Claude Cowork for lawyers: what happens to professional secrecy?

What is Claude Cowork?

Claude Cowork is the agentic side of Claude, Anthropic’s assistant. It borrows the architecture of Claude Code, Anthropic’s developer tool, without the terminal: you describe an outcome (a memo, a spreadsheet, a sorted set of exhibits), and Claude makes a plan, splits the work, runs code if needed and delivers finished files such as documents, spreadsheets or slide decks. According to Anthropic’s documentation, checked on October 19, 2026:

• Plans: Cowork is limited to paid Pro, Max, Team and Enterprise subscriptions. It works in the Claude Desktop app for macOS and Windows, on the web, on mobile and in the Claude in Chrome side panel, with differences by plan.
• Access to your computer: on desktop, Claude “can read from and write to” your local files without uploads, but only in the folders you’ve connected. Local files, the browser and computer use all go through the Claude Desktop app, which must stay open.
• Connectors and browser: Claude can use apps connected to your account (Google Drive, Gmail, Microsoft 365, Slack and so on), open websites, click and fill in forms.
• One interface: Anthropic is gradually merging chat and Cowork. In the new experience, rolling out on Pro and Max and in beta on Enterprise, there’s no “Cowork” option any more: Claude decides whether a request calls for an answer or a task.

With the unified interface, an ordinary conversation can turn into a task that reads your folders, so a firm’s policy has to cover Claude as a whole, not just a “Cowork mode”.

What does Cowork do with the files in a folder you open?

The answer changed on October 6, 2026. Before that date, Pro and Max tasks could run “only on your computer”. Anthropic removed that option: new Cowork tasks on Pro and Max run in the cloud, and you can’t switch back. Tasks started on the computer before October 6 stay there until they finish. On Team, running in the cloud (in beta) is on by default; on Enterprise, it’s off by default and the organization’s owner decides whether to turn it on.

In a cloud session, the agent loop and code execution run in an isolated, temporary sandbox on Anthropic’s infrastructure. When a task needs a local file, the request goes through the Claude Desktop app, and only for connected folders. Anthropic spells out the consequence in its architecture overview: the agent’s work, “including any local files it opens through the desktop app, is processed on Anthropic’s servers rather than staying on the device.” In practice, when a task needs a file, Claude fetches a copy of just that file into the cloud; the copies are deleted with the session.

In a local session (tasks started before October 6, or Team and Enterprise deployments without the cloud), the agent loop runs on the device and code runs in an isolated virtual machine. But Cowork needs an internet connection throughout the session, and nothing in the documentation says the model itself runs on your computer: assume that whatever Claude reads goes to Anthropic. On Team and Enterprise, the history of those sessions stays on users’ computers, and admins can’t delete it centrally.

Anthropic’s own advice overlaps with legal ethics: don’t grant Claude access to files containing sensitive information, create a dedicated working folder rather than granting broad access, and watch for prompt injection, malicious instructions hidden in a document or web page the agent reads. The risk of attack, Anthropic writes, is “still non-zero”.

Training and retention: what changes with each plan?

Anthropic separates its consumer plans (Free, Pro, Max) from its commercial plans (Team, Enterprise, API). Cowork isn’t available on the free plan. As checked on Anthropic’s Privacy Center on October 19, 2026:

Other rules apply across plans. A chat flagged as violating the Usage Policy is kept for up to 2 years. A thumbs up or down keeps the whole conversation for 5 years. Anthropic may retain data where the law requires it or to resolve disputes. And Anthropic’s zero data retention (ZDR) covers only the API and Claude Code on Enterprise: it doesn’t apply to chat or Cowork, and the unified experience isn’t offered to ZDR organizations.

The main takeaway: turning training off protects against reuse, not against transfer. The file Cowork opened has still been copied to and processed by Anthropic.

Where is Cowork data processed and stored?

For its commercial plans, Anthropic says it uses several cloud providers and may route traffic to countries in the US, Europe, Asia and Australia, while noting that “data is stored in the US.” No EU data residency is announced for Claude Team or Enterprise as of our check, and the Privacy Center publishes no equivalent statement for consumer plans.

For the firm’s IT lead: according to Anthropic, endpoint detection (EDR) tools can’t see inside Cowork’s virtual machine or into cloud sessions. On Enterprise, however, Cowork sessions do appear in the Compliance API, the export interface meant for compliance teams.

What do the CNB and the Paris Bar say?

Neither text names Claude Cowork. Both set rules that fully apply to an agent that reads client files. Quotations below are our translations from French.

