The AI Act for law firms: what it requires and what it does not

The European artificial intelligence regulation has not been delayed. What was delayed in July 2026 were the obligations for high-risk systems, which arrive in December 2027 and August 2028. The rest stands: the prohibited practices and the duty to support your team’s training, applicable since February 2025, and the transparency obligations, since 2 August 2026. And for a law firm there is something that matters more than the dates: you are usually not the one developing the system but the one using it, and the obligations of the two roles are not the same.

The misunderstanding about the delay

In July, Regulation (EU) 2026/1744 was published, known as the digital Omnibus, amending the artificial intelligence regulation. Headlines spoke of a delay, and many people understood that everything had been postponed to 2027.

That is not what happened.

What was delayed are the requirements for high-risk systems. Those in Annex III move to 2 December 2027, and those embedded in already regulated products, in Annex I, to 2 August 2028.

What was not delayed is everything else. And «everything else» includes precisely what affects the everyday use of artificial intelligence in a business.

Date	What happens
2 February 2025	Already applicable: prohibited practices and the AI literacy duty
2 August 2025	Already applicable: governance, general-purpose model obligations and the penalty regime
27 July 2026	The digital Omnibus enters into force
2 August 2026	General date of application. Transparency obligations and market surveillance
2 December 2026	New prohibitions and end of the transition for certain synthetic content systems
2 December 2027	Requirements for the high-risk systems in Annex III
2 August 2028	Requirements for the high-risk systems in Annex I

It is worth being clear about this because the confusion has a practical effect: a firm that assumed it had until 2027 has had live obligations since August.

You do not build AI systems: you use them

This is the part almost nobody explains, and the one that changes things most.

The regulation distinguishes between whoever develops or markets an artificial intelligence system and whoever uses it. Most of the obligations fall on the former. Technical documentation, conformity assessments, risk management systems: all of that is the business of whoever builds the tool, not of whoever contracts it.

A firm using an AI tool to work with its own documents is in the second position, not the first.

That reduces considerably what applies to it. It does not remove it, but it reduces it. And knowing which side you are on is the first step towards not spending energy on obligations that are not yours.

There is one exception worth bearing in mind: if the firm develops its own tool, or customises it to the point of changing its purpose, the picture changes. But that is not the usual case.

What applies today to a firm that uses AI

There are 3 things, and none of them has been delayed.

Training the team

The regulation includes an artificial intelligence literacy duty affecting any organisation that uses it. It remains in force.

And it has a nuance that has been little reported: after the Omnibus, the obligation consists of adopting measures that support that training, not of guaranteeing that the team reaches a given level. That is an important difference, because it turns something hard to prove into something reasonable to comply with.

In practice: that the people in the firm know what the tool they use does, where its limits are and what they must not hand over to it. A documented internal session is worth more than a certificate.

Transparency

The transparency obligations have applied since 2 August 2026. For a law firm they have 2 frequent scenarios.

If there is a conversational assistant on the website, the visitor must know they are speaking to an automated system, unless it is obvious. And they must know it at the first interaction at the latest, not find out by reading the privacy policy. The regulation places this obligation on whoever provides the system, but it is the firm that puts it in front of its visitors, so it is worth checking that it is being met.

If images, audio or video constituting a deep fake are published, or texts generated with AI to inform the public on matters of public interest, it must be stated that they are artificial. In the case of texts, this is not required when they have been through human review or editorial control and someone assumes editorial responsibility for the publication.

What a firm does behind closed doors with its own documents does not come into this. This is about what is presented to third parties.

Not doing what is prohibited

The prohibited practices were never delayed and they are what you would expect: social scoring systems, certain biometric uses, manipulation. It is not territory a law firm usually moves in, but it is worth knowing it exists.

And what does not apply yet

The high-risk requirements. With one case that does come close to any firm that grows: using artificial intelligence to recruit staff is classified as a high-risk use, and therefore falls within the package delayed to December 2027.

Delayed does not mean advisable. It means the formal obligations arrive later, not that the bias problems in an automated screen have disappeared in the meantime.

What happens if you fail to comply, and who supervises

In Spain, the body called upon to supervise compliance is the Spanish Agency for the Supervision of Artificial Intelligence. The penalties provided for in the regulation reach, in the most serious cases, 7% of annual global turnover.

Those figures are designed for whoever develops and markets systems at scale, not for a 6-person firm. It is worth saying, because the headline about the multimillion-euro fine generates disproportionate alarm in someone who merely uses a tool.

But there is a route a lawyer has much closer to hand than any artificial intelligence authority: the professional conduct route.

The Bar Association and the General Council of Spanish Lawyers act on professional conduct independently of what any other body does. A brief filed without proper review, a client’s data handed over where it should not have been, a demonstrable lack of diligence: that is judged on its own ground and by its own rules, which existed long before the European regulation.

For most firms, that is where the real risk lies.

What is worth doing, obligation or not

There are 4 things: 3 are sensible and the other is an obligation.

Double-check before signing. Have whatever comes out of a tool reviewed by someone other than the person who asked for it. The regulation does not require this generally for this case, but it is a cheap practice that prevents the kind of error that costs most: the citation nobody checked because it looked right.

Record who reviews and who signs. No system is needed: it is enough that the firm is clear about who answers for each output that goes outside.

Train the team. This one is an obligation, and it is both the easiest to meet and the easiest to forget.

And say so in the engagement letter. A paragraph at the start of the client relationship settles a conversation that, if it arrives late, arrives badly.

If you are interested in the other side of this question —what information can be handed to an AI tool and under what safeguards—, we cover it in another article: Is it safe to use ChatGPT in a law firm? →

Sources

• Regulation (EU) 2024/1689, on artificial intelligence
• Regulation (EU) 2026/1744, digital Omnibus on AI, published in the OJEU on 24 July 2026
• Spanish Agency for the Supervision of Artificial Intelligence (AESIA)