The question “can the firm use artificial intelligence” has a long answer and a short one. The short one is yes. The long one is that from the moment you start, three documents have to say so (and a fourth that always gets forgotten), and nobody looks at any of them until somebody asks.
The record of processing
Article 30 GDPRopens in a new tab requires the controller to keep a record of processing activities, with the purposes, the categories of data subjects and data, the recipients, transfers to third countries and the erasure periods.
Using an AI tool on client documents touches at least three of those columns. It adds a recipient, if the supplier receives the data. It can add a transfer, if the supplier sits outside the Union. And it changes the security measures described, which is the column where the record stops being a list and becomes a statement.
The exemption for organisations under 250 employees does not help: it does not apply where the processing is not occasional, and a firm’s processing never is.
The row, written out
“Update the record” stays an intention until somebody writes the row, and the row is shorter than the word compliance makes you fear. This is the shape it takes when the document leaves for a supplier.
Purpose: supporting the drafting and analysis of documents in carrying out the engagement. Categories of data subjects: clients, their employees, opposing parties and third parties named in the documents. Categories of data: identifying, tax and payroll data and, where they occur, special categories under Article 9. Recipients: the supplier, by company name, appointed processor under the agreement of [date]. Transfers: to [country], on the basis of [adequacy decision / standard contractual clauses], with a transfer impact assessment dated [date]. Erasure periods: those the supplier states, [n] days, plus backups. Security measures: substitution of identifying data before sending, human review of the proposed values, written instructions to authorised persons.
Where the tool runs in the office instead, the same row visibly shortens: the recipients and transfers fields stay empty, because there is nobody the data was disclosed to, and the purpose attaches to processing the record already described. That is the difference between adding a processing activity and describing an existing one better, and you can see all of it in two boxes.
The processor appointment
If the supplier processes data on your behalf it is a processor, and Article 28 requires a written contract setting out the subject matter, duration, nature and purpose, types of data, categories of data subjects and the processor’s obligations, including authorisation for sub-processors.
The practical point is that this contract either exists or it does not. Accepting the terms of a free service by clicking a button is not a processor appointment, and that is the position of anyone using the consumer version of an assistant on work documents.
The impact assessment
Article 35 requires an impact assessment where processing is likely to result in a high risk to people’s rights and freedoms, and lists large-scale processing of special categories among the typical cases. A firm handling payslips or returns with medical deductions is processing special categories; add sending that to an outside supplier using a new technology, and the assessment has to at least be done and written down, even if only to conclude that the high risk is not there.
The conclusion matters less than having written it: that is the accountability principle in Article 5(2), where being right is not enough, you have to be able to demonstrate it.
The fourth document, the one that gets forgotten
The three above are the ones people discuss. There is a fourth that needs no assessment at all and that almost nobody updates: the privacy notice clients have already signed.
Articles 13 and 14 GDPR require telling data subjects, among other things, the recipients or categories of recipients of their data and whether there is a transfer to a third country, with the safeguard it rests on. A supplier that was not there before is a recipient that was not there before: a notice that does not name it describes processing that is no longer the processing going on.
It is worth not confusing this with the other information duty, the one in Article 13 of Italian Law 132/2025opens in a new tab, which is about the use of artificial intelligence in the work rather than the destination of the data. They are two different sentences, in two documents that may well be the same sheet of paper, and anyone who writes only one has usually written the easier one. How to write the second is its own piece.
The setup that shortens the list
All three obligations come from the same fact: the data leaves. If it does not leave, the picture changes. A program running on the firm’s own computers is not a recipient, not a processor and does not produce a transfer: it is a tool, like the practice software installed in the office.
Your own processing remains, and that was already in the record. This is why Omissia works locally, and also why the account area offers a compliance document: a letter with the date, time and version of the text, to file alongside the record.
The duty to inform the client, which is a different thing again and lives in Italian Law 132/2025, is in a piece of its own.