AI for French Lawyers: Is Professional Secrecy at Risk?

The answer fits in one line. AI can help you shape a de-identified draft, but never hand it your client's file. A client's name. A procedural document. Anything that identifies a party. Pasted into a consumer AI, these details leave your firm. That is a disclosure to a third party. Yet the French lawyer's secret professionnel is one of the strongest duties in French law. And under the GDPR, you remain the data controller for your clients' data. There is a clean method: anonymise before any prompt, then restore the values locally.

Secret professionnel: general, absolute, unlimited

The legal basis is solid. Article 66-5 of the law of 31 December 1971 sets the lawyer's secret professionnel. It covers consultations, correspondence, case documents and information entrusted by the client. The Conseil national des barreaux (CNB), the body that represents the profession, states it firmly. This secrecy is general, absolute and unlimited in time. No information-processing tool justifies setting it aside.

The sanction is not only disciplinary. Article 226-13 of the Criminal Code punishes disclosing secret information. The penalty runs up to one year in prison and a 15,000-euro fine. On top of that come bar proceedings, which can go as far as disbarment. So secrecy is not a mere formality. It is a duty whose breach is costly.

Pasting a file into an AI is a disclosure to a third party

The reasoning is direct. A consumer AI is a third-party service. Pasting a client's name or a document into it means passing entrusted information to an outside actor. That information can be retained, reviewed or reused to train the model. The CNB warns about this precise point. Sending confidential data to a generative AI without sufficient safeguards exposes the lawyer to a double risk: breach of secrecy and breach of data protection law.

A file concentrates exactly this sensitive data. Here is what a poorly prepared prompt can expose.

• The client's name and contact details, and those of opposing parties.
• The case reference and the docket number of the matter.
• The facts entrusted, the documents, the protected correspondence.
• The personal data of third parties named in the file.

The GDPR adds to the secrecy duty. For a client's data, the lawyer is the data controller. The CNIL, France's data protection authority, is clear on this. The GDPR applies fully to processing carried out through AI systems. The technology's innovative nature opens no exception. The CNIL helps qualify each actor's role: controller, joint controller or processor. It also sets requirements of purpose, minimisation and verification.

AI hallucinations: a documented legal risk

The second risk is reliability. A generative AI can invent a ruling, a reference, a citation. This is called a hallucination. In legal work, the consequence is serious. Courts have already sanctioned lawyers for it.

The best-documented cases come from the United States. In Mata v. Avianca, in 2023, lawyers filed a brief riddled with case citations entirely invented by a generative tool. Fines followed, notably in California. The lesson holds for France too. Any AI output demands systematic human verification. A lawyer stays responsible for what they sign.

The fix: anonymise before any prompt

Good news: AI is still useful at the firm. It helps structure an argument. It rewrites a paragraph, suggests an outline, clarifies a concept. For that, it needs no real name. Work on a de-identified draft. Keep names, parties and identifying details out of the prompt.

When you must describe a concrete case, anonymise it first. Replace each identifying element with a token. The AI reasons about the shape of the file, without ever seeing the real values. You then restore the real data, locally. The secret never leaves your machine. This caution is in line with professional ethics.

1. 1Spot the identifying elements: names, parties, reference, documents.
2. 2Replace them with reversible tokens, in the browser.
3. 3Send only the anonymized text to the AI.
4. 4Restore the real values in the reply, locally, then verify every citation.

That's what ONYRI Sanitize is for. The engine detects sensitive data — names, contact details, references, amounts — and replaces it with reversible tokens before sending. Detection and the mapping stay in your browser. Only anonymized text reaches the model. The AI finds only tokens, never your clients' identity. You get AI's help, without exposing the secret professionnel that the CNB and the law ask you to preserve.