Your law firm is an SME with a problem others don't have (and it has a method)

A law firm cannot digitize like any other SME: its files contain third-party secrets protected by professional privilege, and uploading a client document to a free AI chat means that information leaves the firm for an external server, under terms of service that are rarely suitable. The alternative is not to give up on AI, but to reverse the direction of the journey — the 'your knowledge doesn't cross' principle: bring AI capabilities to where the firm's knowledge resides, instead of taking the files to where the AI is. In this article: what exactly happens when you upload a document, the architectural principle, the four steps to get started this week without exposing a single file, and the script to draft an AI policy in an afternoon.

The SME that keeps others' secrets

I've been writing about SME digitization for years, and there's one difference that changes everything. When a store digitizes its inventory, it risks its own information. When you upload a work document to a tool, you risk your client's.

Your files are not just data: they are others' secrets. The duty of confidentiality imposed by law and your ethics does not distinguish between 'I told it in a bar' and 'I uploaded it to a server I don't control.' And the circular that the Legal Profession approved this year regarding the use of AI goes exactly along those lines: the tool changes; the duty does not.

What exactly happens when you upload a document to a free chat?

Three things, and it's best to say them without dramatizing but without sugarcoating:

1 · The document leaves your office. It travels to a server that isn't yours, in a jurisdiction you probably haven't chosen.

2 · It is subject to terms of service that almost no one reads — and free versions often include usage restrictions that are not suitable for a law firm.

3 · You lose control. And professional confidentiality is, in essence, an obligation to control. Nothing might happen. But 'nothing might happen' is not a professional standard: it's a hope.

The Principle: Your Knowledge Doesn't Cross

The solution is not to give up on AI. It's to reverse the direction of the journey.

The usual approach takes your documents to where the intelligence is. The sensible approach brings the intelligence to where your knowledge is — and your knowledge stays where it was.

Because what's valuable about your firm isn't the trendy model. It's your templates refined over twenty years, your criteria, the briefs that have already won. That patrimony is both your competitive advantage and your responsibility. It shouldn't travel. By design, not by promise.

How to Start This Week Without Uploading a Single File

Four steps. All four are free:

1 · Separate your knowledge into two boxes. Red box: Confidential — client files, data, and any identifying information. Safe box: Shareable — data-free templates, work guidelines, and public texts. A ten-minute whiteboard session is often more valuable than any software.

2 · Write the rule. Clear boundaries, in writing and dated. This is the cornerstone of your AI policy — the complete guide is further down in this article.

3 · Practice only in a sandbox environment. Ask the AI to improve a template, reorder criteria, or propose the structure for a typical document. You'll discover the tool's full capabilities without compromising anyone's confidential information.

4 · When anything involves real-world data, demand formal documentation. Where they are processed, if they are used for training, who can view them, how they are deleted — under contract, not merely by word of mouth. And keep a record of what you decided: due diligence that leaves no trace never happened.

The AI Policy, in an Afternoon (the script)

Four points, draftable in an afternoon:

1 · What tools can be used and which ones cannot.

2 · Information NEVER uploaded, starting with client files.

3 · Every quote is verified from the source before signing.

4 · Who is responsible — the professional, always.

This isn't bureaucracy: it's what protects you the day an associate uses AI on their own.

The Phrase That Should Make You Suspicious

"Your data is safe" is not an answer. It's a slogan. A serious answer is defined by a contract and an architecture: it specifies where, who, until when, and how it is audited. If the provider cannot provide that level of detail, they have already responded.

What I'm building (and why this edition exists)

For months, I've been building, with a select group of law firms and administrative consultancies, a workflow system where this principle is not a commercial promise but its very architecture: AI works with your knowledge—your templates, your criteria—without your case files ever leaving your office, and with every assertion anchored to its official source.

Frequently Asked Questions

Can I upload client documents to ChatGPT or another AI chat?

You shouldn't, especially with free versions: the document leaves your office for an external server, becomes subject to terms of service that are rarely favorable, and you lose control over information protected by professional confidentiality. If a use case requires handling real data, the approach must be contractual: specifying in writing where it will be processed, if it will be used for training, and how it will be deleted.

What does the principle 'your knowledge isn't transferable' mean?

Reversing the direction of travel: instead of taking the firm's documents to where the AI is, bring the AI's capabilities to where the firm's knowledge resides — templates, criteria, model documents — so that case files do not leave. This is an architectural criterion for evaluating any tool, not a brand.

Is anonymizing the documents enough to upload them?

Reduces risk, but doesn't eliminate it: effective pseudonymization is harder than it seems, re-identification through context is real, and the professional's duty of secrecy remains. That's why the method begins with the 'safe box' (data-free templates, criteria, public texts), not with superficially altered records.

What should an AI policy for a small firm include?

Four points, draftable in an afternoon: which tools are permitted and which are not; what information must never be uploaded (starting with client records); the rule that all citations must be verified against the official source before final approval; and who is accountable — the professional, always. In writing and dated: this offers protection should someone use AI independently.

What should I require by contract from an AI provider?

At a minimum: where data is processed (jurisdiction), whether it's used for training (and the option to opt out), who can access it, deletion timelines and methods, and what data is retained. "Your data is safe" is a slogan; a serious answer is contractual and verifiable.

Sources for this article

• Circular 3/2026 of the General Council of the Spanish Bar (use of AI in the legal profession).
• Official note from the Judiciary (Canary Islands High Court ruling, as part of the series)
• From this series: the case of the 48 non-existent rulings and the AI Act for law firms, no-nonsense.

Sources verified on Jul-6-2026. This blog doesn't ask for faith: it links to the source.

Every two weeks I publish an analysis like this in the PYME Digital PRO newsletter: digitalization for law firms, consultancies, and professional SMEs, without the hype. Subscribe on LinkedIn.