Regulation Tracker · 20 questions
Regulator or bar guidance restricting what client information may be entered into AI tools and under what safeguards.
As of 2026-09-04, 7 of 130 countries and entities have a binding rule for client data in AI tools, 33 have official guidance, 2 have a proposal, 0 are set by case law, 85 were checked with nothing found and 3 remain unclear. Binding countries: Austria, Colombia, Finland, Germany, Philippines, Poland, Slovakia.
Tap or hover a country. Faint land has no record yet. Miller projection; boundaries as published by Natural Earth (India point of view) — see the disclaimer.
Europe · verified 2026-09-04
§ 9(2) RAO confidentiality applies without restriction to AI use: entering mandate-related or otherwise confidential information into public or unsecured AI systems 'stellt einen Bruch der Verschwiegenheit dar und ist standesrechtlich unzulässig'. Lawyers may instruct only AI providers that meet the duties in § 40(3) RL-BA; otherwise only abstract, anonymous questions may be asked.
Americas · verified 2026-09-04
Judiciary only: Acuerdo PCSJA24-12243 article 8(6) forbids entering personal, sensitive or confidential data into AI tools that retain, share or retrain on inputs. No bar guidance for lawyers on client data in AI tools was found.
Europe · verified 2026-09-04
Guideline B 05.1 point 6 (binding, in force 1 Jan 2024): software and services used in practice must be intended for business use; others only with client consent. B 05.2 Annex 5 point 4 applies this to AI — tools may be used only if privileged material is not used, stored or shared contrary to secrecy.
Europe · verified 2026-09-04
§ 43a(2) BRAO (confidentiality, criminally backed by § 203(1) no. 3 StGB) and § 43e BRAO (IT outsourcing) apply to AI providers. BRAK §3.2: for LLMs, transmitting client secrets is 'nach aktuellem Stand der Technik nicht erforderlich' and therefore not permitted; prompts should be abstract and documents anonymised; § 43e(4) requires comparable secrecy protection abroad, so EU/German-hosted providers are preferred.
Asia-Pacific · verified 2026-09-04
Framework Part II.6: no AI tool shall be used to process confidential, privileged, sensitive or secret information without express authority and under the strict supervision of the Court. Reinforced by CPRA confidentiality duties and NPC Advisory No. 2024-04.
Europe · verified 2026-09-04
§ 23e of the advocates' ethics code bars processing information covered by professional secrecy [tajemnica adwokacka] in a technological tool unless the tool's mechanisms guarantee proper protection of such data. KIRP recommendations address the equivalent duty for legal advisers.
Europe · verified 2026-09-04
Resolution Art. 4 forbids entering confidential information or personal data into AI tools except in three modes: (a) a local tool wholly under the lawyer's control, (b) express informed client consent, or (c) a GDPR Art. 28 processor with contractual confidentiality. Guidance Art. 4 sets a mandatory three-question decision test.
Americas · verified 2026-09-04
The Buenos Aires bar guide of July 2025: do not upload client data to platforms without security guarantees, respect professional secrecy, and obtain client authorisation before sharing personal, sensitive or confidential information.
Asia-Pacific · verified 2026-09-04
The December 2024 joint statement of the VLSB+C, Law Society of NSW and Legal Practice Board of WA says confidential client information must not be entered into public AI tools. NSW SC Gen 23, NCAT PD 7 and PIC PD 13 add a binding prohibition on entering suppressed, non-publication or summonsed material.
Europe · verified 2026-09-04
OVB/Avocats.be: the lawyer 'voert nooit stukken of informatie die gedekt zijn door het beroepsgeheim' into an AI tool, the only exception being absolute certainty that the tool runs in a closed environment with sufficient safeguards (e.g. inside the firm perimeter with no outward data sharing). Personal data must be pseudonymised and kept out of prompts.
Americas · verified 2026-09-04
OAB Recommendation 001/2024 devotes a pillar to confidentiality and privacy: professional secrecy must not be compromised, client data must not be entered into AI systems without confidentiality and security guarantees, and the data-protection law applies.
