AI governance for law firms: a checklist

In short. AI governance in a law firm decides which AI tools lawyers may use, what client data may go into each, how outputs are checked before they reach a client, and who is accountable. Without it, nobody can say which tools have seen client data.

The checklist

1. A list of approved tools, and a way to ask for a new one.
2. Data rules for each tool: what may never go in, what may go in with the client’s consent, and what is free to use.
3. Vendor terms checked: where data is stored, whether it trains the vendor’s models, and how long it is kept.
4. A rule that a lawyer checks every output used in client work, and a record of that check.
5. Client information: when clients are told that AI is used, and how the engagement letter says so.
6. Training for everyone who uses the tools.
7. One owner for the policy, and a review date.
8. A route for reporting a mistake, and what happens next.

What the law says

EU AI Act. Article 4 requires the providers and deployers of AI systems to take measures to support the AI literacy of their staff and of others who operate or use AI systems on their behalf. A deployer is anyone using an AI system under its authority outside personal, non-professional use, so a firm whose lawyers use AI at work is one. That wording has applied since July 27, 2026, set by the Digital Omnibus on AI. From February 2, 2025, until then, the duty was to take measures to ensure, to their best extent, a sufficient level of AI literacy. The new text says plainly that a firm need not guarantee any particular level for any individual.

Czech Republic. Under § 21(1) of the Legal Profession Act (No. 85/1996 Coll.), an advocate must keep confidential all facts learned in connection with providing legal services. Client facts put into an AI tool are no exception.

Sources

• Regulation (EU) 2026/1744 (Digital Omnibus on AI), Article 1, point (5), which replaces Article 4 of the AI Act. Official Journal, July 24, 2026; in force from July 27, 2026.
• Regulation (EU) 2024/1689 (AI Act), Article 3(4) (deployer) and Article 113 (application of Chapter I from February 2, 2025).
• Act No. 85/1996 Coll., on the Legal Profession, § 21, consolidated text in force from January 1, 2026.