AI that does real work for a small firm

A law office with two lawyers and a software company of a hundred people that sells to banks share a problem. Staff already use artificial intelligence and nothing about that use is on paper. The fix is smaller than the rulebooks suggest, because a small firm has an advantage that a large one lacks: one person can list every tool the staff use and every call the product makes to a model in a single afternoon.

Start with that list. For each entry write down the supplier, the kind of data that goes in and where that data is processed. Then read the terms you already accepted. The Nederlandse Orde van Advocaten, the Dutch bar, has asked every law firm since the end of 2025 to know where data is stored and processed, to keep client data out of public models and to check citations by hand. A financial firm has had the same duty in harder words since 17 January 2025, when the Digital Operational Resilience Act began to apply: under Article 28 it remains fully responsible at all times for what an outside technology supplier does on its behalf. Add one rule that says which kind of work may go into which tool, and one note on how staff learn to use them. The Artificial Intelligence Act of the European Union has required measures to support the literacy of staff since 2 February 2025.

Much can wait. The obligations for high risk systems under the Act apply from 2 December 2027 for the uses listed in its Annex III and from 2 August 2028 for artificial intelligence inside regulated products. The entry on justice in that list covers use by or for a judicial authority and similar use in alternative dispute resolution, which leaves a research or drafting tool in a law office outside it. A small lender is in a different position: Annex III names credit scoring of natural persons without any size threshold, so the lender has a high risk system from 2 December 2027. A model on the firm's own premises can also wait. The Council of Bars and Law Societies of Europe listed high cost and maintenance as the drawbacks of that route in its technical guide of 27 March 2026, and running a model there does not make a firm compliant. Most small firms begin with an online interface under contract or a private deployment, and the governance is the same on all three routes.

The amounts in the headlines are the wrong ones to be afraid of. Article 99 of the Act sets a ceiling of 35,000,000 euros or 7 percent of total worldwide annual turnover for a prohibited practice, and of 15,000,000 euros or 3 percent for a list of other duties, among them the transparency duties that have applied since 2 August 2026. For most undertakings the higher of the two counts. For small and medium sized enterprises, paragraph 6 of the same article has said since 2 August 2025 that the lower of the two counts, which for a small firm is in practice the percentage of its own turnover. The ceiling is lower and the fines still apply. The General Data Protection Regulation has no such rule: its ceilings of 10,000,000 euros or 2 percent and 20,000,000 euros or 4 percent, in force since 25 May 2018, take the higher of the two at any size. Every one of these amounts follows the words up to in the text of the law. They are maximums.

What reaches a small firm is closer to home. On 27 July 2026 a Dutch disciplinary board for lawyers, the Raad van Discipline, reprimanded a lawyer who practised alone. Her statements of defence in two tenancy cases cited case references that did not exist or belonged to other cases. The board found a breach of the core values of expertise and integrity and ordered her to pay the costs of the proceedings. It stopped at a reprimand partly because the bar's recommendations did not yet exist when she wrote those documents in 2025. They exist now, and the Advocatenwet, the Dutch act on the legal profession, allows heavier measures up to removal from the roll. Such a measure lands on the professional personally. The second thing that arrives is a request for evidence. De Nederlandsche Bank, the Dutch central bank, is asking small and medium sized banks in 2026 about their use of artificial intelligence, and a bank that remains fully responsible for its suppliers sends its questionnaire on to the software company that serves it. Some company legal departments now write into the guidelines for their outside lawyers whether artificial intelligence may be used on their files.

By next month a small firm should hold four dated pages: the list of tools and model calls with the supplier and the processing location of each, the rule on which work may go where, a note of what the supplier terms give on retention and audit, and the name of the one person who keeps all of it current. The AI Guys offers a free briefing as a first step: you answer five questions and receive one signed page on how your solution can be built and which rules apply within two working days, with a conversation of thirty minutes with a partner offered beside it.