AI policy for a law firm: a template to copy, annotated article by article

Is an AI policy mandatory for a law firm?

No text requires a French law firm to adopt an AI policy, but the CNB guide recommends one, and the EU AI Act requires staff training: a written policy is the simplest way to show it has been done.

In a firm, AI rarely arrives through a decision: an associate tries ChatGPT on a letter, an assistant summarizes a file with Copilot, an intern pastes pleadings into a free tool. A policy restores order: it sets what is allowed, what is prohibited, and who is accountable.

The common ground is the same: professional secrecy forbids entrusting client data to a tool that doesn't offer sufficient guarantees, and the professional remains responsible for everything they sign. The details for lawyers are in our summary of the CNB's AI guide; for notaries, in AI and notaries.

Before drafting: three questions

• Which tools are already in use? Ask the team, without blame: personal accounts, browser extensions, AI built into the word processor or the email client. The policy starts from reality, not from a theoretical inventory.
• For which tasks? Drafting letters, summarizing documents, proofreading, research, translation. Each use doesn't expose the same data.
• Who decides? A partner or a point of contact must be able to say yes or no to a new tool, and keep the list up to date.

A 5-article AI policy template to copy

For a small firm that wants a clear rule this week, five articles are enough. Copy the block below, fill in the brackets, and move to the full version as the firm grows.

The full 12-article template, annotated

The bracketed passages are to be completed. The text of each article is indented; the comment that follows explains the choice.

Article 1. Purpose and scope

This policy governs the use of artificial intelligence tools, in particular generative AI, by anyone working for [firm name]: partners, associates, employees, interns and service providers. It applies whatever the device used, professional or personal, as long as the use concerns the firm's business.

Comment: include interns and service providers, and use from a personal phone. The professional rules of the French notariat (article 8.1), for example, recall that the notary ensures that staff and service providers respect secrecy: the policy is a way to do so.

Article 2. Approved tools

Only the tools on the attached list, kept up to date by the AI point of contact (article 10), may be used for the firm's business, with the accounts provided by the firm. Using a personal account or a tool not on the list is prohibited. Any request to add a tool is sent to the point of contact.

Comment: having the list in an appendix lets you change it without rewriting the policy. For each tool, note where the data goes, how long it is kept, whether it is used for training and whether there is a data processing agreement (article 28 of the GDPR). The CNB's guide details these criteria (pp. 26-27).

Article 3. Data that must never be sent in clear

It is prohibited to send to an AI tool, in a form that makes it possible to identify a person or a matter: the names, addresses and contact details of clients and third parties, case documents, deeds and draft deeds, nominative accounting, tax and payroll data, health data, identification numbers and bank details, and any information covered by professional secrecy.

Comment: adapt the list to the profession. A notary's office will add land registry references and matrimonial regimes; an accounting firm, FECs, DSNs and payslips; a patent attorney firm, any description of an unfiled invention.

Article 4. Prior anonymization or pseudonymization

Any document or extract from a file given to an AI tool is first anonymized or pseudonymized on one of the firm's computers, according to the attached procedure. The copy is reviewed before it is sent. Any mapping table stays on the firm's systems and is never sent. It is prohibited to ask an online AI tool to anonymize a document itself.

Comment: this is the central article. The CNB's guide cites “prior anonymization or pseudonymization of data” as one of the two ways to eliminate sovereignty risks (p. 26, our translation). Specify “on one of the firm's computers”: an online anonymization service receives the document in clear, which amounts to the same problem. The difference between the two notions is explained in anonymization vs. pseudonymization.

Article 5. Permitted and excluded uses

The following are permitted, on data prepared in accordance with article 4: drafting and rephrasing, summarizing documents, proofreading, translation and documentary research. The following are excluded: decision-making in place of the professional, advice passed on to the client without approval, and [other exclusions specific to the firm].

Comment: a positive list reassures the team, which knows what it can do. The CNB's guide recalls that generative AI “must never replace the lawyer” (p. 30, our translation).

Article 6. Human review and approval

Any content produced with the help of an AI tool is reviewed, checked and approved by a professional of the firm before being used or sent to a client, a colleague or a court. References (statutes, case law, figures) are checked against an official source.

Comment: according to the CNB's guide, the lawyer “must reread, check and approve each generated piece of content before using it or sending it to a client or a court” (p. 28, our translation). The guide cites decisions from 2025 and 2026 that found non-existent case law: this is the most visible risk.

