Legal Professional Secrecy and AI by Thomas Hoeren – Transcript

00:00Um Um Second um aspect Um uh how can we define legal professional secrecy as an organizational and criminal duty?

00:14Third topic disclosure risk um which might happen when using external AI systems. >> [snorts] >> Then GDPR issues, data protection, that is the role of law firms using AI security um transfer of trans- border data

00:40and um data protection impact assessment. Um next session um we're talking about reliability, opacity, bias, and independence concerns.

00:55And finally, we are talking about procedural risk. Um AI Act uh implications and um governance in practice. So, here I have uh uh first and uh the committed to that issue.

01:16Why is this topic matters now? Because AI tools are very often used for research um documentary uh analysis, drafting support by um advocates and law firms.

01:34They use for translation and um use for data management and internal knowledge retrieval. Um that promises um enormous efficiency gains.

01:50But it touches the core of the legal profession especially when it comes to the issue of secrecy, independence, and accountability. So, the legal framework for that topic, secrecy of a law firm um has many dimensions.

02:13Um professional conduct law, criminal law, data protection law, civil liability, and EU AI regulation. And now I'll show you again uh [clears throat] the framework from uh central regulatory perspective, that's the AI Act, because it adds um an uh additional compliance layer.

02:39It does not re- replace secrecy laws, but is a new feature when we are talking about secrecy of uh law firms and AI. The deadline for coming into force is a very um under discussion now, because we have the digital omnibus and that changes um

03:07several um timelines. For instance, the European Parliament has now agreed that the timeline for uh high-risk AI systems will be postponed till um the end of 2027.

03:28Um So, you have to be aware of this at the end of next year uh what is uh regulated and enforced by the AI Act. Um we have six uh different packages of questions.

03:50The first is the input of client data. May mandate-related data be entered into AI system at all? Second question how must provider roles, contracts, and data workflows be classified?

04:11Third topic how should firms uh handle hallucinations, opacity, or unreliable output? Fourth topic, liability and diligence, what do remains the lawyer's own responsibility despite AI assistance?

04:33Fifth element is independence and delegation, when does AI un- undermine personal service and professional autonomy? And the final section AI Act, what happens when the AI Act is fully enforced and in practice?

04:59So as a starting point let me describe where legal professional secrecy is regulated. Um Um we have professional conduct law in Germany, for instance, section 43a.

05:20It establishes confidentiality as a core basic um professional duty. Um and paragraph two of the Bora rules clarifies that the duty persists even after the mandate ends.

05:41And the duty requires appropriate organizational and technical protection measures. That is one feature of regulation.

05:54The second feature is criminal law. We have famous disastrous section um paragraph 203 of our criminal act in Germany which penalizes unauthorized disclosure of a foreign secret by a lawyer.

06:16The protected sphere is broad and includes not only legal advice as such, but also mandate existence, identities, and contractual um information.

06:33And the third feature of professional secrecy is [snorts] that these rules are technology-neutral. There is no general prohibition on using AI.

06:48But there is a high threshold of review. Tools must be chosen and operated in a way that is compatible with um confidentiality. So next topic AI is a very uh important

07:12element with a high risk at the stage of disclosure. You have to know that external AI systems are not regarded as mere internal tools, but third parties can read and um get to know all the information in an external AI system. So, when you enter um

07:41a um letter to the court as part of your um client relationship as you are entering that in an external AI system that usually discloses that information to the provider and its infrastructure chain.

08:04Um >> [clears throat] >> Therefore section 443a of the Bora rule permits permits service provider access only under strict conditions, including careful selection and adequate confidentiality commitment.

08:28This often fails in practice where terms of of service are parked globally and distributed or changed on short short notice.

08:43As a consequence open public chat chat services systems are generally unsuitable for unredacted client data. Um so, you have to know what you do uh sending open information around.

09:04Um Um Even if a provider claims not to train on user content significant risk uh remain. Logging, support exchange, support subprocessor involvement, and international sub- transfers my may still compromise confidentiality.

09:30So, it's not only the input but as well the processing um of data within an AI system that causes risk for secrecy.

09:48Um You have to know that most mandate data qualify as personal data. Often they are extremely sensitive.

09:59So law firms must assess AI processing against the full GDPR matrix. That means the GDPR is a very important regulation when it comes to the use of AI by law firms.