Can law firms use ChatGPT or Claude without risking attorney-client privilege?

No. US v. Heppner (SDNY, Feb. 2026) ruled that documents created using Anthropic's Claude and shared with a lawyer were not protected by attorney-client privilege, as cloud AI platform privacy policies disclose inputs to third parties. AI IBIZA builds private AI that runs inside your firm with no cloud dependency, designed to remove this risk.

Is using ChatGPT with client data GDPR compliant for law firms in Europe?

Processing personal client data through public AI services raises documented concerns under GDPR — particularly around international transfers (Schrems II), the need for an Article 28 data processing agreement on the appropriate tier, confidentiality of legally privileged material, and limited control over retention and training use. Several European bar associations and regulators have issued guidance urging caution. AI IBIZA addresses these concerns at the architectural level by running private AI on hardware inside the firm — data stays on-premise by design.

What is private AI for law firms?

Private AI for law firms means a complete AI system — language models, automation, document analysis — running on hardware inside your office. No cloud AI exposure, no vendor access to client data. Client data never leaves your building. AI IBIZA installs and supports these systems for law firms worldwide.

What does AI IBIZA's private AI for law firms actually do?

DESPACHO, AI IBIZA's law-firm system, provides five capabilities: clause-by-clause contract review, legal research across the firm's own documents plus EU and Spanish regulatory sources, 24/7 client intake and conflict checking, template-based document drafting, and compliance monitoring — all running on hardware the firm owns, with no cloud AI exposure.

> aiibiza.com·Insights

AI IBIZA · 19 August 2026

The EU AI Act's August 2026 Deadline: What Actually Applies After the Digital Omnibus

Short answer: August 2, 2026 was originally the deadline for EU AI Act high-risk system obligations (Articles 8–15 for providers, Article 26 for deployers). The Digital Omnibus on AI — approved by the European Parliament on June 16, 2026, given final Council adoption on June 29, 2026, and in force since July 27, 2026 — pushed that deadline back: standalone high-risk systems under Annex III now have until December 2, 2027, and high-risk AI embedded in products already covered by EU product-safety law (Annex I) has until August 2, 2028. But one major deadline was not moved: Article 50 transparency obligations — disclosing that a person is interacting with an AI system, and labeling AI-generated or manipulated content — took effect on schedule on August 2, 2026, and national market surveillance authorities can enforce them from that date.

> Why this is easy to get wrong right now

A lot of compliance content published before mid-2026 still describes August 2, 2026 as the date high-risk AI obligations become binding across the board. That was accurate when written. It stopped being accurate once the Digital Omnibus was signed on July 8, 2026 and entered into force on July 27, 2026 — a few weeks before the original deadline would have landed. Anyone relying on older guidance now has two separate, easy-to-conflate deadlines to track instead of one.

> What actually got deferred

Annex III standalone high-risk systems (AI used in areas like employment decisions, access to essential services, credit scoring, education, and law enforcement) — obligations deferred from August 2, 2026 to December 2, 2027.
Annex I high-risk systems embedded in already-regulated products (machinery, medical devices, and similar categories with existing EU product-safety regimes) — deferred to August 2, 2028.

> What did not get deferred

Article 50 was excluded from the Omnibus's deferrals and took effect as originally scheduled:

Disclosure that a person is interacting with an AI system (rather than a human), where that isn't already obvious from the circumstances — applies from August 2, 2026.
Deployer-side disclosure of AI-generated or manipulated content ("deepfake" disclosure) — applies from August 2, 2026.
Watermarking of AI-generated content under Article 50(2) has its own, slightly later implementation runway to December 2, 2026 — a narrower technical deadline separate from the general disclosure duties above.

> What this means in practice

For most firms outside the specific high-risk-use-case list, the immediate, enforceable obligation right now is Article 50 transparency, not the high-risk system requirements that dominate most AI Act commentary. If your firm deploys any AI-facing tool that interacts with clients or the public — a chatbot, an AI-drafted communication, an AI-generated document — the disclosure duty is live today, regardless of whether the underlying system would ever have qualified as "high-risk" under Annex III or Annex I. The high-risk deferral is real relief for firms building or deploying those specific categories of system, but it doesn't touch Article 50, and it doesn't change any Member State's separate GDPR or sector-specific obligations running in parallel.

> Sources

AI IBIZA builds private AI systems for law firms, gestorías and professional services in Spain and worldwide. See Private AI for Despachos, Private AI for Gestorías, or Private AI for Law Firms.