The CCBE's European guide on generative AI: risks and professional duties for lawyers

The Council of Bars and Law Societies of Europe (CCBE), which brings together the bars of the European Union countries and other European states, published its Guide on the use of generative AI by lawyers on 2 October 2025. It is a guide, not a binding rule, but it offers something useful for any firm: a map that links the risks of generative AI to the professional duties that already exist.

Its underlying idea is that the technology is new, but the lawyer's obligations are not. What changes is how they are met.

How it is organised

The guide has an executive summary and six sections: introduction, basic concepts and legal definitions, adoption, benefits and risks, professional obligations, future issues and conclusions. An annex collects national and international guidance for lawyers and judges.

The risks it identifies

Hallucinations

The guide warns that outputs can include fictitious case law, non-existent decisions, false quotations or invented arguments. In Spain there are already courts that have sanctioned filings with this problem, as we report in our review of the cases of fake case law.

Confidentiality and data protection

The prompts and files uploaded to a tool can be stored, used to train models or remain accessible to the provider or third parties. The guide also notes that it is not always clear whether that data can be deleted in practice.

Bias and sycophancy

Models can reproduce biased patterns and tend to agree with the user. The guide calls this last phenomenon sycophancy: the risk that the tool confirms the lawyer's thesis instead of testing it.

Opacity, intellectual property and fraud

Models work to a large extent as black boxes, which makes it hard to verify their reasoning. Training data may be protected by copyright and some terms of use claim rights over what the user enters or receives. Added to this are cybersecurity risks, such as prompt injection, and fraud through impersonation and fake videos or audio.

The professional duties affected

• Professional secrecy. The lawyer remains responsible for what they enter into the tool. They must not input client data without safeguards and must understand how the provider handles data.
• Competence. They must verify outputs when the task requires it, know the capabilities and limits of their tools and train. The guide recalls the AI literacy duty in Article 4 of the European Regulation.
• Independence. Bias, sycophancy and excessive dependence can erode one's own judgement. The lawyer must keep their analysis independent.
• Information to the client. The guide asks for transparency when an informed client would probably object or have reservations. It does not frame this as a formal consent requirement.
• Conflicts of interest. Systems shared among several clients can cause information to cross by accident.
• Loyalty and proper administration of justice. An unverified output can mislead a court.

These duties have their equivalent in the Code of Ethics of the Spanish Legal Profession, starting with the professional secrecy regulated by its Article 5 and the duty of independence.

The practical recommendations

The guide proposes concrete measures that any firm can apply:

1. Do not enter personal or client data unless there are safeguards: contractual confidentiality, zero retention, a data processing agreement or a local or protected environment.
2. Review the provider's terms, adjust the privacy settings and consider data processing within the EU or the EEA.
3. Verify outputs before using them, especially legal and case-law citations.
4. Train and consult your bar association's guidance.
5. Be transparent with the client where appropriate.
6. Review conflicts of interest in shared systems.
7. Protect your own published work, which may be harvested to train models.

What it leaves for later

The section on the future points to several open questions: market concentration in a few providers, the training of junior lawyers when entry-level tasks are automated, intellectual property and fraud with fake content.

How to use it at your firm

The guide works as a basis for a short internal policy: which tools are authorised, which data is never entered, who verifies what and when the client is informed. Combined with the new AI Act timetable, it lets you organise the use of these tools without waiting for the more demanding obligations to arrive.

Judges already have their own rules: the CGPJ approved in January 2026 an instruction on the use of AI in judicial activity, which we analyse in CGPJ Instruction 2/2026, point by point. More analysis in Legal AI.