A lawyer, accountant or consultant who puts a client's material into an AI tool has disclosed it to a third party. Whether that breaches the duty owed to the client depends on questions that must be answered before the tool is adopted, not after. These are the questions.
Need an answer on your own situation? Write to us through the enquiry form or message us on WhatsApp: we reply within one business day.
A lawyer who pastes a client's draft agreement into a general purpose AI tool has disclosed that document to a third party. So has an accountant who uploads a client's management accounts, and a consultant who summarises a confidential board pack. Whether the disclosure breaches the duty owed to the client does not depend on how useful the tool was. It depends on questions about that tool which have to be answered before anyone uses it, and which almost nobody asks at the point of use.
The duty is owed to the client, not to the firm
Confidentiality in a professional relationship belongs to the client. The firm holds the information subject to it and cannot relax it for its own convenience, its own efficiency, or its own margin. The obligation continues after the retainer ends.
That framing settles a question people find difficult. The issue is not whether the firm trusts the supplier. It is whether the client agreed that their information could be handed to that supplier at all. Unless the answer is yes, or the disclosure falls within what the client can be taken to have authorised, the firm is exposed regardless of how well the supplier behaves.
For an advocate the exposure is not only to the client. The Advocates Law, Cap. 2, provides in Part IV for the discipline of advocates, and section 17 for disciplinary offences and the procedure that follows. A disclosure that would not survive scrutiny by the client is unlikely to survive scrutiny there either.
There is a separate and parallel exposure under data protection law. Where the material contains personal data, putting it into a supplier's system is processing, and it is governed by Regulation (EU) 2016/679 and, in Cyprus, by Law 125(I)/2018. The confidentiality analysis and the data protection analysis are different questions with different answers, and a firm that has satisfied itself on one has not answered the other.
Privilege is a separate and more fragile question
Confidentiality and privilege are not the same thing, and the second is easier to damage. Privilege protects communications between a lawyer and a client for the purpose of legal advice, and its practical value lies in the fact that the material cannot be compelled from either of them.
Disclosure to a third party is capable of putting that protection at risk. The analysis turns on the circumstances of the disclosure and the terms on which the third party holds the material, and it is fact sensitive. The prudent course for any firm is to treat privileged material as the category that never goes into a general purpose tool, and to run that as an absolute rule rather than a judgement call made by a fee earner under time pressure.
The questions to answer before a tool is adopted
These are answered from the supplier's contract and its technical documentation, not from its marketing.
Where does the data go, and who can read it. Which entity receives it, in which country, and which of its personnel or sub-processors can access it. A supplier that will not identify its sub-processors cannot be assessed.
Is the input used for training. If material submitted by users is used to develop the model, the firm has not merely disclosed the client's information, it has contributed it to a system that other people will use. Consumer grade services and enterprise services frequently differ on this point, and the difference is usually in the terms rather than in the interface.
How long is it retained, and can it be deleted. A retention period that outlasts the retainer, or a deletion right the supplier does not actually offer, is a problem the firm inherits.
What happens on a breach or a demand. Whether the supplier will notify the firm, and whether it will tell the firm before disclosing client material to a court, a regulator or a law enforcement agency in its own jurisdiction.
Confidentiality and liability in the contract. Whether the supplier accepts a confidentiality obligation at all, and what the liability cap is against the value of the information at risk. On standard consumer terms it is usually nominal.
Until these are answered in writing, the operating rule should be that no client material of any kind is entered into the tool. That is a workable position: the tools remain available for material the firm generates about itself, for public documents, and for tasks that involve no client information at all.
The confidentiality analysis and the data protection analysis are different questions with different answers, and a firm that has satisfied itself on one has not answered the other.
Supervision does not transfer
Where a tool is used, the work remains the professional's work. An output that has not been verified against the primary source is not research, and a document that has not been read against the file is not a draft. Responsibility for what the firm sends out sits with the person who sends it, and neither the supplier's disclaimer nor the client's knowledge that the firm uses such tools moves it.
This has a practical consequence for how firms supervise. The check has to be recorded: who verified, against what, and when. A firm that cannot show the verification step has no answer to a complaint about an error, and it also has no way of telling whether the tool is helping.
If you are at this point
The questions in this section are answerable in an afternoon. Ask us before the first client file goes in or write to office@kleanthousplatis.com.
