The EU AI Act and Law Firms: What Applies, and When

Most of what law firms have been told about the EU AI Act is either too abstract to act on or quietly wrong. The two errors that recur are assuming the Act does not apply because a firm is not a technology company, and assuming everything a law firm does with AI is automatically high risk. Neither holds.

The distinction that decides everything: provider or deployer

The Act assigns obligations by role. A provider develops an AI system and places it on the market under its own name. A deployer uses an AI system under its own authority in a professional capacity.

A firm that buys a legal AI product and uses it internally is a deployer. Deployer obligations are meaningfully lighter than provider obligations, and most of the compliance anxiety in the market comes from firms reading the provider chapters and assuming they apply.

The exception matters though. If your firm builds a client-facing tool, or takes a third-party system and puts it out under your own brand, you can be a provider. Firms shipping client portals with AI features should look at this carefully rather than assuming the vendor carries it.

The timeline

The Act is phasing in over several years. The dates that matter, drawn from the official implementation timeline:

• 2 February 2025. Prohibitions on certain AI practices took effect, along with the AI literacy obligation.
• 2 August 2025. Rules on general purpose AI models, governance structures, notified bodies and penalties began to apply.
• 2 August 2026. The majority of the remaining provisions apply. This is the date most firms should be planning around.
• 2 August 2027. General purpose AI models already on the market before August 2025 must be brought into compliance.
• 2 December 2027. High-risk requirements apply for systems in Annex III.
• 2 August 2028. High-risk requirements apply for systems in Annex I.

AI literacy: the obligation that already applies to you

This is the one most firms have missed, and it has been in force since February 2025. Article 4 requires providers and deployers to take measures to ensure a sufficient level of AI literacy among staff who operate these systems, taking account of their technical knowledge, training and the context of use.

It is not prescriptive about method. It does require that you have done something and can show it. Given that 2026 survey data found 54 per cent of legal professionals had received no AI training at all, a large number of firms operating in the EU are not meeting an obligation that has been live for well over a year.

What satisfies it in practice: a documented training session covering what the firm’s tools do and where they fail, records of who attended, a short written policy, and a refresh cadence. That is achievable in a fortnight.

When legal AI is actually high risk

Contract review software is not high risk. Legal research assistance is not high risk. Drafting support is not high risk. The high-risk categories in Annex III are specific, and the ones that touch legal work are narrower than the general anxiety suggests.

The categories to watch are systems intended for use by a judicial authority in researching and interpreting facts and law and applying the law to a concrete set of facts, systems used in law enforcement contexts, and systems affecting access to essential services, employment or creditworthiness.

A firm advising on the deployment of an AI recruitment screening tool is advising on a high-risk system. A firm using AI to summarise its own document review is not. If your firm provides technology into court or tribunal processes, that is the area to examine closely.

Transparency obligations

Article 50 requires that people are informed when they are interacting with an AI system, unless it is obvious. For law firms this bites in one place above all: client-facing chatbots on firm websites and intake tools. If a prospective client is talking to a machine, they need to know.

Synthetic content also needs to be marked as machine generated in a machine-readable form where it is published. Firms producing content at volume should be aware of this.

The interaction with confidentiality and GDPR

The AI Act sits alongside GDPR rather than replacing it. Where you are processing personal data through an AI system, and in litigation and employment work you almost always are, the existing lawful basis, data minimisation and transfer analysis all still apply. The AI Act does not give you a new basis for processing.

Professional secrecy under national rules is a further layer, and in several member states it is stricter than anything in either instrument. In practice the national bar rule is often the binding constraint, not the Act.

A workable compliance sequence

1. Inventory. List every AI system in use across the firm, including the ones that arrived inside products you already had. Most firms are surprised by this list.
2. Classify each one. Provider or deployer. High risk or not. Subject to transparency obligations or not.
3. Close the literacy gap. Train, document, and set a refresh date. This is the obligation already in force.
4. Write the policy. Approved tools, prohibited uses, the verification requirement, and who to ask.
5. Review vendor terms against both the Act and your professional secrecy obligations.
6. Diarise 2 August 2026 and check your inventory against the provisions that come into effect.

For the United States position on the same questions, see our explanation of ABA Formal Opinion 512. For the policy document itself, see our firm AI policy structure.

This article is general information about a regulation, not legal advice on your firm’s position.