use AI, but how far a non-user has fallen behind.
- Secrecy starts at the prompt Secrecy covers every system that touches a client file, including AI inside translation, PDF and word processing tools. The CCBE warns that a lawyer may breach professional and data protection duties the moment client data enters a prompt.
- Vendor terms beyond negotiation Most AI in the sector is bought off the shelf, so confidentiality rests on the vendor's contract. The CCBE's 2026 technical guide notes that large providers often treat control and audit rights as non-negotiable.
- Clients set the conditions The Dutch Bar recommends asking clients before AI is used on their file. The CCBE expects transparency wherever an informed client would object or set conditions. A firm must know which tools touched which matter.
- Unverified output, professional liability The CCBE warns that unverified AI output can bring sanctions for misconduct, contempt of court and malpractice claims. The NBA and NOREA guidance of June 2026 makes validation and human judgement the basis of public trust in accountants.
- Data held by others Client data at a provider can be demanded from the provider, not the firm. Since 18 August 2026 the EU e-Evidence Regulation lets authorities send production orders directly to providers in other member states. The CCBE advises firms to check which jurisdictions govern a provider's cooperation with law enforcement.
Data protection holds back more professional firms
Professional firms that considered AI and passed worry more than others about confidentiality and legal uncertainty, and less about cost and compatibility.
Of legal, accounting and consultancy firms that considered AI but did not use it, 59.8% cited data protection concerns, against 52.7% of all enterprises.
Reasons for not using AI, share of enterprises that considered AI but did not use it, 2025, %
¹ NACE M69-M71: legal and accounting activities, activities of head offices, management consultancy, architectural and engineering activities, technical testing and analysis. Eurostat does not publish legal services separately. ² All enterprises: all activities except agriculture, forestry, fishing, mining, quarrying and the financial sector. ³ Full wording: concerns regarding violation of data protection and privacy. ⁴ Full wording: lack of clarity about the legal consequences. Base: enterprises that ever considered using AI but did not use any AI technology in 2025 (25.7% of non-using legal and accounting firms). Multiple answers possible. Scope: EU27, enterprises with 10 or more persons employed.
Source: Eurostat, Artificial intelligence by NACE Rev. 2 activity (isoc_eb_ain2), EU survey on ICT usage in enterprises, updated 15 June 2026
View data table
| Category | Series 1 | Series 2 |
|---|---|---|
| Lack of expertise | 68.5% | 70.3% |
| Data protection³ | 59.8% | 52.7% |
| Legal uncertainty⁴ | 57.2% | 53.6% |
| Data quality or access | 43.6% | 43.5% |
| Incompatible systems | 32.3% | 41.6% |
| Costs too high | 31.1% | 38.4% |
| Ethical concerns | 20.3% | 24.6% |
Series 1: Legal and accounting¹. Series 2: All enterprises². Unit: %
Key regulation
In this sector the share citing data protection rose from 49.3% in 2023 to 55.3% in 2024 and 59.8% in 2025. The barrier is control, not budget. A firm that can show where client data goes removes the objection that stops most hesitant peers.
| Framework | Relevance |
|---|---|
| Professional secrecy | Privilege and confidentiality duties cover every system that processes client files. |
| GDPR | Applies in full to client and counterparty personal data. |
| EU AI Act | Transparency obligations under Article 50 apply from 2 August 2026. |
How Lindstead helps
- Regulation and risk AI register and professional secrecy data map Lindstead lists every AI system in use, including hidden features, and traces which client data reaches which provider on which terms. The firm receives a register, a review against professional secrecy, GDPR and the AI Act, and a plain statement for clients.
- AI strategy Confidentiality tiers for every type of work Lindstead ranks the firm's work, from public research to sensitive litigation and transactions, by confidentiality and client conditions. A board paper sets where each tier may run: external service, European cloud or own servers.
- Model selection Open-weight models tested on the firm's documents Lindstead tests candidate models on the firm's own contracts, memos and working papers, in its languages. The firm receives a shortlist with results per task and a licence check for a firm of its size.
- Infrastructure and cost Sizing a private AI service Lindstead sizes hardware for the firm's users and document volumes. A three-year cost model compares own servers, a European cloud and current vendor licences, with every assumption shown.
- Deployment Private document assistant behind the firm's walls Lindstead builds a first use case, such as due diligence review or precedent search, on infrastructure the firm controls. Access follows matter permissions and ethical walls, every query is logged, and the documentation answers auditors and clients.
