A law firm AI charter: what the Paris Bar's model contains (July 2026)

On 21 July 2026 the Paris Bar Council adopted a model AI charter for law firms. It is not binding: it is a template that each firm adapts and has its lawyers sign. We read the whole text. Here is what each article says, and the five points we think a firm should add before signing.

The template can be downloaded as a Word file from the Paris Bar's announcement page (direct link to the .docx). According to its article 1, it works alongside the National Rules of the Bar (RIN), the Paris Bar's internal rules, the GDPR and the EU AI Act.

1. What the model charter contains

Scope and definitions (articles 1 to 3)

The charter covers every AI system used in the course of practice, "whatever its method of development, origin or hosting": online, cloud, on-premise, built-in or developed in-house (our translation). It defines "confidential data" broadly: anything covered by professional secrecy, the confidentiality of exchanges between lawyers, trade secrets, the secrecy of investigations or any other secret protected by law. It also defines agentic AI, systems that pursue a goal autonomously over several steps.

Access and authorisation (article 4)

Using any AI system requires each lawyer's prior, written, individual acceptance of the charter, and suitable training. The firm then picks one of three regimes:

• Option 1: only tools developed or expressly validated by the firm, after an audit of security, confidentiality, GDPR compliance and professional rules.
• Option 2: online tools are allowed if three conditions are all met: prior validation by a designated referent or sufficient guarantees, no confidential or sensitive data entered, and systematic human checking of results.
• Option 3: case-by-case authorisation, on a reasoned request, after a legal, technical and ethical risk analysis.

The most forward-looking clause is the review rule. A validation is "never definitively acquired": it is reviewed at least once a year, and immediately if the vendor, its subcontractor or its host changes hands in a way that could subject it to an extraterritorial data-access law, if its terms, data policy, hosting location or subprocessors change, or if the rules change. The referent can suspend a tool at any time, and lawyers must stop using it on notification.

General principles (article 5)

Lawyers remain "the sole guarantors of the accuracy, lawfulness and relevance of the content produced", must check every output and keep human control, and are warned that "the fluency and apparent coherence of generated content in no way guarantee its reliability" (our translation).

Permitted and prohibited uses (article 6)

Prohibited: entering, uploading or exposing secret, confidential or sensitive information in an AI system outside the firm or non-compliant; automating legal analysis that engages the firm's liability without real human control; using a tool whose terms are incompatible with the GDPR, the RIN or the charter. Permitted, subject to the rest of the charter: research, drafting assistance with full review by a lawyer, translation with human checking, legal monitoring, training materials, structuring internal work (the text lists "workflow, cowork, minutes, summaries") and informational audio or video without client data.

Training, data, security, audit, liability (articles 7 to 12)

• Article 7: regular, updated training on how the tools work, prompting, legal and ethical risks, GDPR and algorithmic bias, with a named point of contact.
• Article 8: intellectual property, both the client's (documents entered into an unvalidated tool) and third parties' (protected content in the output).
• Article 9: GDPR principles, no personal data in an unvalidated or unsecured tool, and doubts reported to the DPO or the firm's GDPR referent.
• Article 10: security (two-factor authentication, encryption, logging), updates installed without delay, incidents reported.
• Article 11: the firm may set up internal monitoring or audit of AI use.
• Article 12: using AI changes nothing about professional liability. It is "neither a ground for exoneration nor a mitigation of liability" (our translation), and it never replaces the lawyer's judgment.

The last articles deal with how the charter ranks against other internal rules (it prevails on AI matters), its revision and its electronic signature. A small drafting note: the numbering goes from article 14 to article 16, so check the cross-references when you adapt it.

2. Five points worth adding

The template is a framework, and several of its clauses are explicitly left "to be completed". Here is what we would write in, drawing on the CNB's 2026 ethics guide.

• A named list of validated tools. For each one: plan, hosting location, training setting, retention, date of validation and date of next review. Article 4 requires the review; a table makes it real.
• A mandatory pseudonymisation step. The template does not mention pseudonymisation. Yet the CNB guide asks lawyers to "systematically pseudonymise or anonymise data before any use of a generative AI tool", and the Paris Bar's white paper mentions a tool "deployed locally, with no external transmission of data to third-party servers" (our translations). Write down that no client document goes to an AI without being pseudonymised first, and with which tool.
• A verification protocol. The principle is there; the method is not. At minimum: every decision cited is opened at the source before it is used. See our article on case law invented by AI.
• Training that includes staff. The template is addressed to lawyers. Assistants, paralegals and trainees handle the same files; the firm's internal rules should cover them too.
• A position on informing the client. The CNB's 2026 guide leaves it to the lawyer to decide whether to tell the client that AI is used, and requires consent where client data would be used to train an internal AI system. The firm's charter is the place to set its own rule.