The 2020 CJEU ruling that invalidated the EU-US Privacy Shield and imposed conditions on Standard Contractual Clauses for transfers of EU personal data to the United States.
Last reviewed: 2026/05/22
Where a legal AI vendor physically stores and processes client data — a compliance requirement under GDPR, data sovereignty laws, and attorney confidentiality obligations.
SecurityRegulation 2024/1689, the world's first comprehensive AI law, classifying AI systems into four risk tiers with obligations applying to providers and deployers including law firms.
SecurityEU Regulation 2016/679 governing personal data collection, processing, and transfer for EU residents — directly applicable to law firms using AI tools on EU client matters.
European-compliant AI legal platform with built-in GDPR safeguards for contract review and research.
Modern AI workspace for collaborative legal work, EU-grown.
The most expensive legal AI in the market — Am Law 100 firms only.
Conversational legal research with real-time Shepard's citation validation.
Move from this definition to role-based legal AI shortlists and the selection criteria that matter for each type of legal team.
Am Law 200 and global firm workflows: accuracy at scale, security compliance, and matter-level auditability.
Legal department workflows: contract lifecycle, regulatory tracking, outside counsel management, and risk.
Last reviewed: 2026/05/22. Definitions are written by the LawyerAI Editorial team. Commercial relationships are disclosed and do not determine editorial scores or conclusions. See our Sponsorship & Affiliate Disclosure.
Schrems II refers to the July 16, 2020 judgment of the Court of Justice of the European Union (CJEU) in Case C-311/18, Data Protection Commissioner v. Facebook Ireland Limited and Maximillian Schrems. The ruling had two principal holdings: it invalidated the EU-US Privacy Shield framework — which had been the primary legal mechanism allowing US companies to receive personal data from EU entities — and it upheld Standard Contractual Clauses (SCCs) as a valid transfer mechanism, but with a condition: SCCs are only sufficient if supplementary measures are in place to ensure that the level of data protection in the destination country is equivalent to the protection guaranteed within the EU under the GDPR.
The ruling's significance for transatlantic data flows — and for any EU law firm or legal department using US-hosted software — is structural. It is not a compliance checkbox that can be satisfied by signing a contract. The Court held that the legal framework of the destination country (in this case, the United States) must itself be evaluated, and that US surveillance law renders the United States unable to guarantee GDPR-equivalent protection for EU personal data in certain circumstances. That structural problem cannot be resolved by any contractual provision alone.
The legal sector processes among the most sensitive categories of personal data under GDPR: legal professional privilege communications, personal data relating to legal proceedings (Article 9 and 10 GDPR special categories), financial records, and data of vulnerable individuals. For European law firms and in-house legal departments, the question of whether their software vendors — particularly US-based AI vendors — can lawfully process EU client data is not a compliance formality. It is a threshold question for any deployment.
The practical implication of Schrems II for legal AI is this: a European law firm that routes EU client data through a US-hosted legal AI platform must have a valid legal basis for that transfer under GDPR Chapter V. Since Privacy Shield was invalidated, the primary available mechanisms are Standard Contractual Clauses (updated 2021 EU Commission SCCs) and the Trans-Atlantic Data Privacy Framework (TADPF, July 2023). Neither mechanism is unambiguously settled.
SCCs require a Transfer Impact Assessment (TIA) — an analysis of whether the specific transfer, given the specific data, the specific recipient, and the surveillance law of the specific country, can be adequately protected through the SCCs plus whatever supplementary measures are available (encryption, pseudonymization, limiting personal data to what is strictly necessary, etc.). A TIA is a legal analysis, not a form — it requires the transferring entity to genuinely assess whether US intelligence law's access to the data is a realistic risk given the specific use case. For a legal AI platform processing EU client personal data, including data relating to ongoing legal matters, the realistic risk is not negligible.
The TADPF, adopted by EU Commission adequacy decision in July 2023, partially restored the legal basis for EU-US transfers for US organizations certified under the framework. The TADPF introduced a Data Protection Review Court (DPRC), a new redress mechanism for EU individuals whose data is accessed by US intelligence agencies, as the mechanism to address the CJEU's concerns about surveillance access. Max Schrems and his organization NOYB (None of Your Business) challenged the TADPF before the CJEU in September 2023. As of 2026, that challenge is pending, and the TADPF's durability is legally uncertain. US vendors relying solely on TADPF certification as their EU data transfer mechanism are carrying legal uncertainty that their EU customers need to understand.
The 2025 IAPP (International Association of Privacy Professionals) Corporate Privacy Survey found that 64% of EU-based privacy counsel rated transatlantic data transfer compliance as their highest-priority data protection legal risk, ahead of GDPR enforcement and AI Act compliance. For legal AI specifically, the combination of sensitive legal data and US-hosted infrastructure makes this the most legally exposed category of technology deployment.
Law firms advising clients on GDPR compliance and data transfer matters have a secondary obligation: the instruments and vendors they use for legal work should themselves be consistent with the advice they give. A law firm advising corporate clients on US-EU data transfer compliance while using US AI tools that lack a verified transfer mechanism creates a credibility and consistency problem in addition to a direct compliance risk.
The Schrems II ruling addressed a structural incompatibility between EU law and US surveillance law. The CJEU found that FISA Section 702 — the provision of the Foreign Intelligence Surveillance Act that authorizes collection of communications of non-US persons from US electronic communications service providers — and Executive Order 12333, which authorizes foreign intelligence collection outside the US, create access rights for US intelligence agencies that are incompatible with the rights guaranteed by the GDPR and the EU Charter of Fundamental Rights.
