Generative AI: what the French Bar (CNB) recommends to lawyers (2026 guide)

The French National Bar Council (CNB) has published two texts on generative AI: a practical guide in 2024, then an ethics guide in 2026. Here is what they actually say, quoted from the source, what the Paris Bar has added, and a checklist you can apply to your own practice.

1. Two guides, three years apart in tone

The practical guide on using generative AI systems (first edition, September 2024) was a user's guide. The guide "Ethics and artificial intelligence", prepared by the Rules and Practices committee, was adopted by the CNB in March 2026 (first edition, April 2026). It is now the reference, and it is much more prescriptive.

2. The principle: client data never goes to a generative AI

The principle follows directly from professional secrecy, which article 2.1 of the RIN calls "general, absolute and unlimited in time" (our translation). The 2024 guide already said that lawyers must never share data covered by secrecy with a generative AI, "on pain of sanctions".

3. The solution it names: pseudonymise or anonymise first

The 2026 guide does not ask lawyers to stop using AI. It names the way to use it: "The solution lies in pseudonymising or anonymising the data" (our translation). Its summary of good practice reads:

• "Systematically pseudonymise or anonymise data before any use of a generative AI tool" (our translation);
• "Pay attention to the risk of indirect identification by cross-referencing data" (our translation).

The 2024 guide gave the manual version of the same idea, replacing client names with fictitious initials "of the X or Y type", and already warned that cross-referencing several pieces of data can identify a person even after pseudonymisation.

4. Sovereignty, and why provider promises are not enough

The guide asks firms to prefer providers hosted in France or the EU and to rule out those subject to extraterritorial access laws, "such as American companies under their current legislation" (our translation). It also notes that a provider's commitment not to reuse data "is generally neither provable nor verifiable" (our translation). In other words: a setting in a dashboard is not a guarantee.

5. Checking the output is part of the duty

The 2026 guide requires "systematic verification of the results produced by AI" (our translation). It cites two 2026 rulings on fabricated case law in court filings: Rennes administrative court, 28 January 2026 (no. 2506364), and Bordeaux administrative court of appeal, 26 February 2026 (no. 25BX02906). The 2024 guide put it in one line: you become "a verifier and a validator" of what the AI produces (our translation).

6. Informing the client

On this point the 2026 guide leaves the choice to the lawyer: "It is for the lawyer to decide whether to inform the client" (our translation). There is one exception: the client's consent is required when client data are used to train an internal AI system.

7. What the Paris Bar adds

The Paris Bar's White paper on AI (2025), which includes a good practice guide voted by the Bar Council, explicitly opens two routes: the lawyer may use anonymisation or pseudonymisation, or write an abstract version of the case, and "may also use a locally deployed tool, with no external transmission of data to third-party servers" (our translation).

On 21 July 2026 the Paris Bar Council adopted a model AI charter for firms. Users undertake not to submit to an AI system any data or information covered by professional secrecy unless the tool has been validated beforehand, and the charter requires systematic human verification of results.

8. A checklist for your firm

1. List the AI tools actually used in the firm, including personal accounts, and the plan each one is on.
2. Make prior pseudonymisation the default for any document that comes from a client file, without exception for "quick questions".
3. Keep the mapping table inside the firm, separate from the protected copy, as the GDPR definition requires.
4. Review each protected copy for indirect identifiers before sending it: rare job titles, small towns, exact dates, distinctive amounts.
5. Verify every AI output against the sources, especially case law and citations.
6. Write it down: a short internal charter (the Paris Bar model is a good base) and a decision on informing clients.

9. Where a local pseudonymisation tool fits, and where it does not

What it solves

Hexagone AI does the prior pseudonymisation the CNB asks for, on the lawyer's own computer: the original file and the mapping never leave the firm, so the sovereignty question does not arise for the pseudonymisation step itself, and no provider promise is needed. The same person keeps the same pseudonym across a whole file, which manual "X and Y" cannot sustain over two hundred pages.

What it does not solve

• Verifying the output. A pseudonymised file does not make the AI's answer correct. Checking it stays your job.
• Live tasks. As the 2024 guide notes, pseudonymisation does not apply to every task, for example a live summary of a client meeting.
• Indirect identification. The software flags what it detects, but a human review of the protected copy is still the safeguard against context that identifies on its own.