The guide of the Conseil national des barreaux (CNB, France’s national bar council), La déontologie et l’intelligence artificielle (1st edition, April 2026), starts from Article 66-5 of the French law of December 31, 1971 and Article 2 of the national bar rules (RIN). It’s unambiguous: lawyers must make sure they “never share data relating to their files or their clients” with generative AI (p. 15). It rules out attaching “any file containing all or part of a case file” that includes the client’s name or confidential information, which is exactly what Cowork does with a connected folder. Its summary of good practice says to “systematically pseudonymize or anonymize data before any use of a generative AI tool” (p. 18). On sovereignty, it excludes companies subject to extraterritorial laws, “such as American companies under their current legislation,” and recognizes only two ways to remove the risk: prior pseudonymization or anonymization, or a model installed on the firm’s own systems (p. 26). More detail: the CNB’s AI guide explained.

The Paris Bar adopted a non-binding model AI policy on July 21, 2026, which each firm can adapt. It expressly covers “generative” and “agentic” AI. Three passages bear on Cowork:

• permitted uses include “assistance in structuring internal tasks (workflow, cowork, minutes, summaries)”, subject to strict compliance with the policy’s other obligations;
• users undertake not to submit to an AI system any information covered by professional secrecy “unless the tool used has been vetted in advance” by the firm;
• a vetted tool must be reviewed again, in particular whenever its terms of use or its hosting location change.

Cowork’s move to the cloud on October 6, 2026 is exactly that kind of change: a firm that vetted Cowork when it ran locally should redo its assessment. To write or update the firm’s rule: a model AI policy for a law firm.

Is a Team or Enterprise plan enough to protect secrecy?

It handles part of the GDPR, not secrecy. On Team or Enterprise, the firm is the controller and Anthropic the processor: the DPA governs what Anthropic may do with the data (GDPR Article 28), and the no-training default is a contractual commitment. That’s far better than a personal Pro account.

But Article 226-13 of the French Criminal Code punishes the disclosure of secret information by the person entrusted with it with one year of imprisonment and a €15,000 fine. The CNB adds that a vendor’s promise not to reuse data is “generally neither provable nor verifiable” (p. 26). And the Paris model policy leaves vetting to the firm, a decision it will have to justify if a client or the bar ever asks.

The easiest position to defend is the CNB’s: don’t send the secret at all. Cowork then receives a folder in which no person or company can be recognized. For the profession-by-profession analysis: generative AI and professional secrecy.

How to use Cowork on a client file: the mirror folder

The idea: Cowork never sees the real file. It works on a pseudonymized copy, prepared and reviewed on your computer, in which every person and organization is replaced by a stable label such as [PERSONNE_1] or [ORGANISATION_2] (AnonymFiles uses French labels). The mapping table stays encrypted on your machine. The steps:

1. Open the folder in AnonymFiles. The app goes through the whole folder, subfolders included: text or scanned PDFs, Word, .eml and .msg emails, spreadsheets, presentations, images. Names, organizations, addresses, emails, phone numbers and IBANs are detected, and the same person gets the same label in every document.
2. Review side by side. Each document is validated next to the original before anything is exported. Look for indirect identifiers: an amount, a date, a case reference, a project name. Amounts are masked by hand, or by choice in a spreadsheet.
3. Export “for an AI” to a new folder. The export keeps the subfolder structure, gives files neutral names and adds an index plus an instruction file (AGENTS.md) asking the AI to keep the labels unchanged.
4. Connect only that folder to Cowork. Not the client folder, not your Documents folder. It’s the “dedicated working folder” Anthropic recommends, and there’s nothing secret left in it.
5. Hand over the task. Ask for a deliverable: a chronology, an exhibit table, a draft memo, a comparison of versions. Claude handles the labels like names.
6. Put the names back on your computer. Take the file Cowork produced and have AnonymFiles restore the real names, as text, Word or PDF. The mapping table never leaves the computer.
7. Check, then delete the task. Verify dates, figures, reasoning and case law. Then delete the task in Cowork: Anthropic erases it from its servers within 30 days.

What the method doesn’t solve: a file can still be recognizable from context alone (a high-profile case, a very narrow industry). That’s what the review is for, and human review of Claude’s work is still required. Step by step: pseudonymize a document for AI, then put the real names back and how AnonymFiles works.

On the network side, AnonymFiles works without an account or telemetry and doesn’t call any AI: you’re the one who drops the mirror folder into Cowork. See what the app does and doesn’t do on the network, and AnonymFiles for lawyers.

Which settings should you check before opening a folder to Cowork?

Even with a mirror folder, limit what the agent can read and do. The settings Anthropic documents: