AI use policy for the firm

How the tool works

1. The questions. Nine short steps: the firm and its AI referent, tools and how they are authorised, data and professional secrecy, verification of outputs, clients and publications, uses to screen (human resources, arbitration), training, security and control, adoption.
2. The policy. Each answer adds or adapts clauses. Each clause is written from scratch, carries a stable identifier (for example ai.secrecy.closed_env) and cites its source: the OVB and AVOCATS.BE guidelines, the OFABB and Paris bar model charters, the CCBE guides, the AI Act, the GDPR. Some clauses are always there: professional secrecy and closed environment, pseudonymisation, verification of the sources cited, the lawyer's responsibility, AI literacy, prohibited practices.
3. The checks. If the policy lets a tool receive more data than the AI tools register proposes, or secret information while only on-premises environments count as closed, the tool says so next to the document.
4. The summary. One page of "Do / Do not" for staff, with the referent to contact.
5. What comes next. The "Before you sign" list shows what remains: GDPR register, DPIA screening, privacy notice, processing agreements, training record.

The policy and the summary export to PDF and Word, in the language chosen, independently of the site's language. With a verified e-mail address, they carry your firm's letterhead, and its name is used in the text.

What the texts say

• OVB and AVOCATS.BE guidelines (January 2025). The lawyer knows the basics of AI, reads the tool's terms of use, checks that the legislation, doctrine and case law cited exist, pseudonymises personal data and never enters information covered by professional secrecy outside a closed environment with sufficient safeguards. They remain responsible for the output. There is no general duty to tell the client that AI is used.
• Penal Code, art. 352 (since 1 September 2026, formerly art. 458): professional secrecy.
• AI Act. Art. 4, replaced by Regulation (EU) 2026/1744 since 27 July 2026: the deployer takes measures to support the AI literacy of its staff, with no guaranteed level. Art. 5: prohibited practices, including inferring emotions at the workplace. Art. 50: transparency of chatbots and generated content, since 2 August 2026. Annex III and art. 26: high-risk uses (recruitment, arbitration), from 2 December 2027.
• GDPR, arts 28, 30, 35 and 44 to 46; the CCBE guides of 2025 and 2026; the model charters of the OFABB (March 2026) and the Paris bar (July 2026), whose structure the tool follows without reproducing their text.

Points to watch

• The guidelines do not require a written policy: the policy is the firm's choice, organising duties that already exist.
• Can a business online service be a "closed environment"? The question is not settled. By default, only the firm's premises or a private infrastructure it controls count; the other option needs an explicit decision of the firm.
• No text found governs billing for AI-assisted work: the clause is optional and neutral.
• A chatbot the firm builds under its own name may make the firm a provider within the meaning of the AI Act: examine this before it goes live.
• To pseudonymise a document on your device before using it with an AI tool, Localex works in the browser.

What the tool does not do

• It replaces neither reading each tool's terms of use nor the advice of a data protection specialist.
• It does not say whether a given tool is safe: the AI tools register helps document that, point by point.
• Your answers stay in this tab's memory: nothing is sent.

Verification

The sources were verified on 7 October 2026. The tool assists the lawyer, who remains responsible for the text the firm adopts.