From personal AI subscriptions to a practice you can defend: how law firms start safely in six weeks
Adam D. Wisniewski, Managing Partner19 October 2026
In small law and fiduciary firms, AI is mostly used through personal subscriptions: without a contract, without informing clients, without a written rule and without evidence. Our approach closes this gap in six weeks, with around eight hours of the partners' time and no change to how the firm works day to day. Further steps follow, up to automated workflows and digital services, each decided separately on the basis of measurement.
What we see in small firms
AI has long since arrived in most law and fiduciary firms. Partners summarise files with a chatbot, staff have letters drafted, someone translates a clause. Mostly this happens through personal subscriptions that individuals took out themselves.
That is understandable: the tools are good and the benefit is immediate. But a gap remains, and it only becomes visible when someone asks.
| Today, often | After the set-up | |
|---|---|---|
| Accounts | Personal subscriptions on consumer terms | A firm-owned workspace on commercial terms |
| Client material | Depending on provider and settings, used to train models | Excluded from model training by contract |
| Contracts | No agreement governs the processing | Processing agreement and confidentiality undertaking |
| Clients | Not informed, nothing in the engagement terms | Information sheet and engagement clause |
| The rule | Judgement in the moment, case by case | One written rule on what may be processed |
| Evidence | Nothing you could show if asked | A file for clients, insurers or the supervisor |
The question is not whether your firm uses AI. The question is whether you can prove how, when a client asks.
Why this matters especially for firms
Law and fiduciary firms work with information entrusted to them in confidence. For lawyers, professional secrecy is anchored in law, and breaching it is a criminal offence. For everyone, the Data Protection Act applies, which the FDPIC considers directly applicable to AI.
Anyone entrusting client data to an external service therefore needs three things: a contract governing the processing, a confidentiality undertaking from the provider, and control over who can access what. A personal subscription meets none of these.
Where does your firm stand? The AI check for law, fiduciary and advisory firms shows in five minutes whether your current use of AI is defensible and what would pay off. Free of charge, with an instant result.
Level 1: the set-up in six weeks
The set-up is deliberately lean. It does not change how the firm works, only the basis on which it works.
Weeks 1 and 2: foundations. A firm-owned workspace is set up and personal accounts are retired. The existing Microsoft 365 environment is connected, with deliberately limited reach. Each active matter gets its own separate space. The partners invest one 90-minute session on their recurring tasks and take three decisions.
Weeks 3 and 4: the compliance file. The processing agreement and the confidentiality undertaking are put in place. Possible foreign authority access is assessed and documented. Added to this are a client information sheet, an engagement clause, an internal directive and a written rule on what may be processed. The partners need around three hours to review and sign off.
Weeks 5 and 6: the firm’s own way of working. From around 25 past letters, we capture how the firm writes: structure, wording, terminology in German and English. Ready-made instructions are prepared for the recurring tasks. At the same time a baseline measurement starts, so the gain is later proven rather than assumed. Two short training sessions, then ordinary use.
In total, that is around eight hours of the partners’ time, spread over six weeks.
Three decisions that lie with the firm
- Processing location: Is processing outside Switzerland acceptable for now, or is a dedicated workspace with processing in Europe needed first?
- Who gets access: Which staff use the environment, and how far does their access into the files reach?
- What stays out: Are specific clients, matters or types of work excluded from AI use entirely?
What deliberately does not happen
No new filing system, no reorganisation of folders, no new software. The firm keeps working in Word, Outlook and its existing filing.
Where it goes next
After the set-up, each further level is a separate decision, taken on the basis of what has been measured.
| Level | What is created | Value for the firm |
|---|---|---|
| 2 Own workspace | Processing in Europe, own retention rules, a record per matter, templates and deadline calculation | The remaining compliance gaps close |
| 3 Email and tasks | Mail matched to the matter, deadlines and replies prepared, the firm approves | The inbox stops setting the agenda |
| 4 Repeatable matters | Standard processes as approved playbooks | Routine matters take a fraction of the time, fixed fees become viable |
| 5 Digital services | Standardised reviews online, for example of employment references or clauses, reviewed by the firm | Revenue no longer bound to personal hours |
The last level is the most important strategically. AI-based providers will offer standardised legal and fiduciary services more cheaply. Firms that turn their own knowledge into such services stay a step ahead of this competition.
What the firm can say afterwards
At the end of the set-up, the firm has a statement it can stand behind with clients, insurers and the supervisor: AI assistance on commercial terms with no training on client data, with a processing agreement and a confidentiality undertaking, a written rule on what may be processed, and the firm’s review and approval of all substantive output.
That is less spectacular than an AI project. But it is the foundation on which every further level can build safely.
Frequently asked questions
May law firms use AI with client data?
Yes, as long as professional secrecy and data protection are preserved: a provider on commercial terms, a processing agreement, a confidentiality undertaking, a written rule and control over who can access what. The details depend on your professional rules.
How much partner time does the set-up take?
Around eight hours over six weeks: a 90-minute session at the start, about three hours to review and sign off the compliance file, and two short training sessions.
Do we have to inform our clients?
Transparency is advisable and, depending on professional rules, required. A short information sheet and a clause in the engagement terms work well, with a path for clients who decline AI support.
Is processing outside Switzerland acceptable?
That is one of the three decisions that lie with the firm. We document the assessment of possible foreign authority access so the decision is reasoned. Firms that require processing in Europe start with their own workspace from step 2.
Where does your firm stand today?
The Professional Services page shows the approach at a glance, with the differences for law firms, fiduciaries and asset managers.
See the approach for professional servicesThis article belongs to Step 0: Where you stand. Where do we really stand?
