Lawyers work with the most sensitive data there is: criminal case files, M&A documents, health records in personal injury claims, trade secrets. A single data breach can end a career and ruin a firm.
Yet the pressure to use AI keeps building. As we wrote in our article on legal tech in daily practice: AI is shifting from promise to necessity. The question is not whether you will use AI, but how you do it without compromising your duty of confidentiality.
The problem with ChatGPT and American AI services
Let's be honest: ChatGPT is impressive. But for law firms it comes with fundamental problems:
1. Your data gets used for training
OpenAI's standard terms allow the data you enter to be used for training models. Even with the Enterprise version, questions about data retention and processing remain.
"Anything you type into ChatGPT can in theory resurface in output for other users."
2. American jurisdiction
The CLOUD Act gives US authorities access to data on the servers of American companies, no matter where those servers physically sit. That runs straight up against:
- The GDPR
- Lawyer confidentiality (article 11a of the Dutch Advocates Act)
- The Dutch code of conduct for lawyers
3. No control over how data is processed
With OpenAI, Google and Microsoft you never know exactly:
- Where your data is stored
- Who has access to it
- How long data is kept
- Whether sub-processors are brought in
The European alternatives
Luckily, a solid ecosystem of European AI models that do meet the requirements is taking shape.
Mistral (France)
The most mature European alternative. Mistral offers:
- Mistral Large: comparable to GPT-4 in capability
- Mistral Small: faster and cheaper for simple tasks
- On-premise deployment: run the model on your own servers
- EU data centre option: your data stays in Europe
We use Mistral for our legal AI solutions. The model performs excellently on Dutch legal texts.
Aleph Alpha (Germany)
A Heidelberg company that focuses specifically on enterprise use:
- The Luminous model range
- GDPR-compliant by design
- German hosting
- A strong focus on explainability
LLaMA 2/3 (open source, self-hosted)
You can host Meta's open-source models entirely yourself:
- Full control: your data never leaves your network
- No vendor lock-in: you don't depend on a single party
- Room for customisation: fine-tune on legal data
- Cost-efficient: no API costs after the initial setup
Anthropic Claude (with a caveat)
Claude (from Anthropic) is technically American, but it does offer:
- No training on the data you enter
- Stronger privacy guarantees than OpenAI
- Deployment in an AWS EU region
That makes Claude a stopgap rather than the end solution for firms that want to work 100% European.
Practical implementation models
Model 1: fully on-premise
How it works:
- An open-source model (LLaMA, Mistral) runs on your own servers
- No data leaves the firm's network
- Full control, full responsibility
Suitable for:
- Large firms with IT capacity
- Firms with extremely sensitive files (criminal law, M&A)
- Firms that want zero external risk
Investment: €50,000 to €150,000 for hardware plus implementation
Model 2: private cloud in the EU
How it works:
- The model runs at a European cloud provider (Hetzner, OVH or Leaseweb, for example)
- The servers sit physically in the Netherlands or Germany
- A data processing agreement with an EU party
Suitable for:
- Mid-sized firms
- Firms without their own data centre
- A balance between control and convenience
Investment: €2,000 to €10,000 per month
Model 3: hybrid approach
How it works:
- Sensitive data stays on-premise
- Non-sensitive tasks (research, summaries) run through the EU cloud
- Smart routing decides what gets processed where
Suitable for:
- Firms that want to get started quickly
- A pragmatic approach with room to grow
This is the model we implement most often for AI projects at law firms.
The legal grounding
GDPR requirements for using AI
Every AI system that processes personal data has to meet:
-
Lawfulness (art. 6 GDPR): which legal basis are you using?
- Legitimate interest (efficiency at the firm)
- Performance of a contract (serving your client)
- Watch out: consent is rarely the right fit
-
Purpose limitation (art. 5 GDPR): only use data for what it was collected for
- AI may not reuse data for other purposes
- Document the purpose up front
-
Data minimisation: only enter the data you actually need
- Anonymise where you can
- Pseudonymise as a bare minimum
-
Retention periods: how long does the AI system keep data?
- What to demand from your supplier: a specified maximum retention
- Preferably: no retention at all (stateless processing)
Confidentiality and secrecy
On top of the GDPR, lawyers are bound by:
- Article 11a of the Dutch Advocates Act: the duty of secrecy
- Rule of conduct 3: confidentiality
- Disciplinary liability: if you breach either
In practice that means:
- Client data may not go to servers outside your control
- You are liable for data breaches at your AI supplier
- Informed consent from clients is worth getting
Implementation checklist for firms
Before you start
- Map out which data you want to process with AI
- Classify data by sensitivity (public → highly confidential)
- Decide which implementation model fits your risk profile
- Involve your privacy officer or data protection officer in the choice
When choosing a supplier
- Ask about data centre locations (they have to be in the EU)
- Insist on a data processing agreement that meets the GDPR
- Check whether sub-processors are used
- Ask about certifications (ISO 27001, SOC 2)
- Discuss the data retention policy (preferably: no retention)
After going live
- Train your people in safe AI use
- Write a protocol for what may and may not go into AI
- Monitor usage and incidents
- Review it periodically (at least once a year)
What we build
At Green Creatives we build AI solutions specifically for law firms:
1. EU-compliant legal research Legal research built on Mistral, hosted in the Netherlands. It searches legislation and case law without any data going to the United States.
2. On-premise knowledge bases All your internal knowledge, memos, advice, cases you won, searchable with AI. It runs entirely inside your own network. Read more about knowledge base systems.
3. Anonymisation layer A pre-processing step that automatically strips personal data before anything reaches an AI model. Even with external processing, you keep the risk to a minimum.
4. Secure client portals Custom web apps where clients can safely "talk" to their own file. End-to-end encrypted, hosted in the Netherlands.
The main takeaway
Using AI as a law firm is not impossible, it just takes the right approach. The American big tech options are convenient, but a minefield in compliance terms.
European alternatives are mature enough for production use. With the right implementation model you keep every benefit of AI without putting your duty of confidentiality on the line.
Want to know which model fits your firm? Book a no-obligation call →
This article is part of our series on legal tech. Read also: Legal tech: AI is shifting from promise to daily practice.
