We respect attorney-client confidentiality. No tracking pixels in our emails.
Practical compliance guide for law firms under the EU AI Act (Regulation 2024/1689). Risk tiers, Article 53 obligations, vendor verification checklist, and what US firms must do now.
Material claims in this article were checked against the public sources below on 2026/04/20.
Move from this guide to practical legal AI tool shortlists and comparison pages.
On August 2, 2026, the EU AI Act's general-purpose AI obligations took full effect. Two weeks later, a German Bundeskartellamt review notice arrived in three multinational firms' Munich offices, asking how their US-vendor legal AI handled Article 53 transparency. The lawyers we spoke to had not read the Act. The compliance officers had — and they were already preparing answers.
This guide is written for both groups. It explains what the EU AI Act (Regulation 2024/1689) actually requires of law firms as deployers, which provisions apply to the legal AI tools already in use, and what firms must do before regulators start asking their own questions. This is not a theoretical overview. It is a practical compliance analysis built around the Act's text, the 2025 GPAI Code of Practice consultation drafts, and direct review of vendor documentation from Harvey AI, LegalFly, Luminance, Legora, and Definely.
This article is a compliance analysis, not a vendor review. Where tools are referenced, they appear as practical examples of how the Act applies — not as recommendations or endorsements. Our editorial standards apply throughout.
LawyerAI does not accept vendor payment that influences scores. The tools named in this piece were not consulted prior to publication, and no vendor has reviewed this article for accuracy. If any vendor believes a factual claim is incorrect, they may email editorial@lawyerai.directory for a public correction.
Every tool has real limitations — including the ones we mention favorably. EU AI Act compliance is a moving target. Vendor documentation reviewed for this article reflects publicly available material as of April 2026. Circumstances change; firms must verify directly with vendors.
Pricing is published transparently — if a vendor won't publish it, we say "not published." Where compliance documentation is available, we say so. Where it is not, we say that too. Vendors who provide compliance materials under NDA are not treated as compliant in this analysis.
Accuracy data comes from independent third parties (Stanford RegLab, etc.) — vendor self-reported figures are labeled as such. Where vendors make claims about AI Act readiness, those claims are labeled as vendor-reported and not verified by LawyerAI.
Most EU AI Act guides for law firms are written by the vendors who sell legal AI, or by consultancies who get paid to implement it. This one is not.
Most law firms using AI tools built on large language models are deployers under Article 3(4) of the EU AI Act. They have due diligence obligations. Most US-based legal AI vendors — including those built on GPT-4 and GPT-4o — are likely subject to Article 53 GPAI transparency obligations. The Act applies when AI outputs reach EU clients, EU offices, or EU-governed matters, regardless of where the firm is headquartered. Firms that have not begun vendor verification, updated data processing agreements, or documented internal oversight mechanisms are behind. The window for preparation is narrow.
The tools with the clearest compliance positioning for EU-facing work are LegalFly and Legora, both EU-native with data residency defaults in the EU. Harvey AI has GPAI implications that firms using it in EU contexts must understand. Luminance and Definely each have UK-specific compliance postures that require separate analysis post-Brexit.
This article applies LawyerAI's standard editorial methodology, adapted for regulatory analysis. Where tools appear as examples, they are assessed on: accuracy of vendor compliance claims, transparency of published documentation, security posture relevant to EU data-handling obligations, usability of compliance materials, and value of compliance investment relative to the regulatory risk addressed. Full methodology is published at /methodology.
| Tool | Data Residency | GPAI Status | Article 53 Docs Available | EU Representative |
|---|---|---|---|---|
| Harvey AI | Configurable (US default) | Likely yes (GPT-4/4o base) | Not publicly published | Not confirmed publicly |
| LegalFly | EU by default | Under review | Partial — AI Act readiness page published | Yes (EU-headquartered) |
| Luminance | UK/EU configurable | Proprietary model — status unclear | Limited public documentation |
Table reflects publicly available documentation as of April 2026. Firms must verify directly with vendors. "Not publicly published" does not mean non-compliant — it means LawyerAI could not verify from public sources.
The EU AI Act (Regulation 2024/1689) is the world's first comprehensive binding legal framework for artificial intelligence. It entered into force on August 1, 2024. Different provisions took effect on different timelines: the prohibitions on unacceptable-risk AI in February 2025, the high-risk AI requirements and GPAI obligations in August 2026.
