Welcome back to Legal Prompting, this is Nicola Fabiano.
Download transcript (.vtt)
0:09
0:14
0:21
0:26
0:33
0:40
0:45
0:53
0:59
1:06
1:10
1:15
1:21
1:30
1:36
1:42
1:45
1:50
1:58
2:01
2:08
2:16
2:23
2:29
2:36
2:39
2:43
2:51
2:54
3:00
3:07
3:12
3:19
3:20
3:24
3:31
3:33
3:39
3:47
3:54
4:00
4:05
4:09
4:15
4:22
4:24
4:29
4:34
4:39
4:47
4:50
4:55
4:58
5:05
5:08
5:16
5:23
5:25
5:33
5:35
5:41
5:47
5:54
6:02
6:03
In the previous episode, we discussed professional secrecy and how choosing an AI infrastructure
is, first and foremost, a deontological decision.
Today, we shift our gaze from the single tool to the regulatory framework that governs
its use, the European AI Act and the obligations it places on legal professionals.
The central principle is easy to state and hard to practice.
The AI Act does not only regulate those who develop or place AI systems on the market,
it also regulates those who use them, that is, the deployer, and the legal professional
who integrates AI into their practice is, in every respect, a deployer.
This means that choosing a good tool is not enough.
You must use it within a precise perimeter of obligations.
To this perimeter, we must add a cross-cutting one already fully applicable since February
of 2025, the duty of AI literacy for staff set out in Article 4 of the regulation.
Anyone using AI in a law firm must have acquired adequate competence.
Anyone who entrusts those tools to collaborators must ensure they have it too.
Three concrete applications.
First, classify the risk of the system you use.
The AI Act distinguishes between prohibited systems, high-risk systems, limited-risk systems,
and minimal-risk systems.
Many general-purpose tools used in a law firm fall within the limited-risk category with
obligations that are mainly about transparency, but when a system is used to assess individual
profiles, to support decisions that affect fundamental rights, or for activities covered
by Annex 3 of the regulation, the classification changes.
The first question is not whether the tool works well, but which risk category your concrete
use of it falls into.
Second, notice to the client and to the recipients.
Article 50 of the AI Act imposes transparency obligations toward those who interact with
AI systems or receive their output.
For the legal professional, this translates into clear clauses in the engagement letter,
in opinions that flag where AI has contributed, and in communications that do not pass off
as purely human and content generated or reworked with AI.
It is not a bureaucratic formality, it is how you preserve the trust that grounds the
professional relationship.
Third, documenting your use.
The AI Act requires the deployer to keep the logs of high-risk systems and to monitor how
they operate.
Even outside the high-risk category, professional prudence requires you to document which tools
are used, for which tasks, with which standard prompts, and with which human controls.
An internal register, even a simple one, is the trail that allows you to answer tomorrow,
before a client, an authority or a judge, on how a given content was produced.
Three cross-cutting operational rules.
First, effective human oversight, not symbolic.
The AI Act speaks of human oversight, and the phrase is not a slogan.
It means that the professional must be in a position to understand, verify and, if necessary,
contradict the output of the system.
If the output is not verifiable, oversight is only apparent.
Second, preliminary assessment of tools.
Before integrating a system into your workflow, you must check the technical documentation
provided by the supplier, the data processing terms, the conformity guarantees and the consistency
with your duty of confidentiality.
A technological choice made in haste becomes a regulatory problem tomorrow.
Third, continuous updating.
The AI Act is a regulation that enters into application gradually, with different dates
for different categories of systems.
Some prohibitions apply from February of 2025, the obligations on general-purpose AI models
from the following August, and the rules on high-risk systems come fully into force from
August of 2026.
The legal professional must follow its implementation, because their responsibility grows as the
obligations become binding.
In the next episode, we will close the journey, a synthesis of the legal prompting method,
and a look at the perspectives of evolution, both regulatory and technological.
To explore these themes further, I invite you to subscribe to the newsletter at nickfab.eu,
where each episode is accompanied by a dedicated issue with references, notes, and additional
materials.
See you soon!