Americas · verified 2026-09-04
Every published law society guidance restricts client data in AI tools. The Law Society of British Columbia (Nov 2023) warns against entering confidential information in public tools; the Law Society of Ontario white paper (Apr 2024) requires safeguards for confidential and privileged information; Alberta's rules of engagement say the same.
Europe · verified 2026-09-04
No bar-authored rule; the Croatian Bar republished the CCBE generative-AI guide and the CCBE Technical Guide on AI tools in May 2026, which cover confidentiality, hosting options and data residency.
Europe · verified 2026-09-04
ČAK's Stanovisko (point 5) warns that entering client information into AI tools — including merely to let the tool learn — will most likely breach the statutory duty of confidentiality [povinnost mlčenlivosti] under the Act on Advocacy, and that the lawyer is always responsible for compliance.
Europe · verified 2026-09-04
Danske Advokater's guidance on buying and using AI covers confidentiality, IP and GDPR alongside the conduct rules; Advokatsamfundet's own commentary warns lawyers to be clear about which technology they use and how it affects confidentiality and conflicts.
Europe · verified 2026-09-04
The Bar's AI guide states that sensitive client information may be entered only into systems whose security has been verified, and warns against free public AI services, which 'may use entered information for product development or share it unexpectedly'.
Europe · verified 2026-09-04
CCBE guide requires care over professional secrecy, what is entered into tools and where data is processed. EDPB Opinion 28/2024 (17 Dec 2024) governs the GDPR side of AI model development and deployment. Secrecy itself is regulated nationally.
Europe · verified 2026-09-04
CNB guide (17 Mar 2026) puts protection of the secret professionnel and GDPR compliance first. The Conseil d'État charter tells court personnel to give up using external AI where data security and confidentiality cannot be assured: giving information to a public chatbot 'équivaut à la publier sur internet'.
Asia-Pacific · verified 2026-09-04
Circular 25-824 requires client confidential information to be kept out of tools without safeguards. The PCPD's March 2025 employee checklist gives organisations, including firms, a template for what may be entered into which tools, and the Judiciary's guidelines bar confidential case material from public tools.
Asia-Pacific · verified 2026-09-04
PERADI's guideline bans AI uses that breach confidentiality and requires alignment with the Personal Data Protection Law. Separately, a Deputy Chief Justice letter of 2 September 2026 (No. 112/WKMA.Y/HK2.1/IX/2026), annex C.3, bans uploading draft judicial templates to AI document-processing services.
International bodies · verified 2026-09-04
The CCBE Guide ties professional secrecy to what is entered into tools and where data is processed; CEPEJ(2025)18 bars confidential case data in unsecured tools; SVAMC Guideline 2, Ciarb 2.2, VIAC para 3 and AAA-ICDR apply the same rule to arbitration, barring party names and case specifics without data-protection guarantees.
Europe · verified 2026-09-04
Law Society of Ireland guidance v4 (12 Nov 2025): client confidential information must not be entered into tools without adequate safeguards; the guidance lists suitable and unsuitable uses.
Middle East · verified 2026-09-04
At/60/24 bars entering client personal, confidential, privileged or copyright-protected material into AI platforms and prefers closed in-house systems. Procedure 01-26 prohibits entering material from Net HaMishpat case files into AI tools that are not internal to the judiciary.
Europe · verified 2026-09-04
No Italy-specific rule. The National Bar Council republished the CCBE guide on generative AI in Italian in November 2025, which covers confidentiality and data entered into tools. Law 132/2025 article 13(1) confines professional AI use to instrumental and support activities.
Asia-Pacific · verified 2026-09-04
The JFBA notice of September 2025 warns against entering client-identifiable or confidential information into external generative-AI services under the duty of confidentiality in Attorney Act article 23. The Personal Information Protection Commission alert of 2 June 2023 cautions all businesses on entering personal data into generative AI.
Europe · verified 2026-09-04
No Luxembourg instrument; the secret professionnel under art. 35 of the loi du 10 août 1991 sur la profession d'avocat applies. The CCBE guide supplies the practical rules on what may enter a tool.
Asia-Pacific · verified 2026-09-04
Circular 242/2025 tells practitioners not to input personal data, NRIC or financial data or client-specific facts into generative-AI tools, to redact before use, not to disclose privileged material, and to comply with the Personal Data Protection Act 2010.
Europe · verified 2026-09-04
NOvA 'Vertrouwelijkheid' recommendations: no confidential or client data in free or public AI models; privacy-by-design and documented trade-offs; know where data is stored and processed (country, sub-processors, security); keep input and output inside the firm environment; run a DPIA where personal data is processed; be aware of implicit data collection (location, open tabs).
Asia-Pacific · verified 2026-09-04
The court guidelines say nothing that is not already public should be entered into a chatbot, and nothing private, confidential, suppressed or privileged; chat history should be disabled and breaches reported to the Head of Bench and to the Ministry of Justice. The Law Society guidance requires privacy and privilege to be protected.
Africa · verified 2026-09-04
NBA-SLP AI Guidelines s.5.3 and s.7.1 state client information and uploaded documents should never be used with generative-AI tools lacking robust security and confidentiality protocols, and require NDPA 2023 alignment.
Europe · verified 2026-09-04
Advokatforeningen's AI guidance (5 Sept 2025) is issued under its professional-ethics framework and addresses confidentiality of client information in AI tools; full text is members-only. The CCBE guide is also promoted to Norwegian members.
Asia-Pacific · verified 2026-09-04
The Law Society's Advisory on the Use of Publicly Available AI Tools (2 April 2026) says client information must not be entered into tools that may retain or train on it. The MinLaw guide applies confidentiality and PDPA obligations to anything entered into a tool.
Europe · verified 2026-09-04
The Madrid Bar Guide of Good Practice on AI of October 2025 addresses client data in AI tools; Circular 3/2026 expressly defers confidentiality and professional secrecy to a separate circular. The press reports a CGAE Circular 1/2025 on professional secrecy and technology, which was not opened.
Europe · verified 2026-09-04
Bar guidance s.4: confidentiality [tystnadsplikt] holds regardless of working method; client information may only be entered into GenAI in a secure way, and the tool must not use it for training or to generate output for other users. Firms with information barriers must keep walled data out of shared tools.
Europe · verified 2026-09-04
SAV Wegleitung §2.1 is the most structured confidentiality test in this group. Before using any AI, clarify what happens to input data, who can access it and where it is stored, respecting the Anwaltsgeheimnis, the DSG and the Standesregeln. Only three routes are open: an on-premise install where no data leaves the firm network; compliance with the SAV's IT-outsourcing and cloud rules; or an informed consent-and-waiver from the client covering both professional secrecy and the DSG. Otherwise no confidential, personal or IP-protected content may be entered.
Middle East · verified 2026-09-04
TBB Guide prohibited-use list: non-anonymised client data, case and enforcement file contents, party details, evidence, special-category data, trade secrets and negotiation strategy must not be entered into public AI tools or tools with inadequate contractual safeguards. Data masking and closed systems required.
Middle East · verified 2026-09-04
DIFC PGN 2/2023 requires practitioners using AI to comply with the DIFC Courts Mandatory Code of Conduct and applicable data-protection and IP law, and identifies protection of client confidentiality as a best practice.
Europe · verified 2026-09-04
SRA compliance tips and warning notice: client data must not enter tools without adequate protection or be used for training without authority. BSB guidance (18 May 2026) treats free consumer tools as generally unsuitable for confidential legal work.
Americas · verified 2026-09-04
ABA Formal Opinion 512 requires informed client consent before confidential information is entered into a self-learning tool. USPTO guidance (11 Apr 2024) bars entering confidential or export-controlled client information into tools that may disclose it.
Asia-Pacific · verified 2026-09-04
Journal-level only. The court's journal tells judges not to enter un-anonymised personal data into these tools and not to analyse unpublished case files in them. No binding confidentiality rule for AI use was located.
Americas · verified 2026-09-04
Protocol directive 2: public AI tools are prohibited for case data, only institutional tools may be used, and administrative staff may not enter personal data into unauthorised systems. It applies to judicial actors and is not yet in force.