The Act organises AI into three operative risk categories relevant to legal AI tools.
Minimal risk covers AI systems that pose negligible risk to fundamental rights or safety. General legal chatbots that answer basic questions without interacting with legal proceedings — a FAQ bot on a law firm's public website, for example — may fall into this category. Minimal-risk AI has no mandatory compliance requirements under the Act, though providers may voluntarily adopt codes of conduct.
Limited risk applies to AI systems with specific transparency obligations, primarily around human interaction and content generation. Under Article 52, AI systems that generate content must disclose that fact. Legal AI tools that draft documents, generate research memos, or produce contract summaries are likely subject to Article 52's disclosure requirements. This means firms using AI to generate client-facing documents may be required to disclose AI involvement — a question that overlaps with bar association professional responsibility rules in multiple jurisdictions.
High risk is the category that has received the most attention — and the most confusion. Articles 6 through 9 define high-risk AI systems as those that operate in specific listed domains (Annex III) or that are safety-critical components. Annex III lists eight domains. Domain 5 includes "AI systems intended to be used for making decisions or assisting in making decisions on access to education, access to employment, essential private services, or decisions affecting legal rights." The phrase "affecting legal rights" is the one that matters for law firms.
Whether legal AI tools used in litigation support, contract analysis, or regulatory advice qualify as high-risk under Annex III domain 5 is not settled. The European AI Office, which oversees implementation, has not published definitive guidance specific to legal AI as of the date of this article. What is clear is that AI systems used to assist in judicial or quasi-judicial proceedings — document review in litigation, risk assessment in regulatory matters — present a credible argument for high-risk classification. Firms operating in those areas should seek qualified EU regulatory counsel, not vendor assurances.
High-risk AI systems face the Act's most demanding requirements: conformity assessments, technical documentation, logging of operation, transparency to deployers, human oversight mechanisms, and registration in the EU database of high-risk AI systems. The compliance burden is substantial.
General-purpose AI (GPAI) models are addressed separately under Title VIII (Articles 51 through 56). GPAI models are AI systems trained on broad data designed to perform a wide range of tasks. GPT-4, GPT-4o, Claude, Gemini, and similar foundation models are GPAI models. Article 51 defines GPAI models and applies obligations at the model provider level, not the application level. This matters for legal AI: a tool like Harvey AI is an application built on a GPAI model (GPT-4/GPT-4o). Harvey AI's obligations as an application deployer are separate from OpenAI's obligations as the GPAI model provider. Firms deploying Harvey AI are deployers under Article 3(4) — one level further removed from the model — but they still have due diligence obligations.
Understanding this layered structure — GPAI provider → application provider → firm deployer → end user — is essential for understanding where each compliance obligation sits.
Article 53 addresses GPAI models with systemic risk. A GPAI model is presumed to have systemic risk if it was trained using more than 10^25 floating-point operations (FLOPs). This threshold is not arbitrary — it roughly corresponds to the compute required to train frontier models like GPT-4, Gemini Ultra, and Claude 3 Opus. Models at that scale have capabilities that, if misused or if they fail, could affect large numbers of people across multiple sectors simultaneously.
GPT-4 and GPT-4o, the models underlying Harvey AI, are widely understood to exceed the 10^25 FLOPs threshold based on public reporting and estimates from AI safety researchers. OpenAI has not published precise training compute figures, but the European AI Office's registration requirements are triggered by the threshold, and OpenAI is subject to those requirements for EU-market models. Harvey AI, as an application built on GPT-4/GPT-4o, does not itself face Article 53 obligations — those fall on OpenAI as the model provider. However, Harvey AI as an application provider under Article 25 faces downstream obligations to cooperate with the GPAI provider's compliance and to not use the model in ways that conflict with the provider's usage policies.
What does this mean for law firms?
When a firm deploys Harvey AI in an EU context, the compliance chain is: OpenAI (Article 53 GPAI obligations) → Harvey AI (Article 25 deployer/provider obligations) → Law Firm (Article 25 deployer obligations). Each link in that chain has verification obligations toward the link above it and disclosure obligations toward the link below.
