AI Regulation Tracker / Legal profession
CCBE Publishes a Pan-EU Guide on Generative AI for Lawyers
Guidance, not a binding rule. On October 2, 2025, the Council of Bars and Law Societies of Europe issued its Guide on the Use of Generative AI by Lawyers. It maps how the existing duties of confidentiality, competence, independence, and client transparency apply when a lawyer uses a GenAI tool.
The CCBE is the body that speaks for the bars and law societies of Europe, and on October 2, 2025 it published a Guide on the Use of Generative AI by Lawyers. Read it for what it is. It is not a rule, it does not carry sanctions, and it does not add a single new duty to any lawyer's plate. What it does is take the professional obligations lawyers already carry and show, section by section, where a generative AI tool strains them. In the CCBE's own words, the Guide "aims to raise awareness of what generative AI (GenAI) is, to explain its current uses in legal practice and to highlight potential opportunities and risks associated with its use." It "deals only with professional ethics and regulations applying to legal practice," and it is built to be used "by lawyers, Bars and Law Societies or law firms."
That framing matters, because the value here is not a new command to follow. It is a clean map of the pressure points. If you run a firm, or you are drafting an AI use policy, or you are a US lawyer whose matters touch European clients and European data, this is the document that tells you which of your duties a chatbot puts at risk and why.
What duties does the Guide say GenAI puts under pressure?
The Guide organizes itself around the core duties of the profession. On confidentiality, the point is blunt. The moment a lawyer types client information into a tool, the confidentiality question is already live. The Guide warns that "the users themselves (i.e. lawyers) are responsible for the information they provide as an input to the system, and may be in breach of their professional obligations and/or relevant data protection laws already at the point of inputting the data into a system." It then walks through why: data entered into a consumer GenAI interface may be stored, reused to train the model, or accessed by the provider and third parties, often through cloud services. Professional secrecy does not pause because the interface is convenient.
On competence, the Guide is equally direct. Lawyers "are responsible for their work, the advice they give and the representations they make," and that responsibility now includes keeping "abreast with the technological developments affecting their practice." The most quotable line is the verification rule: lawyers should, "where the use case requires, verify the output of a GenAI before it is utilised in their work." Note the qualifier. The Guide does not demand that every output be checked in every case. It ties the intensity of verification to the risk of the task, which is a sensible standard and one a US court sanctioning a lawyer over fabricated citations would recognize instantly.
What does the Guide say about telling clients you used AI?
On transparency, the CCBE does not impose a blanket disclosure obligation. It uses a reasonable-client test. As the Guide puts it, "if it can reasonably be assumed that an informed client would object, make conditions, or otherwise have reservations in respect of use of the GenAI for the purpose in question, the lawyer should make sure to be transparent with the client." That is a judgment call, not a checkbox. It also covers independence, where the Guide flags algorithmic bias and AI sycophancy as forces that can quietly bend a lawyer's professional judgment, and conflicts of interest, where a shared tool used across many firms raises its own questions.
Why does a non-binding EU guide matter to a US lawyer?
Two reasons. First, if your practice touches EU clients or EU data, the CCBE Guide is the closest thing to a profession-level reference for how European bars think about these duties, and it interacts with obligations that are binding, including the EU AI Act's Article 4 requirement, in force since February 2, 2025, that organizations ensure staff have sufficient AI literacy. Second, even setting Europe aside, the analysis travels. The duties the Guide stress-tests, confidentiality, competence, candor, and client communication, are the same duties US bar authorities and courts are enforcing when a lawyer files a brief full of hallucinated cases. A well-structured European checklist of where AI breaks those duties is useful wherever you practice.
What should a firm actually do with it?
Treat it as a policy input, not a mandate. Use its five headings, confidentiality, competence, independence, transparency, and conflicts, as the skeleton of your own AI use policy. Decide which categories of matters require output verification and write that down. Set a rule on what client data may never be entered into a general-purpose tool. Decide when you will tell a client that AI was used. None of this is compelled by the Guide, because the Guide compels nothing. All of it is easier to defend if a regulator, a client, or a court ever asks how your firm was governing AI when something went wrong.
Questions professionals are asking
Is the CCBE Guide binding on lawyers?
No. It is non-binding guidance from the Council of Bars and Law Societies of Europe. It creates no new obligation, carries no sanction, and does not amend any national bar rule. It interprets how a lawyer's existing duties apply when generative AI is used.
Does the Guide require lawyers to check every AI output?
Not every output in every case. It says lawyers should, where the use case requires, verify the output of a GenAI before it is used in their work. The level of verification is tied to the risk of the task, so higher-stakes work calls for closer checking.
Do lawyers have to tell clients they used AI?
There is no blanket disclosure rule. The Guide uses a reasonable-client test: if an informed client would reasonably object, set conditions, or have reservations about the AI use for that purpose, the lawyer should be transparent with the client about it.
Why should a US lawyer care about an EU guide?
Because the duties it stress-tests, confidentiality, competence, candor, and client communication, are the same ones US courts and bar authorities enforce over AI misuse. It is also directly relevant if your work touches EU clients, EU data, or the EU AI Act's AI-literacy requirement in force since February 2, 2025.
RELATED BRIEFINGS
Browse the full AI Regulation News tracker
Informational analysis for working professionals, not legal advice. Confirm how any guidance or professional rule applies to your situation with qualified counsel in the relevant jurisdiction.