Which AI Can a Law Firm Use Safely? The NOvA Rules Applied

Which AI can a law firm use safely?

A law firm can use AI safely when it satisfies the Dutch Bar's five core values, and the recommendations say how: never confidential data in free tools, know every data flow, and the lawyer stays personally responsible for the advice.

AI that keeps the client's data inside the firm, does not learn from it, shows its sources, and leaves the advice with the lawyer. That rules out free public chatbots for anything confidential and rules in private deployments for document review, drafting from precedent and research with citations. This guide maps the Dutch Bar's 2025 recommendations onto the tasks a firm actually does.

By Tom Joseph · Last updated: 14 September 2026

The same task, done safely or not

Task	Not safe	Safe
Summarising a client file	Pasting it into a free public chatbot	A private assistant in the firm's tenancy, no training on the data, output traced to the file
Drafting a contract or a letter	A generic model inventing clauses	Drafting from the firm's own precedents, with every clause traced to its source
Legal research	Citations the model made up	Retrieval over licensed sources and the firm's knowledge base, with the source shown and checked by the lawyer
Due diligence review	Uploading a data room to an unvetted tool	Review inside the data-room environment or the firm's own, with a processor agreement
Client intake and conflict checks	A chatbot with no logging	A workflow that logs who asked what and routes to a person

What the NOvA's core values mean for a system

Confidentiality. Know and manage every data flow. No confidential data in free tools. The system runs in the firm's own EU tenancy under a processor agreement, does not train on client data and logs every access.

Expertise. The lawyer verifies. Every output shows its sources, so verification takes minutes rather than faith.

Independence and integrity. No tool that nudges advice toward a vendor's interest; no output sent to a client unread. Transparency about AI use where it plays a substantial role in the service.

Partisanship. The client's interest decides. A system that speeds up the work without changing who is responsible for it serves that; one that replaces judgement does not.

What a private legal AI costs

Crux Digits builds it in three fixed steps: a €2,500 audit that maps the data flows, the sources, the confidentiality boundaries and the first use case, and produces the DPIA outline; a €20,000 Production-ready MVP, a private assistant over the firm's own precedents and files with hard source citation, in your Azure or AWS tenancy or on-premise; and production from €50,000, integrated with the document management system and the practice software, with logging and retention rules. Excl. VAT, all code handed over. See the private AI assistant and AI for legal.

Frequently asked questions

May a lawyer use ChatGPT?

The NOvA's recommendations say never to put confidential data in free tools, and to know and manage every data flow. A public chatbot for a general legal question without client data is one thing; a client file in a free tool is a breach of confidentiality. Enterprise deployments in the firm's own tenancy, with a processor agreement and no training on the data, are a different product.

Who is responsible for AI-assisted advice?

The lawyer, always, according to the NOvA. The system prepares and shows its sources; the lawyer verifies and signs. That is why source citation is a design requirement, not a feature.

Must we tell clients we use AI?

The NOvA recommends transparency where AI plays a substantial role in the service or affects confidentiality, quality, costs or the processing of personal data. A line in the engagement letter and a clear internal policy cover most cases.

Can AI do legal research reliably?

Retrieval over licensed sources and the firm's own knowledge base, with the source document shown, yes. A general model asked to cite case law from memory, no; it invents citations, and the lawyer who files them is responsible.

What does a private legal AI cost?

At Crux Digits: a €2,500 audit, a €20,000 Production-ready MVP over the firm's own precedents and files, and production from €50,000 integrated with the DMS and practice software, all excl. VAT, with the code handed over.