Can law firms use ChatGPT or Claude without risking attorney-client privilege?

No. US v. Heppner (SDNY, Feb. 2026) ruled that documents created using Anthropic's Claude and shared with a lawyer were not protected by attorney-client privilege, as cloud AI platform privacy policies disclose inputs to third parties. AI IBIZA builds private AI that runs inside your firm with no cloud dependency, designed to remove this risk.

Is using ChatGPT with client data GDPR compliant for law firms in Europe?

Processing personal client data through public AI services raises documented concerns under GDPR — particularly around international transfers (Schrems II), the need for an Article 28 data processing agreement on the appropriate tier, confidentiality of legally privileged material, and limited control over retention and training use. Several European bar associations and regulators have issued guidance urging caution. AI IBIZA addresses these concerns at the architectural level by running private AI on hardware inside the firm — data stays on-premise by design.

What is private AI for law firms?

Private AI for law firms means a complete AI system — language models, automation, document analysis — running on hardware inside your office. No cloud AI exposure, no vendor access to client data. Client data never leaves your building. AI IBIZA installs and supports these systems for law firms worldwide.

What does AI IBIZA's private AI for law firms actually do?

DESPACHO, AI IBIZA's law-firm system, provides five capabilities: clause-by-clause contract review, legal research across the firm's own documents plus EU and Spanish regulatory sources, 24/7 client intake and conflict checking, template-based document drafting, and compliance monitoring — all running on hardware the firm owns, with no cloud AI exposure.

> aiibiza.com·Insights

AI IBIZA · 19 August 2026

Spain's AESIA and the New AI Governance Law: What Firms Need to Know

Short answer: Spain has a second regulator for AI, separate from the AEPD. AESIA (Agencia Española de Supervisión de la Inteligencia Artificial) has been operational since June 2024 and already runs a live regulatory sandbox. A new Organic Law on the proper use and governance of artificial intelligence, approved by Spain's Council of Ministers on May 26, 2026 and currently before Congress, would give AESIA formal sanctioning power — up to €35 million or 7% of global turnover for the most serious infringements. The law has not yet passed; as of this writing it is still in committee, past its amendment period which closed June 30, 2026. Firms that have only been tracking AEPD/GDPR exposure now have a second, AI-specific regulatory track to watch.

> AESIA is not new, but its enforcement power is about to change

AESIA was created and has been market-surveilling since before this law existed — it selected its first cohort of companies for a regulatory sandbox in 2025, and by 2026 it was on its third cohort, having processed more than 20 AI systems end to end and opened preliminary investigations into Spanish deployments. What AESIA has lacked, until this Organic Law passes, is a codified domestic sanctions framework specific to Spain, distinct from what the EU AI Act itself already sets at the EU level.

> What the draft law would actually do

The bill formally designates AESIA as Spain's lead authority for AI systems that fall outside existing EU product-safety regimes — the categories that matter most to professional services firms: AI used in employment decisions, biometric identification, and education, among others. It establishes a graduated sanctions regime with three tiers:

Very serious infringements — up to €35 million or 7% of global annual turnover
Serious infringements — a lower band aligned with, but distinct from, the very-serious tier
Minor infringements — up to €500,000 or 0.5% of turnover

The law also builds in flexibility that firms should actually welcome: penalties scale with intentionality and recurrence, there are early-payment reductions, corrective-measure pathways that substitute for a fine, and specific consideration for SME and startup size — this isn't a pure strict-liability regime.

> Where it stands right now

May 26, 2026 — Council of Ministers approves the draft as an Organic Bill.
June 12, 2026 — Published in the Official Journal of the Parliament; formal parliamentary processing begins.
June 30, 2026 — The 15-working-day amendment period closes.
Now — In committee (Economy, Commerce and Digital Transformation). No enacted law yet.

Because it's an Organic Law — a category of Spanish legislation requiring an absolute majority in Congress — the passage timeline is inherently less predictable than an ordinary bill. Firms should treat the sanctions figures above as the shape of what's coming, not as currently enforceable numbers; AESIA's existing market-surveillance and sandbox activity is real today, but the codified fine structure is not law yet.

> Why this matters alongside AEPD, not instead of it

None of this replaces GDPR or AEPD exposure — it sits on top of it. A Spanish law firm or gestoría processing client data through cloud AI already has to reckon with AEPD's operational-sovereignty guidance and Article 32. Once this Organic Law passes, the same firm has a second, AI-specific regulator with its own sanctions track, its own inspection powers, and its own definition of what counts as a "very serious" failure. Architecture that keeps processing on hardware the firm controls addresses the exposure both regulators care about — audit-ability, control, and the ability to demonstrate what happened and who could access it — rather than something either agency has to be argued around separately.

> Sources

AI IBIZA builds local-first AI systems for Spanish law firms and gestorías where the firm holds the keys and the hardware. See Private AI for Despachos or Private AI for Gestorías.