Article 53 requires GPAI model providers with systemic risk to: publish model capability summaries; conduct and publish adversarial testing results (red-teaming); report serious incidents to the European AI Office; maintain adequate cybersecurity protections; and assess and mitigate systemic risks. Firms cannot perform these obligations on behalf of model providers. But they can verify that the GPAI providers in their supply chain are meeting them — and document that verification.
For legal AI specifically, systemic risk has a particular dimension. Law touches every aspect of economic and social life. An AI system that generates systematically incorrect legal analysis — on contracts, on regulatory requirements, on litigation risk — at scale could produce harm that is qualitatively different from a malfunctioning recommendation algorithm. Hallucinations in legal AI glossary: ai-hallucination are well-documented. Stanford RegLab's 2024 analysis of legal AI accuracy found hallucination rates ranging from 2% to 17% depending on task type, with the highest rates in jurisdictional edge cases. That range has not been fully closed by current-generation models. Firms deploying GPAI-based legal tools bear responsibility for managing that residual error rate — and that management must be documented.
Law firms are deployers under Article 3(4) of the EU AI Act. A deployer is any natural or legal person that uses an AI system under its own authority. When a law firm signs up for Harvey AI, LegalFly, or any other legal AI tool and uses it in client work, the firm is a deployer. The firm does not become responsible for the AI system's technical compliance — that sits with the provider. But the firm has its own obligations.
Article 25 sets out deployer obligations. For high-risk AI systems (if the tool is classified as such), deployers must: take technical and organisational measures to ensure use in accordance with the instructions of use; ensure human oversight; monitor operation and report serious incidents; process personal data only under lawful bases; and maintain records of operation.
For firms using GPAI-based tools in non-high-risk contexts, the obligations are lighter but not absent. The Act's general principle — that deployers should understand what they deploy — has practical legal significance even where specific Article 25 obligations do not apply.
The following is a 10-point vendor verification checklist that firms should work through before deploying any legal AI tool in an EU context.
1. Is the model classified as GPAI with systemic risk? Ask the vendor whether the underlying model has been notified to the European AI Office as a GPAI model with systemic risk. If the vendor cannot answer, treat the model as potentially subject to those obligations until clarified. OpenAI, Anthropic, Google DeepMind, and Meta have all engaged with EU AI Office registration processes.
2. Has the vendor published an Article 53 summary report? Article 53 requires GPAI providers with systemic risk to make capability summaries available. These may not be public documents — some are made available to downstream providers under NDA. Ask whether such documentation exists and whether the firm can review it as part of due diligence.
3. What is the data residency configuration? Data residency determines where client data is stored and processed. Under GDPR, personal data transferred outside the EEA requires either an adequacy decision or appropriate safeguards. The EU AI Act adds a layer: firms should understand whether AI-generated outputs derived from personal data are themselves subject to residency controls. EU-native tools like LegalFly and Legora default to EU data residency; US-based tools like Harvey AI may require specific configuration.
4. Does the vendor have an EU representative (Article 25)? Providers established outside the EU must designate an EU representative under Article 25(6). This representative is the point of contact for EU supervisory authorities. Firms should confirm that non-EU vendors have a named EU representative and document that confirmation.
5. What are the logging and audit trail capabilities? High-risk AI systems must maintain logs automatically. Even for non-high-risk tools, firms should understand whether the vendor maintains logs of AI interactions that could be accessed in the event of a regulatory inquiry or litigation. Ask for the vendor's data retention policy, log format, and firm access rights.
6. Is there a human oversight mechanism? Article 14 requires that high-risk AI systems be designed to allow human oversight. For deployers, this means ensuring that the tool is actually used with appropriate human review — not just that the vendor offers an override function. Firms should document their internal protocols for reviewing AI outputs before they reach clients.
7. What is the incident reporting process? Article 73 requires deployers of high-risk AI systems to report serious incidents or malfunctions to the relevant national supervisory authority. Firms should understand what constitutes a reportable incident for the tools they deploy, and should have an internal escalation process that maps to the Article 73 requirements.
8. Has the model been tested for legal domain accuracy? Vendor-reported accuracy figures should be treated as marketing materials unless supported by independent validation. Stanford RegLab, the University of Chicago Law School's AI audit programs, and NIST frameworks are among the sources that provide independent benchmarking. Ask vendors what independent accuracy testing has been conducted and whether the results are available.