The core incompatibility is proportionality. EU law (GDPR Article 52, Charter Article 52) requires that limitations on fundamental rights be proportionate to a legitimate objective. FISA Section 702 authorizes bulk collection without individualized suspicion, and EU data subjects have no effective judicial redress against such collection under US law. The CJEU found that this structural feature of US law cannot be fixed by a contract between two private parties.
Standard Contractual Clauses are pre-approved contractual templates issued by the European Commission (updated June 2021) that specify data protection obligations between data exporters and data importers. They remain valid post-Schrems II, but subject to the TIA requirement. A TIA must assess: whether the destination country's surveillance laws would prevent the data importer from complying with the SCCs; whether technical measures (encryption, data minimization) sufficiently reduce the surveillance risk; and whether the likelihood of government access to the specific data is realistic given its nature and the profile of the data importer.
For most commercial legal AI vendors, a TIA must address whether FISA Section 702 targets entities like the vendor (large technology companies providing "electronic communication service" to US persons and non-US persons) and whether EU personal data processed by the vendor would be within the scope of a potential Section 702 directive. For cloud-hosted AI platforms processing communications and documents, the answer is not clearly "no."
The Trans-Atlantic Data Privacy Framework created a US Executive Order 14086 (October 2022) framework for US intelligence collection to include proportionality principles and a new DPRC as the redress mechanism. The EU Commission adopted an adequacy decision for the TADPF in July 2023, restoring the equivalent of Privacy Shield for certified US entities. Certification requires US organizations to self-certify to the Department of Commerce that they will comply with the TADPF principles for EU personal data.
The pending NOYB/Schrems challenge to the TADPF argues that Executive Order 14086 does not fundamentally change the surveillance access problem — it is a policy commitment by the executive branch that can be revoked or reinterpreted, not a statutory limitation enforceable by EU data subjects. If the CJEU agrees and invalidates the TADPF as it did Privacy Shield, US organizations relying on TADPF certification will again need an alternative transfer mechanism. The uncertainty this creates for legal AI deployments is concrete and ongoing.
LegalFly is the clearest case of Schrems II compliance by architecture. As an EU-hosted platform, LegalFly processes EU client data within the EU. There is no trans-Atlantic data transfer to assess or justify. For European law firms and in-house departments processing EU personal data, LegalFly's architecture eliminates the Schrems II compliance question entirely. Limitation: EU-only infrastructure means that US-based legal matters, US case law research, and US client data may receive less optimized performance, and certain US legal AI features (US court database integrations, US-specific practice area tools) may be less developed.
Legora is similarly EU-native in design and deployment, positioning EU data protection compliance as a core product feature rather than an afterthought. For EU legal teams, Legora's architecture means Schrems II compliance is resolved at the infrastructure level. Limitation: as with LegalFly, US-market feature coverage and integrations may be lighter than US-headquartered competitors.
Harvey AI is a US-based AI company with EU enterprise customers. Harvey's EU data transfer mechanism relies on TADPF certification and SCCs. Harvey has published documentation of its GDPR compliance program, including DPA (Data Processing Agreement) templates that address Chapter V transfer requirements. Limitation: TADPF certification is subject to the legal uncertainty of the pending Schrems challenge. EU law firms deploying Harvey for matters involving EU personal data should document their TIA analysis, should not rely solely on Harvey's TADPF certification as sufficient transfer justification, and should monitor the CJEU case development. A contingency plan for if TADPF is invalidated — such as an EU data processing option or migration to an EU-hosted alternative — is prudent risk management.
Lexis+ AI (LexisNexis) serves major European law firms and in-house departments. LexisNexis is a large US corporation subject to FISA Section 702. Its enterprise contracts include GDPR Data Processing Agreements and SCCs. Whether an EU processing option (EU-hosted infrastructure) is available for LexisNexis's AI features should be verified contractually — availability varies by product and contract type. Limitation: the standard SaaS deployment routes through US infrastructure; EU data sovereignty options require specific contractual arrangements that not all customers negotiate.
Identify which legal AI tools process EU personal data. This includes any tool used in matters involving EU individuals, EU companies, or EU regulatory filings — not just tools explicitly marketed for EU markets. A US law firm representing a European company in US litigation may be processing EU employee data, EU commercial contracts, or EU regulatory correspondence through its AI tools.
Request and review the vendor's Data Processing Agreement (DPA) and Chapter V transfer mechanism documentation. The DPA should specify: whether the vendor is a data processor or controller, what transfer mechanism is used for EU-US data transfers, whether EU-hosted processing is available, and what supplementary measures are in place. If the vendor cannot produce a DPA with specific Chapter V language, the transfer does not have an adequate legal basis.
Complete a Transfer Impact Assessment for US-hosted tools processing EU personal data. A TIA is a legal analysis, not a vendor-supplied form. It should assess whether the specific data being processed (legal matter communications, personal data of EU individuals) is realistically at risk of US intelligence access given the nature of the vendor and the data. Document the TIA and its conclusion before deployment. Update it if the legal landscape changes (e.g., TADPF invalidation).
Establish a contingency plan for TADPF invalidation. Given the pending NOYB challenge to the TADPF, US vendors relying on TADPF certification should not be the only transfer mechanism in your compliance analysis. Identify whether the vendor offers EU-hosted processing options, whether an alternative EU-native tool exists, and what the data migration process would be if you needed to transition. This contingency analysis should be completed before deployment, not in the event of a crisis.