Filter by Category

How to Comply with the EU AI Act When Using Generative AI for Document Review in a German Law Firm

German law firms using generative AI for document review must comply with the EU AI Act’s obligations for deployers and, in some cases, providers—especially when the tool qualifies as “high-risk” or uses a GPAI model. In Germany, this sits alongside strict GDPR, professional secrecy (Verschwiegenheit), and client confidentiality expectations. This article explains how to classify your use case, allocate roles, implement required controls, and document compliance for AI-assisted review workflows.

Why the EU AI Act matters for AI-assisted document review in Germany

Generative AI is rapidly becoming part of document review: summarizing productions, clustering documents by theme, extracting key clauses, drafting chronologies, and proposing relevance or privilege tags. In a German law firm, these efficiency gains intersect with a strict regulatory environment—most notably the EU AI Act (the “AI Act”), the GDPR, and professional secrecy obligations (Verschwiegenheit) that underpin client trust and legal privilege-like protections.

The AI Act is a horizontal EU regulation establishing a risk-based compliance framework for AI systems placed on the EU market or used in the EU. It regulates not just “providers” who develop or place AI systems on the market, but also “deployers” (users) such as law firms. If your firm uses a vendor’s generative AI tool for document review, you are typically a deployer; however, your firm may become a “provider” if you significantly modify an AI system or put it into service under your own name in a way the AI Act treats as providing.

Because document review often involves personal data, special category data, trade secrets, and privileged communications, the core compliance question is not whether the AI Act applies (it likely does), but which obligations apply to your specific setup and risk profile.

Step 1: Classify your AI use case under the EU AI Act

1) Are you using a “GPAI model” or an “AI system”?

Many document review tools embed a general-purpose AI (GPAI) model (e.g., a large language model) and offer it as part of an AI system (a product/service with a defined intended purpose). The AI Act includes separate obligations for providers of GPAI models and for providers of AI systems. Law firms usually don’t train the model; they use an AI system supplied by an eDiscovery or productivity vendor.

2) Is your document review tool “high-risk”?

The AI Act imposes its most demanding obligations on “high-risk” AI systems. Whether document review is high-risk depends on the AI system’s intended purpose and how it is used. Typical “AI-assisted review” features—summaries, suggested tags, duplicate detection, clustering—are not automatically high-risk. However, risk can rise if the system is used in contexts that affect individuals’ rights in a legally significant way.

Practical examples:

Lower-risk (but still regulated): Using GenAI to summarize contracts in an M&A due diligence data room, propose issue lists, or draft internal memos—where attorneys remain fully responsible for decisions.

Higher-risk indicators: Using AI outputs as decisive inputs for employment-related investigations, whistleblowing triage, or mass claims screening where outcomes may materially affect individuals, without robust human oversight and contestability.

3) Are you a “deployer” or have you become a “provider”?

Most German law firms are deployers. You may drift toward provider territory if you:

• repackage the system under your brand and provide it to third parties,

• make “substantial modifications” affecting compliance, or

• change the intended purpose in ways the AI Act treats as placing a new system into service.

This distinction matters because provider obligations (e.g., technical documentation, conformity assessment in high-risk scenarios) are heavier than deployer obligations.

Step 2: Map EU AI Act duties to a German law firm’s document review workflow

Assuming your firm is a deployer using a vendor AI tool for document review, your compliance focus typically includes: (1) governance and policies, (2) human oversight, (3) input/output controls, (4) logging and documentation, and (5) vendor management.

Human oversight: keep lawyers “in the loop” with enforceable controls

The AI Act emphasizes that humans must be able to oversee AI systems appropriately to prevent or minimize risks. In document review, this means more than a policy statement; it should be operationalized:

• Require attorney validation before any AI-suggested relevance/privilege tag is finalized.

• Prohibit “auto-send” of AI-generated client communications without review.