Africa · verified 2026-09-04
Not yet binding. The LSSA revised draft guidelines require practitioners to address cybersecurity risks including prompt injection and data corruption; conference resolution 5.2 asks the judiciary policy to safeguard confidentiality.
No countries in this status.
No bar guidance on entering client data into AI tools found as of 4 September 2026.
No rule, guidance or reported case found as of 4 September 2026.
No bar or data-protection AI guidance restricting entry of client data into AI tools was found as of 4 September 2026.
No rule, guidance or reported case found as of 4 September 2026.
No rule, guidance or reported case found as of 4 September 2026.
Middle East · verified 2026-09-04
No rule, guidance or reported case found as of 4 September 2026. The Bahrain Bar Society has published no restriction on client data in AI tools.
Asia-Pacific · verified 2026-09-04
No rule, guidance or reported case found as of 4 September 2026.
No rule, guidance or reported case found as of 4 September 2026.
No bar guidance on entering client data into AI tools found as of 4 September 2026.
No rule, guidance or reported case found as of 4 September 2026.
No bar or data-protection AI guidance restricting entry of client data into AI tools was found as of 4 September 2026.
No bar guidance on entering client data into AI tools found as of 4 September 2026.
No rule, guidance or reported case found as of 4 September 2026.
No bar guidance on entering client data into AI tools found as of 4 September 2026.
No bar or data-protection AI guidance restricting entry of client data into AI tools was found as of 4 September 2026.
Americas · verified 2026-09-04
No bar guidance on client data in AI tools found as of 4 September 2026; article 17 of the ethics code addresses judges' data only.
Asia-Pacific · verified 2026-09-04
No All China Lawyers Association or Ministry of Justice guidance on client data in AI tools found as of 4 September 2026.
Americas · verified 2026-09-04
No bar guidance found as of 4 September 2026.
No bar or data-protection AI guidance restricting entry of client data into AI tools was found as of 4 September 2026.
No bar guidance on entering client data into AI tools found as of 4 September 2026.
Europe · verified 2026-09-04
No Cyprus Bar guidance found as of 4 September 2026; the CCBE guide is the available reference.
Americas · verified 2026-09-04
No bar guidance found as of 4 September 2026.
Africa · verified 2026-09-04
No rule, guidance or reported case found as of 4 September 2026. The Egyptian Bar Association has published no restriction on entering client data into AI tools.
No bar guidance on entering client data into AI tools found as of 4 September 2026.
No bar or data-protection AI guidance restricting entry of client data into AI tools was found as of 4 September 2026.
No rule, guidance or reported case found as of 4 September 2026.
Africa · verified 2026-09-04
The Legal Profession (Professional Conduct and Etiquette) Rules 2020 (L.I. 2423) cover confidentiality generally but are silent on AI tools; the General Legal Council has issued no interpretive guidance.
Europe · verified 2026-09-04
No Greek bar guidance; the Athens Bar's AI page sits under its CCBE activities and relays CCBE material. A direct fetch of the bar page returned 404.
No bar guidance on entering client data into AI tools found as of 4 September 2026.
No bar guidance on entering client data into AI tools found as of 4 September 2026.
Europe · verified 2026-09-04
Lawyers' confidentiality under the Lawyers Act [lög um lögmenn nr. 77/1998] and the Bar's code of conduct applies generally, but no rule or guidance addressing client data entered into AI tools was found as of 4 September 2026.
Asia-Pacific · verified 2026-09-04
No bar rule or guidance restricting client data in AI tools was found. Kerala and Gujarat High Court policies bar judicial officers from uploading case material to public AI tools. The Bar Council committee on AI ordered by the Supreme Court had published nothing as of 4 September 2026.
No bar or data-protection AI guidance restricting entry of client data into AI tools was found as of 4 September 2026.
No bar or data-protection AI guidance restricting entry of client data into AI tools was found as of 4 September 2026.
No bar guidance on entering client data into AI tools found as of 4 September 2026.
No bar or data-protection AI guidance restricting entry of client data into AI tools was found as of 4 September 2026.
No rule, guidance or reported case found as of 4 September 2026.
Africa · verified 2026-09-04
The Law Society of Kenya has published no guidance restricting client data in AI tools. A site search of lsk.or.ke on 4 September 2026 returned no AI guidance document.