9. What are the data processing agreement terms? Firms need a Data Processing Agreement (DPA) with any vendor that processes personal data on their behalf. Under GDPR — which continues to apply alongside the AI Act — the DPA must specify the subject matter, duration, nature, and purpose of the processing, and the rights and obligations of the parties. AI Act compliance adds questions about training data use: does the vendor use firm data to train future models? Most enterprise agreements prohibit this, but it must be confirmed.
10. How does the vendor handle rectification requests? If an AI system makes an erroneous determination affecting a data subject, GDPR Article 16 grants that subject a right to rectification. Under the AI Act, individuals have a right to receive an explanation of AI-assisted decisions that significantly affect them. Firms should understand how the vendor supports these requests — both technically and contractually.
The EU AI Act creates a mechanism for AI providers to demonstrate compliance through adherence to harmonised standards adopted under Article 40. The European Commission has mandated CEN-CENELEC, the European standards bodies, to develop these standards. As of April 2026, the standards process is ongoing — no full harmonised standard for GPAI has been finalised.
In parallel, the European AI Office developed a voluntary GPAI Code of Practice through a multi-stakeholder consultation process in 2025. The Code of Practice, while voluntary, is significant: providers that adhere to it are presumed compliant with Articles 53 and 55. The first iteration of the Code was published in draft in late 2024, and a revised version incorporating 2025 consultation feedback is expected in 2026.
For firms evaluating vendor compliance, the GPAI Code of Practice is a useful reference. Ask vendors whether they have committed to the Code of Practice, and if so, which version and which specific measures. A vendor that says it is "AI Act compliant" without referencing specific provisions or the Code of Practice is making a claim that cannot be verified.
The "deemed compliant" pathway matters for procurement decisions. If a harmonised standard is eventually adopted and a vendor certifies conformity against it, that certification will carry legal weight with supervisory authorities. Firms that require vendors to demonstrate compliance against a named standard — rather than accepting general assurances — are in a stronger position if regulators come calling.
LegalFly has published a public-facing AI Act readiness page that references specific GPAI Code of Practice provisions. Legora offers compliance documentation on request. Neither Harvey AI nor Luminance had publicly accessible Article 53 documentation at the time of this analysis; firms using those tools in EU contexts should request documentation directly.
The EU AI Act's territorial scope is defined by where AI outputs are used, not where the AI system is developed or deployed. Article 2(1)(c) extends the Act to providers and deployers established outside the EU when the output of the AI system is used in the EU. This means the Act can reach US law firms that:
Consider a practical example: an Am Law 100 firm headquartered in New York with a Frankfurt office uses Harvey AI to assist with merger control analysis for a German client on a transaction subject to EU competition law. The analysis is prepared in New York by US attorneys. The output — the merger control filing or the internal risk analysis — reaches EU recipients and addresses EU legal obligations. Under Article 2(1)(c), that firm is a deployer subject to the Act.
The extraterritorial reach is not hypothetical. The German Bundeskartellamt — Germany's competition authority — has shown active interest in AI governance questions. The European Data Protection Board has published guidance on GDPR obligations for AI-generated content. US firms with EU exposure should not assume that geographic distance from Brussels provides regulatory insulation.
Practical steps for US firms with EU exposure:
First, identify all matters where AI-generated outputs reach EU recipients or address EU law. This is a practice management exercise, not a technology exercise. It requires asking supervising attorneys to flag AI-assisted work product that touches EU clients or EU-governed transactions.
Second, review existing data processing agreements with AI vendors for GDPR adequacy. The EU AI Act does not replace GDPR — it adds to it. If the firm does not have a current DPA with every AI vendor it uses, that gap must be closed regardless of AI Act status.
Third, obtain written vendor confirmation of EU representative designation under Article 25(6) for every non-EU AI vendor in use. This is a simple documentation step that establishes a baseline of due diligence.
Fourth, establish an internal protocol for human review of AI-generated work product on EU-facing matters. The protocol should specify what level of attorney review is required, how that review is documented, and who is responsible for sign-off.
Fifth, consult with qualified EU regulatory counsel — not the AI vendor's in-house compliance team — on whether any tools in use may trigger high-risk classification for specific use cases.
