AI in Law Firms: Searching Files and Templates While Keeping Professional Secrecy

Key Takeaways

• In a law firm, AI helps most with searching your own files and templates, summarising and drafting.
• Client data only goes into systems that keep professional secrecy: on your own network, with a provider bound by contract, or with the client's consent.
• The search has to respect your access rights and conflict barriers, so nobody sees more than they could in the file.
• A qualified person checks every result, because liability stays with the firm.
• An internal instruction, an updated engagement letter and a trained team make the whole thing safe.

A law firm can use AI today mainly to search its own files, templates and past submissions by meaning, to summarise long correspondence and to prepare drafts of standard letters. That's allowed as long as client data only reaches systems that keep professional secrecy. The legal assessment, the responsibility and the signature stay with the lawyer.

What do law firms sensibly use AI for?

AI makes sense where time goes into searching and gathering that you can hardly bill. In many firms that's less about research in legal databases and more about working with what you already have. Where's the good clause from the last similar case? How did we argue against this opposing party back then? What's actually in the eighty emails in this file? Our page on law and advisory firms gives the overview. This guide goes deeper into what the law requires and how to go about it.

• Searching files and templates: finding past opinions, submissions, contracts and model clauses even when your search words don't appear in them, always with a reference to the document.
• Summarising: boiling long correspondence, minutes or exhibits down to what matters, with references so you can read the original.
• Preparing drafts: engagement confirmations, requests for extensions, standard letters or fee proposals from your own templates.
• Pre-checking new inquiries: logging them, pulling out the parties for the conflict check and passing them to the right person.
• Translating and polishing, for example on matters in French, Italian or English.

What does professional secrecy require when AI is involved?

Professional secrecy requires that nothing your clients have entrusted to you reaches anyone unauthorised, and that includes a software tool. Under Article 321 of the Swiss Criminal Code, lawyers and their auxiliary staff commit an offence if they disclose a secret entrusted to them in their profession. The penalty goes up to three years' imprisonment. Disclosure isn't punishable if the person entitled to the secret consents or the supervisory authority gives written permission. Article 13 of the Lawyers Act (BGFA) adds that the secret applies without time limit and towards everyone, and that the firm makes sure its auxiliary staff keep it too.

Then there's data protection law. You may hand the processing of personal data to a processor, but only if no legal or contractual duty of confidentiality forbids it (Art. 9 FADP). And as the FDPIC notes on outsourcing, you stay responsible for data protection even when a provider does the work for you.

What does the Swiss Bar Association recommend?

The board of the Swiss Bar Association (SAV/FSA) adopted guidelines on the use of AI on 14.06.2024. Before using any software, they say, you need to know what happens to the data you put in, who can access it and where it's stored. For confidential data they name three routes:

1. On your own network.The tool runs on the firm's infrastructure and no data leaves it. It's the strictest option, and it needs IT of your own.
2. With a provider, following the outsourcing rules.Here the association refers to its 2019 guidelines on IT outsourcing and cloud computing. Under those, a carefully chosen provider counts as the firm's auxiliary if it's contractually bound to professional secrecy and uses the data only to perform the contract.
3. With the client's consent.The informed client agrees, for example in the engagement letter. The cloud guidelines recommend this consent on top of the second route as well.

Outside these three routes, the guidelines say confidential information and personal data don't belong in an AI system. They also recommend an internal instruction on AI use and require every result to be checked independently. A lawyer who performs a mandate badly is liable, and saying the AI got it wrong excuses nobody. As of October 2026. This article isn't legal advice. Have your set-up reviewed against your professional and bar rules.

Which AI tools are an option for a law firm?

For client data, only tools where you know and control the contract, the storage location and the access. Broadly there are four kinds:

• Public chatbots on a personal account: fine for general questions and texts with no link to a matter. Not for files, names or facts of a case, because you don't control the terms or the storage.
• Business versions from large providers: with a contract, a processing agreement and a commitment that your data won't train any model. Whether that's enough for client data depends on the contract, the storage location and the commitment to professional secrecy.
• Your own solution on your documents: a search or assistant built on your files, hosted in Switzerland, in the EU or on your own network, with your access rights.
• AI inside your practice software: features in your case management or document management system. Ask which subcontractor actually does the AI processing.

What to look for in storage locations and contracts is covered in our guide to AI tools and where your data goes.

How do you make the archive searchable without anyone seeing too much?

The search takes over the access rights your document management system already has, including any barriers you've set up because of conflicts of interest. If someone can't open a file, they don't get an answer from it either. Technically, that means permissions are checked with every question, not once at set-up. How this kind of search works, and the four questions that decide whether it's safe, are explained in Can confidential documents go into an AI?

An example: a firm with eight lawyers handles several tenancy disputes a year. An associate is looking for the argument on returning the rented premises from an earlier case. Instead of asking around at the partners' meeting, the associate puts the question to the search, gets three passages from submissions they're authorised to see, and reads the paragraphs in the original. A file behind a conflict barrier never shows up in the results at all.

How do you introduce AI in a law firm?

In five steps, with little risk at the start and client files only once the groundwork is in place:

1. Take stock.Write down who already uses which AI tools, on which account and for which data. It's often more than the partners know.
2. Issue an internal instruction.Decide which tools are allowed for which data, how results are checked and who to ask. There's a model outline in our guide to writing an AI usage policy.
3. Start with low-risk data.Your own templates, model clauses and anonymised submissions are a good start. Client files follow once the contract, the storage location and access are settled.
4. Update the engagement letter.Add a note on the use of cloud and AI services, and get the client's consent wherever you want to rely on it.
5. Train the team.Anyone using AI needs to know how to ask good questions and how to spot a wrong answer, like an invented judgment or a false citation. Why models do this is explained in why AI makes things up.

The AI may search, sort and draft. Assessing, deciding and signing stay with the firm.

Strategy, legal assessment, deciding what goes into a submission and the signature all stay with you. The bar association's guidelines also point out that you may have to tell clients if they expect you to handle the mandate personally. In our team training, lawyers practise using AI safely for research and drafting.