Picture an international firm of some six hundred lawyers with offices in Amsterdam, Brussels, London and New York. It bought a legal platform that runs on a model provider's technology in the cloud of a large American company. Then the questionnaires start to arrive. A bank asks the firm to confirm that no data from its matters is sent to any provider of language models. A private equity house asks the opposite: it expects the firm to use artificial intelligence and wants to see the saving on the invoice. Both point to their outside counsel guidelines, and each partner answers for his own client.
In a survey by the Thomson Reuters Institute among 1,702 professionals in early 2025, 8 percent of the respondents from company legal departments said they had instructed their law firms to use generative artificial intelligence or had written it into their outside counsel guidelines or requests for proposals. Another 10 percent had instructed their firms to stay away from it. And 71 percent of law firm clients did not know whether their outside firm used it at all.
The professional rules differ between the firm's offices as well. The Nederlandse Orde van Advocaten, in its recommendations of the end of 2025, places the task at the level of the firm: a policy for the whole firm, supervision of staff and suppliers, and knowledge of where data is stored and processed. The Belgian bar organisations, in their guidelines of January 2025, address the individual lawyer and set a stricter test for privileged documents, which may be entered only when there is absolute certainty that the environment is closed and adequately secured. A Brussels partner and an Amsterdam partner on the same matter work under two tests.
The usual response is a memorandum from the risk committee which says that the platform is approved because the supplier holds the right certificates and processes in a European region. The bank's question was whether its data reaches a model provider, and on the firm's current setup the honest answer is yes. A certificate about the supplier's security leaves that answer as it is.
Microsoft's documentation for its Azure service, dated 18 May 2026, states that prompts are unavailable to other customers and to the maker of the model and are used for training only with permission. The same pages say that a sample of prompts may be stored for abuse monitoring and reviewed by Microsoft staff unless the customer has applied for and received an exemption, and that a deployment of the type called Global may process in any geography. The provider also remains a company under the law of the United States. The firm's answer to a client therefore depends on settings that somebody in the information technology department chose, perhaps without knowing that a client guideline turned on them.
The way out is to stop treating the firm as having one route. For each client and matter the firm decides which of three routes the data may take: the online service of a model provider under contract, a private deployment that the firm controls, or hardware on the firm's own premises. The technical guide that the Council of Bars and Law Societies of Europe published on 27 March 2026 calls the last of these the most secure option for confidentiality and says with equal candour that a service hosted by the vendor is sometimes the only way to reach the most capable models. Matters of the bank run on the firm's own hardware or without any model, the private equity house gets the platform, and the middle group goes to the private deployment with the region fixed and the storage for monitoring switched off.
For the head of information technology this turns a policy into something that has to pass a test. The restriction must live where the matter lives: a field at matter intake that records the client's instruction, and a rule in the document system that stops a tool on the wrong route from opening a restricted file. Every call is logged with user, matter and route. Once a quarter someone tries to send a restricted document the wrong way and records that it was refused.
Moving a route on premises shortens none of the governance. The inventory of tools, the checks on supplier contracts, the evaluation on the firm's own work, human review of output, training and an incident route are the same on all three. Under the European Union Artificial Intelligence Act the duty to support staff literacy has applied since 2 February 2025. The rules for high risk systems apply from 2 December 2027. They cover systems meant to be used in alternative dispute resolution in a way similar to a court, which a firm whose partners sit as arbitrators should check against its own tools.
By next month the managing partner should be able to put four documents before the risk committee: a register of client instructions per matter, a route table that says which kind of matter runs where, the supplier file for each route with the settings that were actually chosen, and the log of the first test in which a restricted document was refused. The AI Guys can set up such a register and run the test as an outside party.