EU AI Act for Legal Services: What Law Firms Must Do
Law firms are adopting AI for contract review, legal research, e-discovery and drafting. Under the EU AI Act (Regulation (EU) 2024/1689), most of these uses sit in the limited-risk tier rather than the high-risk regime — but the Act still imposes transparency duties, and a narrow set of justice-sector applications is high-risk under Annex III. Knowing which tier each tool falls into is the first compliance step.
Is it in scope?
The Annex III high-risk listing for the administration of justice is deliberately narrow: it covers AI intended to be used by, or on behalf of, a judicial authority to research and interpret facts and law and to apply the law, or used in alternative dispute resolution. A private firm's contract-analysis, research or drafting tools generally fall outside that trigger and are not high-risk on this basis. Client-facing chatbots and generative drafting attract Art. 50 transparency duties instead — disclosing AI interaction and marking AI-generated content. Firms must also observe Art. 4 AI literacy, in force since 2 February 2025.
Typical AI use cases
- Contract review and clause extraction
- Legal research and case-law analysis
- E-discovery and document review
- Automated drafting of briefs and correspondence
- Client-facing legal-intake chatbots
Risk classification
For most firms, legal-AI tools are limited- or minimal-risk: the priority is Art. 50 disclosure for chatbots and generative output, plus AI literacy under Art. 4. The system genuinely becomes high-risk only where AI is used by or on behalf of a judicial authority (or in ADR) to assist in interpreting and applying the law under Annex III(8) — a scenario relevant to courts and some litigation-support work rather than routine advisory practice. Professional-secrecy and accuracy risks mean human review of AI output should be treated as a matter of professional duty regardless of tier.
Obligations to prepare for
Your exact duties also depend on whether you build or use the AI. See obligations by operator role — provider, deployer, importer, distributor or GPAI provider.
FAQ
Is our contract-review AI high-risk?
Generally no. Contract analysis, research and drafting tools used in private practice fall outside the Annex III administration-of-justice listing, which targets AI used by or on behalf of judicial authorities. They are typically limited-risk, with Art. 50 transparency duties for any generative or chatbot features.
When does legal AI become high-risk?
Under Annex III(8), when AI is intended to be used by, or on behalf of, a judicial authority to research and interpret facts and the law and apply the law to concrete facts, or in alternative dispute resolution. That is a narrow trigger centred on adjudication, not routine legal advice.
Do we have any duties for a client-facing legal chatbot?
Yes. Under Art. 50 you must inform users they are interacting with an AI system unless it is obvious from the context, applicable from 2 August 2026, and mark AI-generated content. Staff must also have adequate AI literacy under Art. 4.
Run the free 2-minute risk checker — no sign-up.