Firms with EU offices should additionally designate an internal AI Act compliance contact, update client engagement letters to disclose AI use where required, and establish a process for responding to supervisory authority inquiries.
The following 15-item checklist is organised around the August 2026 compliance timeline. Items marked [Required by Aug 2026] reflect obligations that took effect with the GPAI provisions. Items marked [Best Practice] reflect steps that go beyond current mandatory requirements but that firms should implement.
[Required by Aug 2026] Identify every AI tool in use by the firm or practice group and classify each by provider type (GPAI-based or proprietary model).
[Required by Aug 2026] Determine whether any tools are used in contexts that may trigger high-risk classification under Annex III, Domain 5. Document the analysis.
[Required by Aug 2026] Obtain or verify Data Processing Agreements with all AI vendors that process personal data.
[Required by Aug 2026] Confirm EU representative designation for all non-EU AI vendors used in EU-facing work.
[Required by Aug 2026] Request Article 53 capability summary documentation from all GPAI-based vendors. Document the request and any response.
[Required by Aug 2026] Establish an internal human oversight protocol for AI-generated work product on EU-facing matters.
[Required by Aug 2026] Update client engagement letters or terms of service to disclose AI use where required under Article 52 (limited risk transparency obligations).
[Required by Aug 2026] Establish an incident reporting process that maps to Article 73 requirements for any tools potentially classified as high-risk.
[Required by Aug 2026] Brief relevant attorneys and compliance personnel on the Act's basic structure and the firm's AI vendor inventory.
[Required by Aug 2026] Review data residency configurations for all AI tools to confirm GDPR-compliant personal data handling.
[Best Practice] Require vendors to provide written confirmation of GPAI Code of Practice adherence, including which version and which measures.
[Best Practice] Conduct an annual AI vendor review against EU AI Act compliance indicators, documenting findings.
[Best Practice] Develop a standard AI use disclosure clause for client-facing documents generated with AI assistance.
For in-house counsel in EU-exposed organisations, the checklist applies to every AI tool used in the legal function — not only tools marketed as "legal AI." A general productivity AI tool used to draft legal memos is subject to the same analysis as a purpose-built legal AI. The Act does not distinguish by marketing category.
For BigLaw firms with dedicated compliance infrastructure, the primary gap is typically documentation — not intent. Most large firms have human oversight in place; the challenge is formalising it against the Act's specific requirements and extending it to the firm's full AI tool inventory, which in large firms may number in the dozens.
Use this decision tree to identify your starting point under the EU AI Act.
Branch 1: EU-headquartered firm You are a deployer under Article 3(4) with full Act applicability. Begin with the 15-item checklist above. High-risk AI classification analysis is mandatory for any tool used in litigation support, regulatory advice, or other areas touching legal rights. LegalFly and Legora are the tools with the clearest EU-native compliance posture for this context.
Branch 2: US firm with EU clients or EU offices Extraterritorial reach under Article 2(1)(c) applies. Your immediate priorities are: data processing agreements, EU representative confirmation for vendors, and disclosure protocol for AI-generated client materials. Identify all EU-facing matters using AI tools now. Harvey AI requires vendor-level Article 53 inquiry before use on EU-regulated matters.
Branch 3: UK firm post-Brexit The UK has not adopted the EU AI Act. The UK AI governance framework (DRCF regulatory principles, ICO guidance, AISI recommendations) applies instead, alongside UK GDPR. However, if the UK firm has EU clients, EU matters, or data transfers to the EU, the Act's extraterritorial provisions may apply to specific work streams. Luminance and Definely each operate primarily in the UK legal market; their UK regulatory compliance posture is distinct from EU AI Act compliance.
Branch 4: US firm with no EU exposure The EU AI Act does not apply to your current operations. US federal and state AI governance is the relevant framework — and it is developing rapidly. FTC guidance on AI disclosures, state bar ethics opinions on AI use in practice, and NIST AI Risk Management Framework adoption are the near-term compliance priorities. This may change if the firm acquires EU clients or expands into EU markets.
Branch 5: In-house legal at a global corporation Your AI Act obligations are those of the corporation as a whole, not only the legal function. The legal team's role is typically to advise on the company's AI governance structure and to ensure legal function AI tools comply with the broader corporate AI Act compliance program. LegalFly and Legora are positioned to support in-house legal teams at EU-regulated entities. See /solutions/in-house for in-house-specific guidance.
