The CNB guide on artificial intelligence (2026) and its assessment grid: the recommendations, point by point

The CNB guide in 5 points

1. Nothing that identifies a client or a matter may be given to a generative AI (p. 15).
2. Systematically pseudonymize or anonymize before any request, and limit the context to what is strictly necessary (p. 18).
3. Beware of cross-referencing. Combined, an amount or an internal project name can make it possible to recognize a client (p. 20). And pseudonymization does not cover every task (p. 17).
4. Get trained and check every result before using or sending it (pp. 24 and 28).
5. Choose tools with verifiable safeguards, and inform the client case by case, and always if they ask (pp. 26 and 36).

When was the CNB guide on AI adopted?

This article draws on two practical guides from the CNB. The first, “Utilisation des systèmes d'intelligence artificielle générative” (Using generative artificial intelligence systems), comes from its Artificial Intelligence working group (1st edition, September 2024): how the models work, risks, writing requests.

The second, “La déontologie et l'intelligence artificielle,” drawn up by the rules and practices committee, was adopted at the general assembly of March 12 and 13, 2026 and announced on March 17. The published booklet is marked 1st edition, April 2026; the CNB's list of practical guides dates it May 13, 2026. Unless otherwise stated, the page numbers cited refer to this 2026 guide.

The guide presents itself as “an operational guide” (p. 11, our translation): it creates no new rule, but applies to AI obligations that already bind every French lawyer, first among them professional secrecy (Article 66-5 of the Law of December 31, 1971, Article 2 of the RIN) and the GDPR.

Can a French lawyer put client data into an AI?

The guide bases the requirement on Article 66-5 of the Law of December 31, 1971 and Article 2 of the RIN, the national internal rules of the bar (p. 15). Under Article 66-5, “all documents in the file are covered by professional secrecy” (our translation).

A request transmits the data to the company running the AI, “in most cases” an American one. That company stores it and sometimes uses it to improve its models (p. 14). Hence the principle: “never communicate data relating to one's files or clients to generative artificial intelligence” (p. 15). The following are excluded from any request:

• the client's name, whether an individual or a company;
• the confidential information they entrusted and the strategy of the matter;
• any attached file containing these elements;
• “any specific detail of a file that could make it possible to identify a person or a company” (p. 15).

The context is limited to the data “strictly necessary to carry out the task” (p. 16).

Pseudonymize or anonymize before any request

“The solution lies in pseudonymizing or anonymizing the data,” the guide states (p. 16), using the definitions of the CNIL (the French data protection authority).

Pseudonymizing

This means replacing directly identifying data with indirectly identifying data, such as an alias or a sequential number (p. 5). The operation remains reversible. The guide's examples: “replace clients' names with fictitious initials (such as X or Y) or a complex string of characters,” or an address with a city or region (p. 16).

Anonymizing

This means making any identification impossible, in practice and irreversibly (p. 17). The suggested approach: remove direct identifiers and rare values, keep only what is useful, reduce precision, for example the year of birth instead of the date (pp. 17-18).

The guide's example: before giving contracts to an AI, the firm “pseudonymizes or anonymizes the parties (names, addresses, phone numbers)” (p. 20). See also the difference between anonymization and pseudonymization under the GDPR.

The limits: re-identification and excluded tasks

Removing names is not enough: “any risk of re-identification must be removed” (p. 15). A client can be recognized by cross-referencing data, even pseudonymized or anonymized. The guide's examples: “amounts, project names given internally, the way a contract is drafted” (p. 20).

Another limit: “To date, pseudonymization does not apply to every task a generative AI could perform.” (p. 17). Example: a live write-up of a client meeting. Here the guide mentions closed AI systems developed by firms (p. 17).

In practice, every copy is proofread in full, as when anonymizing a judgment or procedural documents.

Competence: get trained and check everything

Competence requires mastering your tools and their limits, and assessing the relevance of their results (p. 24). “It is essential to get trained in querying AI.” The CNB offers a free online course, SKILIA (p. 25).

Diligence requires checking everything: the lawyer “must reread, check and validate every generated content before using it or sending it to a client or a court” (p. 28). Otherwise, they risk civil liability and disciplinary proceedings. The guide cites four French decisions, from December 2025 to February 2026, noting case-law references that could not be found or did not exist, or a petition clearly drafted with the help of an AI (pp. 28-29). The 2024 guide already said so: “you become a checker and validator of the result generated by the generative AI” (p. 33). Finally, generative AI “must never replace the lawyer” (p. 30).

Which AI tools does the CNB recommend?

The guide recommends the legal AIs of legaltech companies and major publishers, “whose databases are more reliable” (p. 25). Its criteria:

• Sovereignty. Data hosted in France, or in the European Union, by a French or European company not subject to extraterritorial laws, which as things stand excludes American companies. The same criteria apply to the language model (p. 26).
• No reuse. This is a prerequisite, but a vendor's commitment “is generally neither provable nor verifiable” (p. 26).
• Security. Encryption with a key held by the firm, deletion of requests, restricted access for the provider's employees, logging (pp. 26-27).
• Reliability. Sources cited and accessible, a model suited to the applicable law (p. 27).

