AI, professional secrecy and a client’s documents.

Article 66-5 of the French Act of 31 December 1971 brings all the documents in a lawyer’s case under professional secrecy Source [1]. According to the Paris Bar, information intended for a funder can only come from the client Source [2] Source [3]. The GDPR then governs the processing of the personal data they contain, artificial intelligence tools included Source [4]. In September 2024, the French National Bar Council asked lawyers never to share data covered by that secrecy with a generative AI Source [5].

The reference texts.

What professional secrecy covers.

Article 66-5 of Act no. 71-1130 of 31 December 1971, in the version in force since 30 March 2011, sets the scope of the secrecy Source [1]. In all matters, whether in advice or in defence, it covers the consultations a lawyer sends to a client or intends for them. Correspondence between client and lawyer is covered too, as is correspondence between lawyers, except letters marked official. The secrecy extends to interview notes and, more generally, to all the documents in the case.

The National Bar Council spells out its reach in article 2 of the national rules of the legal profession (RIN) Source [6]. The lawyer is the client’s necessary confidant, and this secrecy, a matter of public policy, is general, absolute and unlimited in time. It applies whatever the medium, physical or digital, and also protects clients’ names and the lawyer’s diary.

Article 2.3 of the RIN requires lawyers to ensure that their staff, and anyone who works with them in their professional activity, respect the secrecy. They answer for any breach committed in this way Source [6]. Under article 226-13 of the French Criminal Code, disclosing secret information held by virtue of one’s profession is punishable by one year’s imprisonment and a €15,000 fine Source [9].

The client’s consent does not lift this secrecy. A report presented to the Paris Bar in 2017 recalls that a lawyer cannot disclose what they know, even when the client releases them from secrecy Source [3].

What a client passes on to a funder.

On 21 February 2017, the Paris Bar Council adopted a resolution on third‑party funding of lawsuits Source [2]. It considers the practice favourable to the interests of litigants and of Paris lawyers, particularly in international arbitration. The lawyer of a funded party owes their professional duties to their sole client, the funded party, and takes instructions only from that party.

The resolution asks the lawyer to refrain from passing any kind of information about the case to the funder. The lawyer must also avoid any meeting with the funder when the client is absent Source [2].

The report presented with this text to the Bar Council sets out a principle: the lawyer cannot communicate directly with the funder Source [3]. The rule applies whatever the funding agreement says and whatever the client asks. The report concludes that disclosure to the funder of information about the proceedings and the facts behind them can only come from the client.

The client therefore chooses what to hand over: their contract, their exchanges with the other side, the evidence of their loss. The secrecy of article 66-5 binds the lawyer, and a third‑party funder does not practise that profession. What the funder does with the personal data it receives falls under the GDPR, and the agreement signed with the client sets out its other commitments.

In the Swiss franc loan programme, the borrower submits their documents online, and ACTIVE AVOCATS, a firm of the COGEP AVOCATS group, conducts the proceedings. Our privacy policy states that these documents “can be accessed by ACTIVE AVOCATS and by the Hello Justice team handling the case, in accordance with professional secrecy” Source [10]. Nothing is sent to the bank while the case is being reviewed. Hello Justice funds the case and plays no part in the firm’s strategy.

The GDPR and the provider that processes the documents.

The documents in a case contain personal data: names, addresses, financial circumstances. Regulation (EU) 2016/679, the GDPR, applies to their processing, whatever the tool used Source [4]. Where a provider processes them on behalf of a law firm or a funder, article 28 requires the controller to “use only processors providing sufficient guarantees to implement appropriate technical and organisational measures”.

A contract binds the processor to the controller. The provider processes the data “only on documented instructions from the controller”, and the people authorised to process it commit to confidentiality. It does not engage another processor without prior written authorisation, and it deletes or returns the data at the end of the service Source [4].

Article 32 requires the controller and the processor to ensure “a level of security appropriate to the risk”. It mentions “the pseudonymisation and encryption of personal data”, the confidentiality and resilience of systems, and regular testing of the measures taken Source [4].

The National Bar Council’s recommendations.