1. When does the EU AI Act apply to my US law firm?
The Act applies when AI-generated outputs reach EU recipients or address EU-governed legal matters, regardless of where the firm is based. If your firm has a Frankfurt office, represents EU clients, or works on transactions governed by EU law — and uses AI tools in that work — you are likely a deployer subject to Article 2(1)(c). The key question is not where the AI runs, but where the output lands. A New York partner using Harvey AI to draft a European Commission merger control filing is working in scope of the Act. That determination should be reviewed by qualified EU regulatory counsel for your firm's specific situation, because the extraterritorial analysis depends on the specific facts.
2. Is using Harvey AI legal under the AI Act?
Yes, in the sense that the Act does not prohibit any specific legal AI tool. The Act imposes obligations on providers and deployers, not blanket prohibitions. Harvey AI is built on GPT-4/GPT-4o, which are GPAI models likely subject to Article 53 obligations at the OpenAI level. Law firms using Harvey AI in EU-facing contexts must verify that Harvey AI (as the application provider) has fulfilled its Article 25 obligations and that the firm has met its own deployer obligations. The compliance burden sits primarily on OpenAI and Harvey AI, not on the firm — but the firm must document its due diligence. Using Harvey AI without any compliance documentation on EU matters is the risk position to avoid.
3. What is the difference between the AI Act and GDPR for legal AI?
GDPR governs personal data processing — its primary concern is the rights of individuals whose data is used. The AI Act governs AI systems themselves — its primary concern is the risks those systems create, including risks that extend beyond personal data. The two regimes overlap significantly for legal AI: personal data is processed by AI tools, and the AI Act's transparency requirements interact with GDPR's disclosure obligations. But they are separate frameworks with separate supervisory authorities. The EU AI Act is enforced by the European AI Office at the EU level and national market surveillance authorities at the member-state level. GDPR is enforced by data protection authorities. Compliance with GDPR does not equal compliance with the AI Act. Firms need to address both.
4. Do my clients need to consent to AI use under the Act?
The EU AI Act does not create a general consent requirement for AI use. However, several provisions interact with client rights. Article 52 requires disclosure when AI generates content in human interaction contexts. GDPR consent requirements apply where client personal data is processed for AI purposes, depending on the legal basis for processing. Bar association ethics rules in multiple EU jurisdictions require disclosure of AI use in client matters — this is a professional responsibility question separate from the AI Act. The practical answer is: clients should be informed of AI use, the legal basis for that disclosure requirement varies by jurisdiction and context, and updating engagement letters to address AI use is best practice regardless of whether it is strictly required.
5. How do I document Article 53 compliance for my bar association?
Bar associations are not Article 53 enforcers — that sits with the European AI Office and national market surveillance authorities. Article 53 obligations fall on GPAI model providers, not on law firms as deployers. However, bar associations in several EU member states have published or are developing guidance on attorney obligations when using AI, including documentation requirements. For bar association purposes, the relevant documentation is typically: a record that AI was used in the matter, what the AI was used for, what human review was applied to AI outputs, and that the firm has a vendor relationship that includes appropriate data protection safeguards. Documenting your 10-point vendor verification process (see Chapter 3) provides the evidentiary foundation for responding to both bar association inquiries and regulatory questions about the firm's AI use.
LawyerAI evaluations are independent. We do not accept payment that influences our editorial scores. Featured placements (when introduced) will be clearly labeled and will not affect our 5-dimension scoring methodology. Our rankings reflect product reality at time of writing — we re-review every quarter and update lastReviewedAt accordingly.
If you spot an error, email editorial@lawyerai.directory. We correct in public and credit the reporter.
| UK entity; EU rep status not confirmed |
| Legora | EU by default | EU-native — compliance-first design | Partial — documentation available on request | Yes (EU-headquartered) |
| Definely | UK/EU | Unclear | Compliance documentation available on request | UK entity |
[Best Practice] Engage a qualified EU regulatory counsel to review the firm's AI Act compliance position, particularly for high-risk use case analysis.
[Best Practice] Monitor European AI Office guidance publications and EU harmonised standard development for updates that affect vendor compliance claims.