- Model stewardship Quarterly watch on models and professional guidance Bar associations and regulators keep revising AI guidance, and models change monthly. Lindstead checks each change against the firm's baseline and sends the board a quarterly note with recommended decisions.
Case study (anonymised)
Private AI for due diligence review at a law firm
A European full-service law firm, around 250 lawyers
Lawyers used consumer and vendor AI tools with no record of what data went where. Corporate clients had started asking about AI in panel reviews.
The transactions practice wanted AI on data rooms that partners would not upload to an external service.
What Lindstead did
- Map current AI use Lindstead interviewed practice groups, IT and risk, and listed every AI tool in use. It checked each vendor contract against the CCBE's questions on training, retention, staff access and jurisdiction.
- Tier work, test models Lindstead sorted the work into confidentiality tiers, and the partners approved tools per tier. Lindstead tested three open-weight models on the firm's own precedents, in its working languages, each with a licence review.
- Size and cost Lindstead sized hardware for data room review and knowledge search. The partnership board received a three-year cost comparison of own servers, a European cloud and the current vendor route.
- Pilot due diligence review One transactions team piloted a private review assistant on the firm's own infrastructure, with matter-level access, logging and mandatory verification. Runbooks and training prepared the firm to run it alone.
What the client received
- AI register with data flows per tool
- Confidentiality tiers with approved tools
- Model shortlist with the firm's working languages test results
- Three-year cost comparison of hosting options
- Pilot runbook, access controls and verification protocol
The decision
The partnership board decided which tiers of work may use external AI, whether to extend the assistant to other practice groups, and what the firm tells clients about its AI use.
Two in three AI-using firms buy it off the shelf
Most professional firms buy their AI rather than build it. The vendor's handling of client data becomes the firm's risk.
In 2024, 63.9% of legal, accounting and consultancy firms using AI relied on ready-to-use commercial software, while 20.8% had built AI in-house.
How AI was sourced, share of legal and accounting enterprises using AI, 2024, %
¹ Base: EU legal and accounting enterprises (NACE M69-M71, including head offices, management consultancy, architectural and engineering activities, technical testing) using at least one AI technology, 10 or more persons employed. Multiple answers possible. ² Full wording: developed or modified by external providers. Sourcing was last surveyed in 2024 and is not part of the 2025 release. The all-enterprise figure for ready-to-use commercial software was 57.9%.
Source: Eurostat, Artificial intelligence by NACE Rev. 2 activity (isoc_eb_ain2), EU survey on ICT usage in enterprises, updated 15 June 2026
View data table
| Category | Value | Group |
|---|---|---|
| Commercial, ready to use¹ | 63.9% | 1 |
| Built or adapted externally² | 30.8% | 1 |
| Open source, adapted in-house | 26.7% | 2 |
| Commercial, adapted in-house | 25.8% | 2 |
| Developed in-house | 20.8% | 2 |
Group 1: Sourced from vendors. Group 2: Built or adapted by own staff. Unit: %.
Opportunities
Only about one in five builds its own. Professional secrecy then rests on vendor contracts, processing terms and where the provider runs its models. Control of those terms, or models on the firm's own infrastructure, reduces the risk holding the sector back.
- Due diligence review A first pass over the data room flags change of control, liability and termination clauses for a lawyer to confirm. Counterparty data held under confidentiality agreements is best kept on the firm's own infrastructure.
- Precedent and knowledge search Search the firm's opinions, templates and past advice, with every result sourced. This work is confidential and the firm's core asset, so the index stays on its own systems.
- Audit and advisory files The NBA and NOREA guidance of June 2026 cites journal entries, contract review and fraud detection. Client ledgers and contracts fall under the accountant's duty of confidentiality, which favours in-house or European deployment.
- Drafting and translation First drafts of memos, letters and translations across European languages, each reviewed by a professional. In-house, client letters stay out of cloud tools with AI features the firm may not know about.
Frequently asked questions
-
The main frameworks are:
- Professional secrecy: Privilege and confidentiality duties cover every system that processes client files.
- GDPR: Applies in full to client and counterparty personal data.
- EU AI Act: Transparency obligations under Article 50 apply from 2 August 2026.
