1. Introduction
The legal services landscape is changing. Legal technology providers, like Harvey or Legora, offer AI solutions to law firms and individual legal experts. Their AI-enabled services can extend from the augmentation of workflows, including due diligence, to decision-making support through the analysis of legal documents. These AI solutions have moved from Generative AI to agentic approaches, the main difference being that the interaction with a Generative AI interface, such as a conversational assistant or chatbot, is largely one-step and reactive, while an agentic system is proactive because it can autonomously execute a series of actions from a single user prompt, provide an output, and learn from the process.
For example, a lawyer performing legal analysis of a given case must first ask a Generative AI conversational assistant to retrieve the relevant legislation and then pose additional prompts to request the application of the legal rules to the facts of the case or perform related actions, such as the drafting of an application for court proceedings. An agentic AI system can be instructed to simply analyse a certain case with potential for litigation and execute all necessary actions without further input from the lawyer. Such a move to more autonomous AI systems signals an increasing exacerbation of risks to data protection, eventually affecting compliance with legal ethics including the duty of confidentiality.
2. Use Cases of Agentic AI in Legal Services
An agentic AI system for legal services:
- Plans by breaking down a task in concrete steps that the lawyer can review and approve in the beginning;
- Researches by retrieving trusted sources, including the law firm’s own documents, legal databases, and, if necessary, the wider web;
- Works by analysing the retrieved resources to complete the instructed task;
- Delivers the output in its final form (for example, a memo or a diligence summary), depending on the applicable context, and;
- Reviews its performance by taking note of the acceptance, rejection, or possible refinements that the lawyer applies.
The added value of agentic AI seems to be time efficiency when performing legal tasks and the generation of more structured and informed insights, primarily relying on internal knowledge of the law firm. Harvey and Legora, two popular players in the legal tech market, offer agentic AI-enabled services in two common areas: compliance and litigation.
Compliance necessitates continuous monitoring of legal obligations to assess if current policies need to be amended in accordance with newly published rules, or even if new policies need to be established, to avoid non-compliance consequences. In practice, the lawyer would grant the agentic AI system access to the firm’s library and give a simple instruction to review existing policies according to the corresponding regulatory update(s) and revise them if needed. The agent would then identify the affected policies and possible compliance risks according to the new rules, alert the lawyer accordingly, and apply any needed changes.
Litigation demands that lawyers identify and review the counterparties’ legal arguments, as expressed in documents such as complaints and inquiry letters, to extract arguments and compare them with those of their clients in preparation of a hearing. AI agents can automatically review the relevant documents provided by lawyers to extract the counterparties’ arguments, match them against their clients’ arguments, and flag which arguments are not supported by agreed facts to require further evidence.
3. Data Protection Risks
The claimed efficiency and effectiveness of agentic AI for legal tasks comes with regulatory risks in relation to data protection. In the context of legal services, data protection can be associated with the duty of confidentiality, which obliges lawyers to keep secret information that has been shared by clients, such as correspondence or even advice. Similarly to Generative AI systems, agentic AI presents third party disclosure risks when it is deployed as a cloud-based service, popular ones being Google Cloud and Amazon Web Services. Even when it is hosted locally, data breaches are possible if the law firm in question does not have a sound data privacy policy. The present work is focusing on personal data, as part of confidential information provided by the client, and the risks to a principled data processing and to the rights of data subjects (i.e. clients) under the General Data Protection Regulation (GDPR).
Personal data must be collected for a specific purpose and be limited to what is necessary, among other principles (Article 5, para. 1, points b and c GDPR). Concerning purpose limitation, one threat concerns the long-term working memory of agentic AI systems that allows them to retain information throughout different conversations. Retaining a history of agentic AI outputs, such as conversations on defence preparation, may improve efficiency if lawyers later handle another case for the same client, but doing so extends beyond the original purpose of case management. Another threat is related to third-party access – whether authorized or not – and further processing of the data for purposes other than case management. For example, the provider of the cloud service on which the agentic AI system is based may decide to indiscriminately collect data for statistical purposes or product improvement, not necessarily guaranteeing the anonymization or aggregation of personal data.
