Blog
Filings, personal data and artificial intelligence.
A few pieces, written when we have something to say: what actually leaves an office when a filing ends up in a chat window, where hand work goes wrong, and which words to use when somebody asks what happened to the data.
Using AI responsibly
An AI policy for a three-person firm
One page, six sections and a list of permitted tools. Twenty-page policies do not get read, and an unread rule is not a measure.
Notaries
Your practice software added AI: ten questions for the supplier
A “summarise” button inside software that already holds the data is not the same as one that sends it out. How to tell, and what to ask.
Accountants
If the firm uses AI, it has to appear somewhere
Record of processing, impact assessment, processor appointment: the paperwork that using artificial intelligence sets off.
Journalists
Four hundred pages, one night, and no document leaves the room
What a model genuinely does well on an anonymised file, what it still makes up, and where human checking cannot be delegated.
Lawyers
The file also holds data about people who are not your client
Witnesses, children, experts, the other side: people who signed nothing with the firm, and whose data leaves along with the filing.
Notaries
Having a model draft a clause without giving it the parties
The precedent bank is the part you can share, the parties are the part you cannot. How to separate what the model needs from what it does not.
Journalists
Essentiality is a rule you already have, applied from the wrong end
Italy’s rules of conduct have long required publishing only indispensable data. The same question, asked before uploading a file, has a shorter answer.
European rules
The AI Act for people who only use artificial intelligence
The dates that matter, the role a professional firm falls into, and the one obligation that has applied to it from the start: staff AI literacy.
European rules
The document that leaves the European Union
Almost every large model sits in the United States. What Chapter V of the GDPR requires, which instruments exist, and how stable they are.
Journalists
A whistleblower is protected from all but the document they gave you
Italian Decree 24/2023 protects a whistleblower’s identity and everything it can be inferred from, even indirectly. A company document is made of that.
Lawyers
The bill for redacting by hand
Twenty minutes a file, an error now and then, and a rule nobody follows at nine in the evening. Why the manual route does not hold, and what it really costs.
Accountants
A tax return pasted into a chat identifies more than one person
Dependants, medical deductions, charitable giving: a tax return describes the life of the person signing it and of the people around them.
Journalists
The wall around a source has no doors, but you have a window
Article 200 of the Italian criminal procedure code and the EMFA protect a source from those hunting for it. Neither covers a document you upload yourself.
Notaries
Sheet, parcel, unit: why land registry data identifies
A land registry reference is an address, and an address can be searched. Removing the names and leaving the registry data anonymises nothing.
Accountants
A payslip carries data the GDPR treats separately
Sickness, union deductions, salary assignments: a payslip is not an ordinary document, and under Article 9 you start from a prohibition.
Notaries
The anti-money-laundering file is not a document like the others
One purpose, ten years of retention, and the Article 39 prohibition: why due diligence data does not leave, not even for a summary.
Using AI responsibly
When the model invents a judgment
The Court of Florence dealt with a filing citing judgments that did not exist. What it decided, and what it teaches about review.
European rules
The GDPR in front of a language model
Opinion 28/2024, the C-413/23 P judgment on pseudonymisation and Guidelines 02/2026: what they mean for people who only use a model.
Lawyers
Researching precedent without handing over the file
The most common way firms use AI is also the most exposing, and it is unnecessary: the model needs the legal question, not the parties.
Using AI responsibly
Human review is not a checkbox at the bottom of the screen
“Checked by a professional” is worth as much as the conditions that check happens in. What makes a review real rather than formal.
Notaries
A notarial deed handed to a model: what actually leaves
For a notary the secrecy rule is not the one that applies to other professionals, and the AML file is a separate case. What a draft deed contains.
Lawyers
Telling the client you use AI: what to write, and where
Article 13 of Italian Law 132/2025 requires informing the client. The form is not prescribed: what the notice has to say, and where it belongs.
Using AI responsibly
What a model remembers about what you gave it
Training, request retention and conversation history are three different things with three different answers. Where to look for each.
Accountants
The values that verify themselves, and the ones that get guessed
Tax codes, VAT numbers and IBANs carry a check character that can be computed. Company names and addresses do not, and the difference matters.
Accountants
A client’s accounts in a chat: what the firm is risking
Removing the company name does not remove the identification, and a payslip carries special categories. Who answers, for how much, and what can be done.
Using AI responsibly
Local or cloud: the question that comes before the others
Where the program runs decides who sees the documents, how many contracts you need and what goes in the record. The other questions come after.
Lawyers
Professional secrecy in front of a text box
What a pleading pasted into a chat actually touches: Article 622 of the Italian criminal code, the bar’s code of conduct, and the GDPR.
European rules
Italy’s AI statute, read from a professional firm
Law 132/2025 has been in force since 10 October 2025. Article 13 covers lawyers, notaries and accountants, and asks two precise things.
Using AI responsibly
What stays in a file after you take the names out
Tracked changes, comments, document properties, the text layer under a scan. Five things that survive an anonymisation done by reading the page.
Using AI responsibly
Redact or substitute: two different jobs on the same filing
A black box and a placeholder solve different problems. When you need each, and why the word “anonymisation” blurs them together.
Lawyers
Handing a court filing to an AI: what leaves the office
What happens when a filing ends up in a chat window, what the GDPR and professional secrecy require, and what to take out of the text before you press enter.
Try it on a case you have already closed.
Three days with every feature. The filing stays on your computer, and at the end of the trial you decide.