Middle East · verified 2026-09-04
No rule, guidance or reported case found as of 4 September 2026. The Kuwait Bar Association has published no restriction on client data in AI tools.
No bar guidance on entering client data into AI tools found as of 4 September 2026.
No bar guidance on entering client data into AI tools found as of 4 September 2026.
Europe · verified 2026-09-04
Advocate secrecy under the Advocacy Law and the 2019 Ethics Code applies generally, but no rule or guidance restricting client data entered into AI tools was found as of 4 September 2026.
No bar or data-protection AI guidance restricting entry of client data into AI tools was found as of 4 September 2026.
Europe · verified 2026-09-04
Advocate professional secrecy under the Law on the Bar and the Code of Professional Ethics applies generally, but no rule or guidance restricting client data entered into AI tools was published as of 4 September 2026.
No bar guidance on entering client data into AI tools found as of 4 September 2026.
Europe · verified 2026-09-04
Legal 500 notes that generative AI's effect on privilege and professional secrecy is unaddressed by Maltese guidance as of 4 September 2026.
No bar or data-protection AI guidance restricting entry of client data into AI tools was found as of 4 September 2026.
Americas · verified 2026-09-04
No professional-conduct guidance on client data in AI tools. Mexico has no compulsory bar; the legal profession is licensed through the Dirección General de Profesiones and bar codes of ethics bind only voluntary members, so no regulator has issued binding AI confidentiality rules.
No rule, guidance or reported case found as of 4 September 2026.
No bar guidance on entering client data into AI tools found as of 4 September 2026.
No rule, guidance or reported case found as of 4 September 2026.
Africa · verified 2026-09-04
No rule, guidance or reported case found as of 4 September 2026. No bar or CNDP restriction on entering client data into AI tools was located.
No bar or data-protection AI guidance restricting entry of client data into AI tools was found as of 4 September 2026.
No bar guidance on entering client data into AI tools found as of 4 September 2026.
No bar or data-protection AI guidance restricting entry of client data into AI tools was found as of 4 September 2026.
Asia-Pacific · verified 2026-09-04
No AI-specific guidance; the Rules of Professional Code of Conduct of Legal Practitioners 2023 and the Individual Privacy Act 2018 apply generally.
No bar guidance on entering client data into AI tools found as of 4 September 2026.
No rule, guidance or reported case found as of 4 September 2026.
No bar or data-protection AI guidance restricting entry of client data into AI tools was found as of 4 September 2026.
Asia-Pacific · verified 2026-09-04
No bar guidance found. The NJPMC guidelines refer to privacy and data-security standards for court use only.
Americas · verified 2026-09-04
No bar guidance found as of 4 September 2026.
No bar guidance on entering client data into AI tools found as of 4 September 2026.
Americas · verified 2026-09-04
No bar guidance found as of 4 September 2026.
Europe · verified 2026-09-04
No bar rule or guidance on client data in AI tools as of 4 September 2026; commentary in April 2026 criticised the bar for issuing only generic communications. For judges, CSM Recommendations 8 and 9 bar judicial data in non-validated systems.
No bar guidance on entering client data into AI tools found as of 4 September 2026.
Middle East · verified 2026-09-04
No regulator or bar guidance restricting client data in AI tools found as of 4 September 2026.
No rule, guidance or reported case found as of 4 September 2026.
No bar or data-protection AI guidance restricting entry of client data into AI tools was found as of 4 September 2026.
Middle East · verified 2026-09-04
No bar or regulator guidance restricting client data in AI tools. SDAIA's generative-AI guidelines contain generic data-handling rules for government and public users.
No bar or data-protection AI guidance restricting entry of client data into AI tools was found as of 4 September 2026.
No rule, guidance or reported case found as of 4 September 2026.
Europe · verified 2026-09-04
No Slovenian Bar guidance found as of 4 September 2026; the CCBE guide is the available reference.
Asia-Pacific · verified 2026-09-04
No bar guidance. The judiciary addresses confidentiality by routing judges to its own closed AI platform rather than external large language models, per February 2026 statements.