-
Organisations in this sector most often face three issues:
- Secrecy starts at the prompt: Secrecy covers every system that touches a client file, including AI inside translation, PDF and word processing tools. The CCBE warns that a lawyer may breach professional and data protection duties the moment client data enters a prompt.
- Vendor terms beyond negotiation: Most AI in the sector is bought off the shelf, so confidentiality rests on the vendor's contract. The CCBE's 2026 technical guide notes that large providers often treat control and audit rights as non-negotiable.
- Clients set the conditions: The Dutch Bar recommends asking clients before AI is used on their file. The CCBE expects transparency wherever an informed client would object or set conditions. A firm must know which tools touched which matter.
- Unverified output, professional liability: The CCBE warns that unverified AI output can bring sanctions for misconduct, contempt of court and malpractice claims. The NBA and NOREA guidance of June 2026 makes validation and human judgement the basis of public trust in accountants.
- Data held by others: Client data at a provider can be demanded from the provider, not the firm. Since 18 August 2026 the EU e-Evidence Regulation lets authorities send production orders directly to providers in other member states. The CCBE advises firms to check which jurisdictions govern a provider's cooperation with law enforcement.
-
The use cases with the clearest value are:
- Due diligence review: A first pass over the data room flags change of control, liability and termination clauses for a lawyer to confirm. Counterparty data held under confidentiality agreements is best kept on the firm's own infrastructure.
- Precedent and knowledge search: Search the firm's opinions, templates and past advice, with every result sourced. This work is confidential and the firm's core asset, so the index stays on its own systems.
- Audit and advisory files: The NBA and NOREA guidance of June 2026 cites journal entries, contract review and fraud detection. Client ledgers and contracts fall under the accountant's duty of confidentiality, which favours in-house or European deployment.
- Drafting and translation: First drafts of memos, letters and translations across European languages, each reviewed by a professional. In-house, client letters stay out of cloud tools with AI features the firm may not know about.
-
Yes. Open-weight models can run on-premise or in a European private cloud, which keeps data and model access under the organisation's control. Whether that is cheaper than an external API depends on sustained volume, and whether it is required depends on data sensitivity and regulation. Lindstead's break-even analysis shows the volume at which own infrastructure pays off.
-
The CCBE guide of October 2025 advises lawyers not to enter personal, confidential or client data into generative AI tools without appropriate safeguards. The Dutch Bar advises against public AI models for client data. In United States v. Heppner (February 2026), a New York federal court ruled that documents made with a consumer AI tool were not privileged, partly because the provider's terms allowed disclosure to third parties. It left open whether enterprise products with stronger terms would fare differently.
-
Research, drafting and document review are not listed as high-risk in Annex III of the AI Act. Annex III does cover AI that assists a judicial authority or alternative dispute resolution, and AI used in recruitment or staff evaluation. Under the Digital Omnibus, Regulation (EU) 2026/1744, those obligations apply from 2 December 2027.
-
The CCBE's technical guide of March 2026 calls on-premises deployment the most secure option for confidentiality, at a cost in hardware, energy and expertise. By its estimate, around €20,000 runs some of the most capable open-weight models slowly, or a strong mid-sized model for several users. The largest open-weight models need 1 to 2 TB of memory, beyond a GPU-only budget below €150,000.
Related research
- Where Should Your AI Run? The 2026 European Briefing
- Open-weight models and their licences
- Self-hosting or API: where is the break-even point?
Sources
- CCBE, Guide on the use of generative AI by lawyers, 2 October 2025
- CCBE, Technical guide on the use of AI tools and models by lawyers, 27 March 2026
- Nederlandse orde van advocaten, Aanbevelingen AI in de advocatuur, November 2025
- Mr. Online, NOvA publiceert langverwachte AI-aanbevelingen met opvallend advies, 9 December 2025
- Accountant.nl (NBA), NBA en NOREA publiceren nieuwe leidraad voor AI-toepassing, 4 June 2026
- BfDI (German Federal Data Protection Commissioner), E-Evidence Regulation, binding from 18 August 2026
- Proskauer, SDNY addresses privilege and work product implications of using unsecured public AI tools (United States v. Heppner, 10 February 2026)
- AI Act Explorer, Digital Omnibus on AI, Regulation (EU) 2026/1744 of 8 July 2026
- AI Act Explorer, EU AI Act Annex III: high-risk AI systems
Discuss the priorities in legal and professional services.
A 30-minute meeting covers the use case, sector requirements and next step.