Article 7. Traceability

Each use of an AI tool on a file is recorded in [the file / the firm's register]: date, tool, task, internal file reference and name of the person who reviewed the result.

Comment: a short record is enough. It lets you answer a client who asks the firm about its practices, and know what to check in case of an incident. Use an internal reference, never the client's name, in a shared register.

Article 8. Client information

The client is informed of the use of AI tools in [the fee agreement / the engagement letter], according to the attached clause. A client who asks the firm about its practices receives a clear answer. No client data is used to train a tool without the client's consent.

Comment: for lawyers, the CNB's guide leaves the choice of informing the client open, unless the client asks, and requires consent if an in-house AI is trained (pp. 34, 36). It offers a model clause for the fee agreement (p. 35). Other professions will adapt it to their engagement letter.

Article 9. Training

Anyone authorized to use an AI tool follows initial training covering this policy, the tools' limits and the anonymization procedure, then a [yearly] update.

Comment: article 4 of the European AI Act requires deployers to ensure a sufficient level of AI literacy among their staff. The CNB offers a free online training course, SKILIA (guide, p. 25).

Article 10. AI point of contact

[Name or role] is appointed AI point of contact. They keep the list of approved tools, answer questions, receive incident reports and prepare the annual review of the policy.

Comment: in a small firm, this is often a partner. What matters is that an identified person answers, quickly, the question “can I use this tool?”.

Article 11. Incidents

Any transmission of data in clear to an AI tool, even involuntary, is reported without delay to the AI point of contact, who assesses the measures to take with [the partner in charge / the DPO].

Comment: an error reported early can be managed; a hidden error can't. If the incident constitutes a personal data breach, article 33 of the GDPR requires notifying the CNIL (the French data protection authority) within 72 hours, unless it is unlikely to result in a risk to the persons concerned.

Article 12. Entry into force and review

This policy enters into force on [date]. It is communicated to each person concerned, who acknowledges receipt, and reviewed at least once a year, or as soon as a new tool or a new professional recommendation warrants it.

Comment: tools change fast, and so do their terms. An annual review, and a review as soon as a provider changes its terms of use, prevent a 2026 policy from authorizing in 2027 a tool that has become unsuitable.

The full template in one block, to copy

The twelve articles above, without the commentary, ready to paste into a firm document.

AI use policy in a company: what changes

The template also suits an in-house legal team or a company, with three adjustments. First, the list of prohibited data extends to employee data, trade secrets and counterparties' information. Second, the point of contact is often the data protection officer (DPO) or the general counsel. Third, in a French company with internal rules (règlement intérieur), a document that sets general and permanent obligations on discipline is treated as an addition to those rules (Article L1321-5 of the French Labor Code): it then follows the same procedure, including the opinion of the works council (comité social et économique). Have this point checked by your employment lawyer.

For in-house teams: document anonymization software for in-house counsel and DPOs, and the checklist to anonymize a contract before ChatGPT.

Keeping the policy alive

A policy nobody applies doesn't protect anyone. Three conditions make it real:

• A short anonymization procedure. If preparing a copy takes an hour, the team will work around the rule. The attached procedure should fit on one page and rely on a tool that works on the computer. For a single document, the manual method is in anonymize a document before ChatGPT; for a whole file, AnonymFiles, French document anonymization software, detects names, organizations, addresses, emails, phone numbers, IBANs, private dates and ID numbers in PDFs, scans, Word files, emails and spreadsheets, with stable labels from one document to the next. Each copy is reviewed next to the original, nothing is exported without approval, and the mapping table never leaves the computer.
• A concrete example during training. Show a real (fictitious) document, its pseudonymized copy, the AI's answer and the review. An example is worth more than a policy article.
• A review that actually happens. Put the date of the next review in the firm's calendar on the day of adoption.

On the network side, AnonymFiles works with no account and no telemetry; the license is checked on the computer, with no network call. On Mac, the detection models are included: no connection at all. On Windows, they are downloaded once, on first use, without any document text (see the security page and the published detection benchmark). To compare tools: comparison of anonymization software; for the profession: document anonymization software for lawyers. Pricing: €290 excl. VAT per seat per year for one or two seats, €240 excl. VAT per seat from three seats, on quote above twenty.