EU AI Act for law firms and legal tech
The instinct is that legal AI must be high-risk. Point 8(a) is drafted around AI used by or on behalf of a judicial authority to apply the law to a concrete set of facts, which is not what a contract review tool at a law firm does. Most legal AI is out of Annex III and squarely inside Article 50.
What is in scope, and what is not
| Detail | |
|---|---|
| Point 8(a) covers | AI intended to be used by a judicial authority, or on its behalf, to assist in researching and interpreting facts and the law and in applying the law to a concrete set of facts, or used similarly in alternative dispute resolution |
| Point 6(b) may cover | Evaluating the reliability of evidence in the course of investigation or prosecution of criminal offences, relevant to some e-discovery and investigations tooling |
| Generally outside Annex III | Contract review and drafting, legal research at a firm, document automation, knowledge management, time recording and billing, client intake, none is a judicial authority applying the law to facts |
Expert analysis. Classification turns on the intended purpose of each system. This is our reading of common deployments, not an authoritative classification.
Where this usually goes next
Three situations account for most people reading this page. Each has a different answer.
A deal is blocked on an AI questionnaire
Legal will not sign until you can evidence how AI is governed. HumanAudit’s AI Trust Package is a fixed $3,500 over five business days: a public trust page, a pre-filled SIG Lite / CAIQ / SSPA Section K questionnaire bank, and your AI inventory and classification.
You need ISO/IEC 42001 documentation
23 clause-mapped AIMS documents with all 38 Annex A controls pre-populated, editable and yours to keep, from $199. Or score your gaps first: 18 questions, free, no signup to begin.
You are not sure what reaches you
Twenty minutes with the founder. No prep, no deck, straight to the person accountable for the work. If none of this applies to you, you get told that on the call.
This reference is published by HumanAudit Inc. Not a law firm, not an accredited certification body, not a registered auditor. We build documentation, your counsel interprets it, and an accredited body of your choosing certifies you. How this is funded →
Where law firms actually have obligations
Article 50, now. A client-facing chatbot must disclose it is AI. AI-generated client correspondence and marketing content engage the marking and disclosure duties. This has applied since 2 August 2026 and is where most firms’ real exposure sits.
Article 4, now. AI literacy applies to the firm as a deployer, at every risk tier. A training record is the artefact.
Article 25, if you productise. A firm that white-labels a client-facing AI tool, or builds a product on a foundation model serving an Annex III purpose, can become a provider of a high-risk AI system with the full Chapter III burden.
Annex III point 4, if you use AI in hiring. Firms are employers. Trainee recruitment screening is point 4(a) like anyone else’s. HR guide →
What is not a firm obligation: conformity assessment, CE marking and Annex IV documentation for tools you merely use. Those sit with the vendor as provider.
For legal tech vendors: the draft guidelines matter
- Draft Commission guidelines on Annex III are out for consultation and are reported to narrow point 8(a) substantially, excluding most internal court tooling, speech-to-text and court transcription, citizen-facing chatbots on court websites, press-release and accessible-summary drafting, and case assignment by specialisation. Draft, not binding, may change.
- Point 6(b) is reported to narrow too, limited to evaluating authenticity, integrity, source reliability and internal consistency, with collecting, structuring, indexing, clustering, timeline reconstruction, translation, transcription, semantic search and multimodal retrieval excluded. That would put much e-discovery outside point 6(b).
- Professional conduct rules apply regardless. Confidentiality, competence and supervision obligations to your regulator are unaffected by AI Act classification and are usually the binding constraint on how a firm may use AI.
- Client confidentiality and model training. Whether client material may be processed by a third-party model is a professional obligations question before it is an AI Act one.
What applies before December 2027
Article 50 and Article 4 apply to firms now. Neither depends on high-risk classification.
The deferral in Regulation (EU) 2026/1744 covers Chapter III Sections 1 to 3. It does not cover Article 5, Article 4, Chapter V general-purpose AI, Article 49 registration or Article 50 transparency. Full timeline →
Status labels on this page
Verified fact: The Annex III points, article references and dates cited above, checked against the consolidated Regulation and the Commission's AI Act Service Desk.
Expert analysis: The in-scope/out-of-scope allocation, the sector edge case, and the parallel-regulation reading.
Unsettled: Harmonised standards remain in development and the Commission's Annex III guidelines are in draft. Sector supervisory practice has not yet formed.
Advise on the live obligations first
Clients asking about the 2027 high-risk deadline usually have an unmet Article 50 obligation today. Leading with what is live is more useful advice and a better first engagement.
Classify before you build
Twelve questions mapping your system against Articles 5, 6, 50 and Annex III. No email required.
Frequently asked
Is legal AI high-risk under the EU AI Act?
Generally not under Annex III point 8(a), which covers AI intended to be used by a judicial authority or on its behalf to assist in researching and interpreting facts and the law and in applying the law to a concrete set of facts, or used similarly in alternative dispute resolution. Commercial legal software used by law firms is not a judicial authority applying the law to facts. Draft Commission guidelines are reported to narrow point 8(a) further by excluding most internal court tooling, though those guidelines are not binding.
What EU AI Act obligations do law firms have?
Principally Article 50 transparency, which has applied since 2 August 2026 and requires disclosure where a client interacts with an AI system and marking of AI-generated content, and Article 4 AI literacy, which has applied since 2 February 2025 to deployers at every risk tier. Firms using AI in recruitment are also deployers of Annex III point 4 systems. Conformity assessment and technical documentation sit with the vendor as provider.
Is e-discovery software high-risk?
It depends on the intended purpose and potentially on the final form of the Commission's Annex III guidelines. Draft guidelines out for consultation are reported to limit point 6(b) to evaluating the authenticity, integrity, source reliability and internal consistency of evidence, and to exclude collecting, structuring, indexing, clustering, timeline reconstruction, translation, transcription, semantic search and multimodal retrieval. Those guidelines are draft and not binding.