• Define escalation rules (e.g., contradictory summaries, unclear citations, or missing provenance triggers manual review).

• Set competency requirements: reviewers must be trained to identify hallucinations, prompt sensitivity, and context loss.

Transparency to internal users and, where appropriate, clients

Even when the AI Act does not mandate specific consumer-style disclosures for a professional B2B setting, transparency is a key risk control. For law firms, transparency has two layers:

Internal transparency: Ensure reviewers know what the tool does (and does not do), its known failure modes, and any constraints (e.g., non-deterministic outputs).

Client transparency: Consider whether engagement letters or matter communications should address AI-assisted review, especially where it affects staffing, billing, confidentiality, or cross-border data handling. Many corporate clients now request AI use disclosures and audit rights.

Logging, traceability, and reproducibility

Document review must be defensible. When GenAI is used, defensibility hinges on being able to show: what data was processed, which prompts or configurations were used, and who approved outputs. Build procedures for:

• retaining prompt and output logs (with access controls),

• versioning the model/tool configuration per matter,

• capturing reviewer decisions and overrides, and

• preserving an audit trail suitable for litigation challenges.

Step 3: Align EU AI Act compliance with GDPR (a must for document review)

For German law firms, the GDPR is often the harder operational constraint because document review commonly involves personal data (employees, counterparties, witnesses) and sometimes special category data. EU AI Act compliance does not replace GDPR; you must do both.

Lawful basis and purpose limitation

Identify the lawful basis for processing (often Art. 6(1)(f) legitimate interests, Art. 6(1)(b) contract, or where applicable Art. 6(1)(c) legal obligation), and ensure AI use stays within the purpose for which the documents were collected/processed. Avoid “function creep,” such as using litigation documents to improve a vendor’s model unless you have a robust legal basis and contractual controls (and, in many cases, client consent is still not enough if secrecy obligations are implicated).

DPIA and risk assessment (often necessary)

Where GenAI introduces new risks—large-scale processing, sensitive data, novel technology, or profiling-like inferences—a Data Protection Impact Assessment (DPIA) may be required. Even if you conclude a DPIA is not mandatory, documenting a structured assessment is prudent and supports the AI Act’s governance expectations.

Data minimization and redaction-by-design

Implement technical steps to avoid exposing unnecessary information to the model:

• redact identifiers where feasible (names, addresses, HR IDs),

• use scoped prompts (ask for clause extraction, not “analyze everything”),

• limit context windows to relevant portions, and

• avoid uploading entire mailboxes when a targeted subset suffices.

International transfers and hosting location

If your AI vendor processes data outside the EEA (or uses sub-processors that do), you must address GDPR transfer rules (e.g., SCCs, transfer impact assessment, and supplementary measures). Many German law firms prefer EU-hosted instances for eDiscovery/GenAI to reduce transfer risk and align with client expectations.

Step 4: Protect professional secrecy and confidential client information

German attorneys have strict professional secrecy duties, and breaches can have disciplinary and legal consequences. GenAI tools can increase risk if prompts or documents are stored, used for training, or accessed by unauthorized persons.

Key confidentiality controls for GenAI document review

Contractual “no training” and use limitations: Your vendor contract should clearly prohibit using client data to train or fine-tune shared models, unless explicitly approved under controlled conditions.

Segregation and tenant isolation: Require technical segregation per customer and, ideally, per matter, especially for sensitive investigations.

Access control and least privilege: Restrict who can run GenAI analysis, export outputs, or view logs. Tie access to matter teams.

Retention and deletion: Define retention periods for prompts, embeddings, and outputs, and verify deletion mechanisms.

Incident response: Ensure the vendor provides prompt notification, cooperation, and forensic detail if there is any security incident affecting your data.

Step 5: Vendor due diligence and contracting under the AI Act

Because most law firms rely on third-party tools, compliance depends heavily on procurement discipline. A “GenAI add-on” to an existing review platform should trigger a refreshed assessment.