Can law firms use ChatGPT or Claude without risking attorney-client privilege?

No. US v. Heppner (SDNY, Feb. 2026) ruled that documents created using Anthropic's Claude and shared with a lawyer were not protected by attorney-client privilege, as cloud AI platform privacy policies disclose inputs to third parties. AI IBIZA builds private AI that runs inside your firm with no cloud dependency, designed to remove this risk.

Is using ChatGPT with client data GDPR compliant for law firms in Europe?

Processing personal client data through public AI services raises documented concerns under GDPR — particularly around international transfers (Schrems II), the need for an Article 28 data processing agreement on the appropriate tier, confidentiality of legally privileged material, and limited control over retention and training use. Several European bar associations and regulators have issued guidance urging caution. AI IBIZA addresses these concerns at the architectural level by running private AI on hardware inside the firm — data stays on-premise by design.

What is private AI for law firms?

Private AI for law firms means a complete AI system — language models, automation, document analysis — running on hardware inside your office. No cloud AI exposure, no vendor access to client data. Client data never leaves your building. AI IBIZA installs and supports these systems for law firms worldwide.

What does AI IBIZA's private AI for law firms actually do?

DESPACHO, AI IBIZA's law-firm system, provides five capabilities: clause-by-clause contract review, legal research across the firm's own documents plus EU and Spanish regulatory sources, 24/7 client intake and conflict checking, template-based document drafting, and compliance monitoring — all running on hardware the firm owns, with no cloud AI exposure.

> aiibiza.com·Insights

AI IBIZA · 19 August 2026

EU & Spain AI Regulatory Calendar: Every Confirmed Deadline

Short answer: The table below lists every EU AI Act deadline currently confirmed in force or in law, plus Spain-specific developments, in chronological order. It distinguishes dates that are confirmed and binding from developments that are proposed but not yet adopted — a distinction a lot of AI Act commentary collapses, especially after the July 2026 Digital Omnibus moved several dates that earlier articles still describe as fixed.

Last reviewed: 19 August 2026. This page will be updated as new dates are confirmed, amended, or adopted — check the "last reviewed" date above before relying on any figure here for a filing or compliance decision, and verify against the primary sources linked below.

> Confirmed and already in force

Date	What applies	Detail
2 February 2025	EU AI Act prohibited practices (Article 5)	Certain AI uses banned outright across the EU.
2 August 2025	GPAI model obligations begin	New general-purpose AI models placed on the market from this date must comply.
18 February 2026	AEPD agentic AI guidance published	81-page Spanish guidance on GDPR risks specific to autonomous AI agents.
27 July 2026	Digital Omnibus on AI enters into force	Defers high-risk system obligations (see below); does not touch Article 50.
2 August 2026	EU AI Act Article 50 transparency duties	AI-interaction disclosure and AI-generated-content labeling. Not deferred by the Omnibus.
2 August 2026	GPAI enforcement powers activate	Fines up to €15M or 3% of global turnover for non-compliant GPAI providers.

> Confirmed, still ahead

Date	What applies	Detail
2 December 2026	Article 50(2) watermarking deadline	Narrower technical implementation window, separate from the general Article 50 disclosure duty already live since August 2026.
2 August 2027	Legacy GPAI models must comply	Models placed on the market before 2 August 2025 lose their grace period.
2 December 2027	High-risk obligations — Annex III standalone systems	Recruitment, credit scoring, education, law enforcement and similar standalone high-risk categories. Deferred from the original 2 August 2026 date by the Digital Omnibus.
2 August 2028	High-risk obligations — Annex I embedded systems	AI embedded in products already covered by EU product-safety law (medical devices, machinery). Deferred by the Digital Omnibus.
2 August 2030	Pre-existing high-risk systems used by public authorities	Legacy systems in public-sector use must reach compliance.

> Spain-specific — confirmed activity, law not yet passed

Date	What happened	Status
June 2024	AESIA (Spain's AI supervisory agency) becomes operational	In force — AESIA already runs sandbox cohorts and preliminary investigations.
26 May 2026	Council of Ministers approves draft Organic Law on AI governance	Approved as a bill, not yet enacted.
12 June 2026	Published in the Official Journal of the Parliament	Formal parliamentary process begins.
30 June 2026	Amendment period closes	Bill remains in committee as of this page's last review.
Pending	Organic Law enters into force	Would codify AESIA's sanctioning power — up to €35M / 7% of turnover for the most serious infringements. Not yet law. See our dedicated article on AESIA and the Organic Law.

> Proposed, not yet adopted — do not treat as binding

Development	Status	Detail
EU "Data Omnibus" (GDPR / ePrivacy / NIS2 / DORA)	In negotiation, not adopted	Proposed: 96-hour breach notification (up from 72h), single-click cookie consent with a 6-month refusal moratorium, one EU-wide DPIA list replacing 27 national lists. Realistic adoption window is late 2026 into 2027, not confirmed.

> Sources

AI IBIZA builds local-first, self-hosted AI systems designed around this regulatory environment — for law firms and gestorías in Spain, and firms elsewhere in the EU. See Private AI for Law Firms, Private AI for Despachos, or Private AI for Gestorías.