When law firms adopt AI tools, the evidence question is rarely about compliance

A rollout, not a compliance exercise

Fieldfisher, a European law firm, is rolling out the Legora AI platform firm-wide to around 1,400 lawyers and staff.^[1] The deployment follows a six-week pilot with 137 users in the firm's UK and European offices. Legora is designed for legal research, drafting and document review, the sort of tasks that take up most of a junior lawyer's day.

The announcement itself is short on regulatory language. There is no mention of the AI Act, no talk of compliance and no suggestion that the firm had to do this to meet a legal deadline. That's because it didn't.

Why legal AI is not high-risk

The AI Act divides AI systems into risk categories. High-risk systems, listed in Annex III or covered by existing product safety rules in Annex I, face strict requirements: technical documentation, logging, human oversight, accuracy thresholds and regular audits.^[2] Those requirements apply from 2 August 2027 for systems under Annex I and from 2 December 2027 for systems under Annex III.

AI tools used by law firms to draft contracts, summarise case law or review disclosure documents do not fall into either annex. They are not used to assess people for jobs, credit, insurance or benefits. They don't determine access to education or essential services. They aren't safety components in machinery or medical devices. They assist lawyers in doing what lawyers have always done: advising clients, preparing documents and building cases.

That means the high-risk requirements in Articles 9 to 15 of the AI Act do not apply.^[3] A law firm using an AI research tool does not have to keep logs under Article 12, does not need a risk management system under Article 9 and does not have to notify a supervisor before putting the system into service.

Think of a spell checker

A legal AI tool used internally is, in evidential terms, more like a spell checker than a flight recorder. You use it to draft a letter or review a contract, but the thing you send to the client is still your letter, checked and approved by you. If the advice turns out to be wrong, you are responsible, not the spell checker.

The AI Act sees it the same way. If a law firm uses an AI tool to help draft a settlement agreement and the agreement later turns out to have been poorly worded, the client's complaint is with the law firm, not with the software. The firm's professional indemnity insurance covers the mistake, just as it would if a junior associate had drafted the clause by hand.

The evidence question remains

Just because the AI Act doesn't require logs doesn't mean a law firm has no reason to keep them. Professional negligence claims, disputes over fees and regulatory investigations can all turn on what advice was given, when and on what basis.

Say a client claims the firm advised them to accept a settlement offer that the AI tool had flagged as unusually one-sided. The firm says no such flag appeared. Without a record of what the tool actually showed, the argument becomes a matter of memory and screenshots. A sealed log of what the AI suggested, and when, would settle the question in minutes.

The same reasoning applies to version control. Say a contract is signed in March and disputed in November, and the client's copy contains a clause the firm says was never in the final version. Being able to show which version was sent, and when, is not a compliance duty. It's a practical advantage.

What this means for you

If you run a law firm or manage its technology, here are three questions worth asking now:

• Could you show what your AI tool suggested on a particular matter six months ago, if a client questioned your advice?
• Do you have a record of which version of a document you sent, and when, separate from whatever the client kept?
• If a regulator or an insurer asked what role AI played in a piece of work, could you answer precisely, or would you be reconstructing it from memory?

None of these questions is about meeting the AI Act's high-risk requirements, because those requirements don't apply. They are about being able to show, later, what actually happened.

A digital witness for what the AI did

Here, the thing to seal is each piece of AI-generated output as it is reviewed: the query sent to the tool, the model version, the result it returned and the lawyer's decision to use, amend or discard it. Sealing takes a fingerprint of the record, not the record itself, so the advice and the client's details never leave your systems.

If a piece of advice is questioned a year later, anyone you share the sealed record with—your insurer, your regulator, an expert witness—can check that it is exactly what was recorded on the day. The check takes seconds and works without trusting whoever kept the log.

What it doesn't do is show that the advice was sound, that the clause was well drafted or that the lawyer made the right call. It shows what the AI tool said and what the lawyer did with it, unchanged since it was sealed.

You can seal records through WitniumChain's REST API, SDK or MCP server. The content stays with you; only the fingerprint is sent. The first 2,000 witnesses a month are free. Read the docs to see how it works.

How it would work

1. The AI tool generates a summary or a draft clause. Your system sends a fingerprint of the output, the query and the metadata (model version, timestamp, matter reference) to WitniumChain and gets a witness ID back.
2. The lawyer reviews the output, marks it as used, amended or discarded, and that decision is sealed as well.
3. If the work is questioned later, you share the sealed record with the person asking. They calculate the fingerprint and compare it with the sealed one. If it matches, nothing has changed.

What to watch

The AI Act's transparency requirements in Article 50 do not apply to AI tools used internally by professionals, but they do apply to AI systems that interact directly with the public.^[4] If your firm ever puts a client-facing chatbot on its website, Article 50 will require you to tell people they are talking to an AI. That disclosure has applied since 2 August 2026.

For tools like Legora, used by lawyers to do their own work, no such disclosure is needed. The regulatory deadline to watch is not an AI Act deadline. It is the ordinary limitation period for a negligence claim, which in most jurisdictions runs for several years from when the client should reasonably have discovered the problem.

Sources

1. Legal Technology, "Fieldfisher rolls out Legora firm-wide", 5 November 2026, https://legaltechnology.com/fieldfisher-rolls-out-legora-firm-wide/
2. Regulation (EU) 2024/1689 (AI Act), Annex III: High-risk AI systems, https://eur-lex.europa.eu/eli/reg/2024/1689/oj
3. Regulation (EU) 2024/1689 (AI Act), Articles 6 and 9 to 15, https://eur-lex.europa.eu/eli/reg/2024/1689/oj
4. Regulation (EU) 2024/1689 (AI Act), Article 50: Transparency obligations for certain AI systems, https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-50