Beyond that, the guide accepts only two ways of eliminating sovereignty risks: “anonymizing or pseudonymizing the data beforehand,” or a model installed on the firm's systems (p. 26). In its view, comparing vendors' safeguards is an obligation under Article 28 of the GDPR, which only allows processors that provide “sufficient guarantees” (p. 27). The same reasoning applies to the tool that does the pseudonymizing: see anonymizing online or offline.

Finally, the lawyer checks that the terms of use do not allow the provider to appropriate what is entrusted to it (p. 29), and that the data is not at risk of being reused in other matters (p. 30).

Informing the client, the team and the judge

The guide does not require the client to be systematically informed: “It is up to the lawyer to decide whether to inform their client of the use of AI tools to handle a matter” (p. 34). Two exceptions: a client who asks the lawyer about their practices must be informed (p. 36); if their data is used to train an AI inside the firm, their consent must be obtained (p. 34).

Its model clause for the fee agreement ends: “No confidential or sensitive information will be sent to a tool that does not offer sufficient guarantees of confidentiality.” (p. 35).

At the firm: an AI usage policy and documented processes (p. 36). Before the judge, “no specific information has to be given to the court” (p. 36). Fees must reflect, in a balanced and transparent way, the time saved and the cost of the tools (p. 40).

From the guide to the firm: what to do

Pseudonymizing a file before AI

The manual method works for a short document (see anonymizing a document before ChatGPT or Claude), much less for an entire file.

AnonymFiles is a desktop app designed for this step, coming soon for Apple silicon Macs and Windows. It reads text and scanned PDFs (local OCR), images, Word files (.docx), e-mails (.eml, .msg), spreadsheets (.xlsx, .csv), presentations (.pptx), and .txt and .md files. It detects names of people, organizations, addresses, e-mails, phone numbers (French format), IBANs (nine European countries), private dates and ID numbers, and replaces them with stable labels such as [PERSONNE_1]: the same person keeps the same label across every document. Amounts and other passages are masked by hand, in one click, during review. Each document is reviewed next to the original, and nothing is exported without approval: no detection is perfect.

On export, the masked content is truly deleted, metadata and annotations are removed, and the copy of a Word document is a redacted .docx that keeps its layout, without images, comments or tracked changes. The mapping table stays on the computer, never in the export: it is used to put the real names back into the AI's answer, as text, Word or PDF. The app works with no account, no telemetry and no online license check. On Mac, the models are included: no connection at all. On Windows, they are downloaded once, at the first processing run, without any document text (see what the app does not do). For the profession: document anonymization software for lawyers. To compare it with other tools: comparison of anonymization software, and the published detection benchmark and offline test.

The CNB's assessment grid: the criteria

Before the 2026 guide, the CNB's Artificial Intelligence working group published in June 2025 a 44-page “grille de lecture” (assessment grid), presented as a self-assessment grid for comparing legal AI solutions. It sorts the criteria into three families (pp. 11-12):

• Data sovereignty, in order of priority: where clients' data is hosted, the nationality of the company that owns the servers, then the same criteria for the language model. Prerequisite: no reuse of data for training.
• Confidentiality and security: encryption in transit and at rest with a key held by the firm, anonymization of clients' data, deletion of requests, certifications, restricted access for the provider's employees, logging, regular security tests, physical security.
• Reliability: sources cited and accessible, origin of the model, certifications, and testing on a dataset before real use.

The grid adds a decisive point. To eliminate sovereignty risks and guarantee confidentiality, it accepts only two means: “full prior anonymization of the data,” or a model installed on the firm's own instances (p. 11). It then compares audited tools, as of March 17, 2025.

AnonymFiles, criterion by criterion

AnonymFiles is not a legal AI: it prepares the anonymized copy before the AI. Several criteria therefore do not apply. Here are our answers, including where the tool does not meet the criterion.

AnonymFiles is coming soon for Apple silicon Macs and Windows. The detail of the network scope is on the security page.

The 7 good practices of the joint advisory council

In an appendix, the guide reproduces the list of ethical good practices adopted by the Conseil consultatif conjoint de déontologie de la relation magistrat-avocat (CCC), the joint advisory council on ethics between judges and lawyers (p. 48). In summary:

1. Understand how tools work and how secure they are, know the applicable legal framework, and get trained in the ethics of generative AI.
2. Do not let AI replace human expertise: any use without critical proofreading is ruled out.
3. Check the accuracy of the information obtained.
4. Put no personal or confidential data into an unsecured tool, and find out about the tools' sovereignty.
5. Inform litigants of the risks of putting personal data or documents covered by secrecy into a non-sovereign, freely accessible AI.
6. Use AI in a reasoned way, to limit its environmental footprint.
7. Encourage regular exchanges between courts and bars about the tools in use.

What the guide does not say

• Which pseudonymization tool to use. It neither names nor endorses any.
• Where to keep the mapping key. The guide does not mention it. The GDPR requires this additional information to be “kept separately and subject to technical and organisational measures” (Art. 4, point 5). Sending the table with the copies would amount to sending the names.
• That pseudonymization does not take you outside the GDPR. The CNIL makes it clear: pseudonymized data “therefore retain a personal character” (our translation).
• What a file hides. The guide does not address hidden data. According to Microsoft, a document can contain comments, revision marks and properties. See how to remove PDF metadata.