On 27 March 2026 the Council of Bars and Law Societies of Europe (CCBE) published a technical guide on the use of AI tools and models by lawyers. That guide builds on the earlier CCBE guide on generative AI of 2 October 2025 and makes explicit a shift that had been visible for some time: in our analysis, safe AI use in legal practice is less about cleverly phrasing prompts and more about whether a firm can demonstrate how it handles confidential data when AI comes into play.
For lawyers and notaries this is not a theoretical point. Professional secrecy, professional competence, independence and transparency towards clients are core obligations that do not cease to apply the moment an AI tool is opened. The recent guidelines pay explicit attention to data flows, contracts and verification.
What the CCBE guides describe
The CCBE guide of October 2025 describes how generative AI affects professional secrecy. The CCBE advises lawyers against entering personal, confidential or client-related data into a generative AI interface, unless appropriate technical and organisational safeguards are in place. The guide links this to the core obligations mentioned: confidentiality, competence, independence and transparency.
The technical guide of March 2026 then discusses how to assess a tool before deploying it on case work. Its key points:
- Analysis of data flows: what happens to input, storage and any training?
- Assessment of the provider's contracts and security measures.
- Preference for a confidentiality-safe deployment, for example enterprise or in-house solutions.
- Setting up verification processes in which AI output does not enter the case file unchecked.
The underlying lesson, in our assessment, is that AI use is above all a matter of configuration, data flows and contracts, not just tool choice. The CCBE guide from 2025 and the technical guide from 2026 stress that AI output must be verified where necessary before it is used in legal work.
Internationally the guidelines run in parallel
A comparable line can be found outside Europe. Singapore's Guide for Using Generative AI in the Legal Sector (Ministry of Law, March 2026) advises legal professionals to classify confidential information, to use only tools with appropriate security and data protection, and to carefully assess providers' privacy and training clauses. According to the guide, client names, case details and other sensitive data have no place on public platforms; with enterprise tools, data retention and model training should be under contractual and technical control.
The Advisory on the Use of Publicly Available AI Tools of the Law Society of Singapore (April 2026) goes further into public tools. These can expose privileged, proprietary and confidential data. The advisory discourages uploading such data, calls for anonymisation and redaction, advises members to check the privacy and training settings and to use opt-out where possible, and stresses that the provider's cybersecurity measures should meet relevant data protection standards.
The overview article Legal Profession Regulation in Europe: AML, AI and Bar Rules 2026 by Obsidian Regulatory Insights outlines a trend in which some European bars take the CCBE guidelines as a reference. On our reading of these sources, a common picture emerges: AI use is linked to existing compliance structures, clients are informed where relevant about AI use, and AI output is verified on the merits. We present this as our interpretation of several sources, not as an established pan-European rule.
From guideline to daily workflow
What does this mean, in our assessment, in concrete terms at case level? Several recurring principles emerge from the sources:
- Determine which data categories should better not enter a prompt unchanged — and ensure that sensitive data are anonymised or redacted beforehand.
- Know, for each tool used, the contractual arrangements on storage, retention and model training, and actively verify them.
- Treat AI output as a draft: no advice or deed without substantive, human review by the responsible legal professional.
- Record which tools were used, which data were processed and who verified the output.
That last point — demonstrability — is where the guidelines, in our analysis, place the greatest emphasis. The guidelines point to policy, access management, logging, output verification and audit trails as useful components of verifiable execution.
Where a verification console can support
It is precisely at this point of verifiable execution that, in our assessment, a privacy-focused verification console such as Vera has a role. The angle is emphatically execution and visibility, not magic. Vera is not a chatbot and not a language model of its own, but a verification layer around working with AI. Vera supports review and control; the professional final judgement remains with the legal professional.
The Semantic Privacy Shield is designed to anonymise documents on EU infrastructure before content is submitted to the selected AI models; if the privacy check fails, nothing is forwarded. In our analysis this aligns with the attention in the Singaporean advisory and the CCBE guides to not simply entering raw client data into an AI interface. Via the Privacy Shield and Vera Office, documents can moreover be viewed and edited within the same secure environment, with the user retaining control.
Multi-model verification makes the control steps visible instead of presenting one answer as the final answer. Importantly, this does not eliminate errors. It makes control possible and gives more insight into what happened, so that the professional final judgement remains with the legal professional. With an audit trail via the evidence function, a firm can help provide insight afterwards into which data were processed and how output was verified, which in our assessment aligns with the emphasis in the guidelines on verifiability.
The common thread in all the documents mentioned is, in our analysis, sober: AI can support legal work, but in our assessment above all within an explicitly designed and verifiable confidentiality and verification approach. For lawyers and notaries this has by now become less a question of innovation than a matter of professional responsibility.