In September 2024, the National Bar Council’s working group on artificial intelligence published a practical guide to using generative AI systems Source [5]. It sets a first rule: a lawyer must never communicate data covered by professional secrecy to generative AI, on pain of sanctions. The guide therefore excludes from any request the client’s name, the confidential information the client has shared, the case strategy and any attachment from the case that contains them.

To use these tools without exposing the secret, the guide recommends pseudonymisation. Fictitious initials take the place of names, and a wider geographical area that of an address. It warns that cross‑referencing several pieces of data can be enough to identify a client, and notes that the technique does not suit every task Source [5].

In June 2025, the same working group published an assessment grid for legal AI tools Source [11]. Its prerequisite is that the tool does not reuse data to train the large language models it relies on. It then ranks the sovereignty criteria, starting with where client data is hosted and the nationality of the company that owns the servers. Finally, it observes that a publisher’s assurance that data will not be reused is generally neither provable nor verifiable.

On 17 March 2026, the National Bar Council announced the adoption of a guide on professional ethics and artificial intelligence Source [12]. According to the announcement, the guide recalls the profession’s core requirements: protecting professional secrecy, complying with the GDPR, competence, prudence, independence, information and balanced fee‑setting.

The European regulation on artificial intelligence.

Regulation (EU) 2024/1689 of 13 June 2024 lays down harmonised rules on artificial intelligence Source [7]. Regulation (EU) 2026/1744 of 8 July 2026, the “Digital Omnibus on AI”, amended it with effect from 27 July 2026 Source [8]. The 2024 regulation defines a deployer as a natural or legal person or other body “using an AI system under its authority”, except in a personal non‑professional activity. A law firm or a funder that uses such a tool in its business meets that definition Source [7].

Article 4 has applied to providers and deployers since 2 February 2025. In its 2026 wording, they take measures “to support the development of AI literacy” of the people who operate and use these systems on their behalf Source [8]. They do not have to guarantee a specific level for each individual. The regulation leaves the GDPR intact: it “shall not affect Regulation (EU) 2016/679”, subject to two of its articles Source [8].

Annex III classes as high‑risk the systems intended for judicial authorities, or used on their behalf, “to assist a judicial authority in researching and interpreting facts and the law and in applying the law to a concrete set of facts” Source [7]. Since the 2026 amendment, the corresponding obligations apply from 2 December 2027, instead of 2 August 2026 Source [8]. Recital 61 adds, for judges, that “the final decision‑making must remain a human‑driven activity”.

The funding opinion and automated decisions.

Article 22 of the GDPR gives everyone “the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her” Source [4]. It allows three exceptions, including a contract and explicit consent. In those two cases, the person keeps at least the right to obtain human intervention.

At Hello Justice, artificial intelligence models help the team. According to our privacy policy, they “read case documents to pick out the figures” and help draft reports, and the team then reviews their output Source [10]. The policy states that “each funding opinion is given by a member of the team, and no score is given to a person or a case”. It also names each provider that receives data, its role, its location and the basis for transfers outside the Union.

Before any funding, a specialised partner lawyer analyses the case’s eligibility: the features of the dispute, the limitation period, the completeness of the documents and reasonable prospects of success. Not every case is accepted. The eligibility test gives a first indication, and the lawyers page describes the tripartite agreement signed by the client, their lawyer and Hello Justice. Our guide to litigation funding explains how the mechanism works.

Frequently asked questions.

Can a lawyer give a client’s documents to a generative AI?

The National Bar Council’s September 2024 guide asks lawyers never to communicate data covered by professional secrecy to generative AI, and advises them to pseudonymise what they do send Source [5]. For legal AI tools, the June 2025 grid requires at the very least that they do not reuse data for training Source [11]. The GDPR also requires a contract with the provider and security appropriate to the risk Source [4].

Can a funder see the exchanges between a client and their lawyer?

These exchanges are covered by professional secrecy, and the lawyer cannot disclose them, even with the client’s consent Source [1] Source [3]. The Paris Bar asks the lawyer not to pass any information about the case to the funder Source [2]. Whatever the funder receives comes from the client.

Does an AI decide whether Hello Justice funds a case?

No. Under our privacy policy, a member of the team gives each funding opinion, and no score is given to a person or a case Source [10]. Artificial intelligence models pick out the figures in the documents, and the team reviews their output.