Before Your Firm Uses AI on Client Files, Take This 10-Minute Test

"72% of law firms have no written AI policy. 1 in 3 lawyers are already using public AI tools on client files. The only question left is which side of that statistic your firm is on."

The Quiet Problem Nobody Is Talking About

It is 4pm on a Tuesday. A senior associate copies a paragraph from a confidential client file and pastes it into a public AI tool. Faster summary. Done.

She did not break a rule. There was no rule.

This is happening in most law firms across Europe right now and managing partners are usually the last to know. Under GDPR Article 9 and the EU AI Act, pasting client data into a public AI tool, one built and operated outside Europe, where your data leaves your control the moment you hit send, can be a serious breach of client confidentiality and data sovereignty. The firms that act now have a window. The firms that wait will not.

The 3 Questions Every Law Firm Needs to Answer Before Using AI

Most AI checklists for law firms are written by compliance teams for compliance teams. This one is not. It covers three things, and only three things, because these are the only three that actually matter right now.

1. Do you know what AI your team is using? Not what you have approved. What they are actually using. Public AI, legal research tools, drafting assistants, etc. If you cannot name them all, you cannot manage the risk. This section covers whether your firm has visibility, a written policy, and someone responsible for keeping it current.

2. Are client files actually safe? This is the critical one. Public AI tools send your data to external servers. If a lawyer in your firm has ever pasted a client document into public cloud-based AI, that data left your building. This section asks whether your firm has a clear rule stopping this, whether clients are informed when AI is used on their files, and whether someone checks every AI output before it is relied on.

3. Are you ready for what is coming? AI regulation for law firms is moving fast. The CCBE has already issued guidance. Bar associations across Europe are following. This section covers whether your firm can explain its AI approach to a client if asked, whether you are tracking regulatory developments, and whether you have looked at local AI options for sensitive work.

4 Questions That Will Tell You the Truth Right Now

Can you name every AI tool your team is using on case work today? Most managing partners cannot.
Has anyone in your firm ever pasted a client document into a public AI tool? If the honest answer is "probably, but we are not sure" that uncertainty is the risk.
Do you have a written, signed-off policy on which AI tools are approved for case work? If you cannot point to a document right now, you do not have one.
Do your AI tools keep data inside your own network or send it to external servers? For sensitive case work, only fully local AI is genuinely safe.

These are four of the 18 questions in the full checklist. If you hesitated on any of them, the complete version will tell you exactly where you stand.

Get the Full Free Checklist

The Sinabis AI Risk Checklist 2026 is an 18-point self-assessment written specifically for law firm partners, senior associates, and digital forensic teams. Ten minutes. A clear score out of 36. Plain language throughout and no technical knowledge needed.