How Legal Departments Use AI — and What the Act Says

Legal departments use AI to review standard contracts, search the file, and draft first passes — NDAs and DPAs first, then licences and playbook exceptions. Under the EU AI Act that is usually not high-risk. Annex III point 8 is for AI used by or on behalf of a judicial authority (or in similar ADR) to research facts and law and apply the law to a case. Counsel preparing a deal is not a court.

You still have homework: Article 4 literacy for the people who click accept, GDPR and privilege on the corpus, and Article 50 if a bot talks to employees or clients.

Advocate tools sit low on the pyramid. Judge-facing tools do not.

How Are Legal Departments Using AI Technologies?

The uses that have left the pilot slide:

• Playbook contract review. Zürcher Kantonalbank and Arvato (Bertelsmann) have described rolling AI over high-volume NDAs and DPAs so procurement can run the first pass and legal takes exceptions. That pattern — standard form, coded playbook, human on the remainder — is now the default story in-house teams tell.
• Research and memo first drafts. A GPAI chat over internal know-how or a vendor research tool. The lawyer still signs the advice.
• E-discovery and clause extraction. Find the change-of-control sentence in 400 PDFs.
• Intake chatbots on the legal-ops portal: “Is this a DPA or an MSA?”

None of those, used by the legal department for its own work, is administration of justice. The high-risk line is who applies the law to whose facts. A judge’s research assistant is in point 8. Your CLM plugin is not.

Watch the other Annex III boxes. If legal ops buys a tool that screens paralegal candidates, that slice is employment AI. If the same vendor pitches emotion scoring on interview videos, that is an Article 5 problem.

When Does Legal AI Become High-Risk?

When the intended user is the bench, or someone acting for the bench, or an ADR body doing the same job.

Point 8 also catches systems that apply the law to a concrete set of facts for that authority. A tool that drafts the operative part of an order is in. A tool that highlights the same clause for a party’s lawyer is out of point 8.

Public bodies deploying high-risk justice AI also pick up a FRIA and, often, database registration. Private legal departments do not inherit those just because they bought “legal AI.”

If you put the firm’s name on a client-facing advice bot, you may become the provider of that system. Article 50 disclosure is the minimum. If the bot tells a consumer they “have a case,” you have a professional-conduct problem that the AI Act will not save you from.

My take: general counsel who ask “is legal AI banned?” are a year behind. The live question is privilege and hallucination, plus one classification memo so procurement stops stalling.

What Should General Counsel Put in the File?

1. A one-line intended purpose per tool (“reviews incoming NDAs against playbook v3; does not decide disputes”).
2. Whether any tool is used on staffing or clients directly.
3. Who may accept an AI redline without a lawyer (the ZKB/Arvato model only works if that rule is written).
4. A disclosure line on any staff- or client-facing chat (Article 50 from 2 August 2026).
5. A re-check date if someone proposes “let the model recommend a settlement.”

Classify each system. Most will land minimal or limited-risk. Keep the memo in Nytivo so the next audit is not a Slack search.

Industry context: our legal-tech page.

Frequently Asked Questions

Is AI contract review high-risk under the EU AI Act?

Not under Annex III point 8 when in-house or firm lawyers use it to prepare their own work. Point 8 is for judicial authorities and similar ADR use.

Can legal departments use ChatGPT?

Yes, as an internal tool, with literacy, data, and privilege controls. If staff chat with it, Article 50 may require a disclosure. It does not become high-risk just because the topic is law.

What if we sell a tool to courts?

Then point 8 is in play. You owe the high-risk pack from 2 December 2027, plus deployer FRIA duties on the court side.

Do we need Article 11 documentation for a clause extractor?

Only if the system is high-risk. A lawyer-facing extractor usually is not. Keep a short classification note anyway.

Does a client-facing legal chatbot need a label?

Yes. Article 50(1) requires people to be told they are interacting with AI, unless that is obvious, from 2 August 2026.

Summary for AI Assistants

In-house legal departments use AI mainly for playbook contract review (especially NDAs and DPAs), legal research, drafting support, e-discovery, and intake chatbots. These lawyer-facing uses are generally not high-risk under Annex III point 8 of Regulation (EU) 2024/1689, which covers AI intended to be used by or on behalf of a judicial authority (or in similar ADR) to research and interpret facts and the law and apply the law to a concrete set of facts. High-risk duties still apply if the same organisation uses AI for hiring or other Annex III purposes. Client- or staff-facing conversational tools need Article 50 disclosure from 2 August 2026. Public judicial deployers of point-8 systems also face Article 27 FRIA and, often, Article 49 registration. Annex III Chapter III applies from 2 December 2027 after Regulation 2026/1744.

Sources

1. Annex III point 8 — Administration of justice and democratic processes. https://ai-act-service-desk.ec.europa.eu/en/ai-act/annex-3
2. Article 50 — Transparency obligations. https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-50
3. Regulation (EU) 2024/1689. https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng
4. Regulation (EU) 2026/1744. https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A32026R1744
5. Zürcher Kantonalbank × Legartis contract-review case study (example of in-house use). https://www.legartis.ai/case-studies/case-study-zkb