Asia-Pacific · verified 2026-09-04
No rule, guidance or reported case found as of 4 September 2026.
Asia-Pacific · verified 2026-09-04
No bar guidance found as of 4 September 2026; the Judicial Yuan guidelines address court data only.
No bar or data-protection AI guidance restricting entry of client data into AI tools was found as of 4 September 2026.
No bar guidance on entering client data into AI tools found as of 4 September 2026.
No bar or data-protection AI guidance restricting entry of client data into AI tools was found as of 4 September 2026.
No bar or data-protection AI guidance restricting entry of client data into AI tools was found as of 4 September 2026.
No rule, guidance or reported case found as of 4 September 2026.
Americas · verified 2026-09-04
No rule, guidance or reported case found as of 4 September 2026.
No bar guidance on entering client data into AI tools found as of 4 September 2026.
No bar guidance on entering client data into AI tools found as of 4 September 2026.
No bar or data-protection AI guidance restricting entry of client data into AI tools was found as of 4 September 2026.
No bar or data-protection AI guidance restricting entry of client data into AI tools was found as of 4 September 2026.
Europe · verified 2026-09-04
Not researched — no MÜK guidance on client data in AI tools could be confirmed. Hungarian legal professional privilege [ügyvédi titok] under the 2017 Act on Legal Practice applies generally but does not name AI.
Europe · verified 2026-09-04
Not researched — no UNBR guidance on client data in AI tools could be confirmed. Professional secrecy under Law 51/1995 and the Statute of the Profession applies generally but does not name AI.
Asia-Pacific · verified 2026-09-04
The Personal Data Protection Act B.E. 2562 (2019) applies to lawyers as data controllers, but no AI-specific guidance was opened: the PDPC site returned HTTP 403.
SafeLegalAI Legal AI Regulation Tracker, "Client data in AI tools" by country, https://safelegalai.com/regulation/category/confidentiality-client-data (accessed 2026-09-04). Data: CC BY 4.0.
SafeLegalAI is a research publication by Cognesio LLP, not a law firm. Nothing here is legal advice, and no lawyer–client relationship arises from reading it. Rules change; always check the official document linked on each record and take advice on your own situation. Researched and drafted with AI assistance; verified against primary sources and edited by Cognesio LLP. The linked official documents are the record — our summaries are not the law and are not legal advice.
Austria
Colombia
Finland
Germany
Philippines
Poland
Slovakia
Argentina
Australia
Belgium
Brazil
Canada
Croatia
Czechia
Denmark
Estonia
European Union
France
Hong Kong SAR
Indonesia
International bodies
Ireland
Israel
Italy
Japan
Luxembourg
Malaysia
Netherlands
New Zealand
Nigeria
Norway
Singapore
Spain
Sweden
Switzerland
Türkiye
United Arab Emirates
United Kingdom
United States
Vietnam
Ecuador
South Africa
Afghanistan
Albania
Algeria
Armenia
Azerbaijan
Bahrain
Bangladesh
Belarus
Bolivia
Bosnia and Herzegovina
Botswana
Brunei
Bulgaria
Cambodia
Cameroon
Chile
China
Costa Rica
Côte d'Ivoire
Cuba
Cyprus
Dominican Republic
Egypt
El Salvador
Ethiopia
Georgia
Ghana
Greece
Guatemala
Honduras
Iceland
India
Iran
Iraq
Jamaica
Jordan
Kazakhstan
Kenya
Kuwait
Kyrgyzstan
Laos
Latvia
Lebanon
Lithuania
Macao
Malta
Mauritius
Mexico
Moldova
Mongolia
Montenegro
Morocco
Mozambique
Myanmar
Namibia
Nepal
Nicaragua
North Macedonia
Oman
Pakistan
Panama
Paraguay
Peru
Portugal
Puerto Rico
Qatar
Russia
Rwanda
Saudi Arabia
Senegal
Serbia
Slovenia
South Korea
Sri Lanka
Taiwan
Tanzania
Trinidad and Tobago
Tunisia
Uganda
Ukraine
Uruguay
Uzbekistan
Venezuela
Zambia
Zimbabwe
Hungary
Romania
Thailand