Conflicts and information barriers
A firm that maintains information barriers between matters should consider whether a shared tool crosses them. Where material from one matter can influence output produced on another, an arrangement designed to keep two teams apart has been undermined by a system nobody thought of as a channel.
Telling the client
The cleanest position is agreement in advance. Where the firm intends to use these tools on client work, say so in the engagement terms, describe the categories of material involved, and give the client the ability to object. Firms that do this find that most clients do not object, and that the small number who do are precisely the ones who would have complained afterwards. Some clients now impose the requirement in the other direction, and their own terms of business should be checked before any tool is used on their matters.
What to send us
Your engagement terms, the supplier contracts and terms of service for any tool in use, your internal policy if you have one, and a description of the material staff currently put into these tools. If client information has already been disclosed and you are considering what to do about it, send the sequence of events first.
Professional services, data and technology work sits within our corporate and commercial practice. For the employer's policy obligations across a wider workforce, see Generative AI at Work. For the regulatory position, see The EU Artificial Intelligence Act.
Send what you have to office@kleanthousplatis.com, or through the enquiry form. We reply within one business day.
Questions we are asked
Does the Digital Services Act reach a law firm's tools?
It reaches the providers, not the users. Law 122(I)/2025 implements Regulation (EU) 2022/2065 and applies, under section 3, to providers of intermediary services established in the Republic, whose legal representatives are here, who have a substantial connection with the Republic, or who supply intermediary services into the Republic without one. A firm using a tool is a recipient of the service; the question of who is regulated turns on who provides it, and where.
Who supervises it in Cyprus?
Section 4(1) of Law 122(I)/2025 designates the Radio Television and Digital Services Authority as Digital Services Coordinator under Article 49(2) of the Regulation. Section 4(2) requires it to act with impartiality, transparency and complete independence, and neither to seek nor to take instructions from any public sector authority or private body. Section 14(1) makes its decisions directly enforceable, with a recourse to the Administrative Court under Article 146 by section 14(2).
What happens if a provider we rely on is in breach?
Section 20(1) makes an act or omission in breach of any provision of the Regulation an offence carrying up to one year or a fine of up to EUR 10,000, or both. Section 20(2) sets the real ceiling: where a fine is imposed it shall not exceed five per cent of the average daily worldwide turnover or income of the provider in the preceding financial year, per day, from the date fixed in the decision. Section 20(3) allows the court to make interim or final orders to stop or suspend the act or omission.
Is putting a client's document into an AI tool a disclosure?
Yes. A lawyer who pastes a client's draft agreement into a general purpose AI tool has disclosed that document to a third party, and so has an accountant who uploads management accounts or a consultant who summarises a confidential board pack. Whether the disclosure breaches the duty owed depends on questions about the tool that have to be answered before anyone uses it, and which almost nobody asks at the point of use.
Can the firm decide for itself that a tool is safe enough?
No, because confidentiality in a professional relationship belongs to the client. The firm holds the information subject to it and cannot relax it for its own convenience, efficiency or margin, and the obligation continues after the retainer ends. The question is not whether the firm trusts the supplier but whether the client agreed that their information could be handed to that supplier at all.
What is the exposure for an advocate specifically?
It is not only to the client. The Advocates Law, Cap. 2, provides in Part IV for the discipline of advocates and in section 17 for disciplinary offences and the procedure that follows, and a disclosure that would not survive scrutiny by the client is unlikely to survive scrutiny there either. Where the material contains personal data there is a separate and parallel exposure under data protection law.
Related Reading
Technology & E-Commerce in Cyprus
Professional Negligence Claims in Cyprus
This article is for general information only and does not constitute legal advice. Laws and their application can change, and individual circumstances differ. For advice on your own matter, contact Klitos Platis at klitos@kleanthousplatis.com or telephone +357 22 680 330.
Klitos Platis
Advocate, Partner
Kleanthous & Platis LLC, Nicosia · Revised 4 August 2026
Need advice on your own matter?
Write to us at office@kleanthousplatis.com with the names of everyone involved and a short description, and we will reply within one business day. We will ask for the documents once we confirm we can act.
Or use the enquiry form, message us on WhatsApp, or call +357 22 680 330.
When Cyprus law changes, hear it from us
One short email when something changes that matters: new legislation, a decision worth knowing, a deadline. Written by the partners, no marketing, unsubscribe with one click.
You are on the list. The next update on Cyprus law will reach your inbox.
That did not go through. Please write to office@kleanthousplatis.com and we will add you.
Your address is used for these updates and nothing else.