The system may further process more personal data than is necessary or infer new information, including sensitive personal data, due to its autonomy in planning and executing the actions it determines are necessary to achieve the lawyer’s objective. For example, while drafting an application for court proceedings may require specific personal information, the agentic AI could process historical correspondence with the client and derive additional information or inferences – such as aspects of the client’s personal circumstances – that are unnecessary for the drafting and may fall outside the original purpose of the processing. This situation can be exacerbated when there are multiple controllers involved, each determining their own purposes and means of data processing. This may happen when the agentic AI system of the law firm (controller 1) accesses databases of a public administration body (controller 2) to obtain data related to their clients for litigation purposes.
A risk to the data subject’s rights is that the client may be affected by a decision based solely on automated processing (Article 22 GDPR). If AI agents are given broad goals to fulfil, such as the preparation of a defence strategy, they might autonomously decide that it is fitting for the completion of the task to send e-mail messages requesting additional information or even transfer files to relevant individuals or services. These automated actions can lead to legal or similarly significant effects to the client, including the breach of the confidentiality of their information or even compromising the success of their defence if crucial evidentiary items are shared with the wrong recipients. Profiling can also be a relevant concern, when agentic AI deems necessary to generate a profile of the client to complete a task, such as recommending appropriate defence strategies. This creates an additional risk that the system may infer information to construct a more comprehensive profile, potentially including sensitive information such as race. If such information, or proxies for such information, influence the system’s recommendations, this could result in discriminatory outcomes.
4. Data Protection under the AI Act
Beginning with the classification of AI agents under the AI Act, these are typically AI systems with an interface that include at least one General Purpose AI model, characterized by “the generality and the capability to competently perform a wide range of distinct tasks” (Recital 97 AI Act). The generality of application and autonomy of actions may trigger the classification of AI agents under prohibited practices or high-risk AI systems.
An example of the former instance is when the agentic AI system deploys subliminal techniques aiming at or achieving to impair the ability to make an informed decision, which can then cause significant harm to the user or another person (Article 5, para. 1, point a AI Act). The lawyer using agentic AI may not understand the extent of data processing due to the lack of transparency and explainability of the system, thus allowing it to autonomously take actions that lead to data breaches and the restriction of the confidentiality of clients’ information. Such an interpretation would, however, not be predominant, considering the added value of agentic AI in legal services and the high threshold for ‘material impairment of informed decision-making’ and ‘significant harm.’ Fabrication of evidence or deliberate concealment of contrary legal authorities would be more obvious cases.
For the agentic AI system to be classified as a high-risk AI system, it should pose a high risk of harm to the fundamental rights of persons, considering both the severity of the possible harm and its probability of occurrence (Recital 52 AI Act). Even if there is a very probable risk of data breaches while using AI agents, as analysed above, their use takes place in the private sector, being an ancillary tool for the provision of legal services, which does not correspond to one of the predefined cases of Annex III.
In any case, transparency obligations (Article 50 AI Act) still burden providers and deployers (law firms) of agentic AI systems, since these interact with natural persons (lawyers) through interfaces and generate content, for example memos or strategy recommendations. Notably, users of agentic AI systems (lawyers) must know that they interact with an AI agent and that the output is generated. Under the GDPR, the law firm would also need to share with their clients information on the data processing, including the purposes of processing, the categories of personal data, or the categories of their recipients, including external services that the agents contact (Article 13 GDPR). Transparency is important so clients are in control of their data and can exercise the rights attributed to them under the GDPR and its national transpositions, such as the right to restriction of processing (Article 18 GDPR).
5. Conclusion: A New State-of-Play?
After reviewing the most pertinent risks to data protection that arise from the use of agentic AI in legal services, one conclusion is obvious: agentic AI is too autonomous to allow for meaningful human oversight from a user’s perspective. With Generative AI systems, users can at least refine their queries through continuous prompting and challenge the accuracy of the AI systems’ output after each reply. Agentic AI takes too many liberties in the planning and execution stages, the reasoning process of which may not be obvious even to the developer. Technical and organizational measures that the law firm is obliged to take for the protection of clients’ personal data (Article 25 GDPR) may not be enough to counteract the risks posed by AI agents, given the complexity of the system. Still, agentic AI has all the potential to become the new tech trend and take over the legal market, overshadowing data protection and confidentiality concerns.
Disclaimer
The information and views set out in this publication are those of the author and do not necessarily reflect the official opinion of the European Commission.
