Editorial: judges already have rules for using AI; law firms should have them too

This is an editorial by the AGENTE LEX newsroom. It expresses the portal's opinion.

Spanish judges have known since 30 January 2026 what they can and cannot do with artificial intelligence. That day CGPJ Instruction 2/2026 was published in the BOE, limiting its use to systems provided by the Justice administrations or the Council itself, admitting it only as support and requiring a personal, complete and critical review of any draft.

The Justice Administration also has, according to the Ministry of Justice, an AI use policy approved in June 2024. The Ministry presents it with a clear idea: AI should help with routine tasks, not replace people or make decisions affecting rights and freedoms. We analyse its content in the article on AI in the Justice Administration.

The question is unavoidable: how many firms have anything similar in writing?

Responsibility is already defined; the rules are not

The courts have not waited. The High Court of Justice of the Canary Islands imposed in February 2026 a fine of €420 on a lawyer who cited up to 48 non-existent judgments suggested by an AI tool. The Chamber pointed out that a search in CENDOJ would have revealed the errors and spoke of a duty of human oversight. Other courts have ruled along the same lines, as we reported in the review of the sanctions for fake case law generated by AI.

The message is unequivocal: responsibility lies with whoever signs. What may be missing at a firm is the organisation that makes it possible to meet that responsibility systematically and not rely on each lawyer's memory.

What the firm can learn from the judicial instruction

The CGPJ instruction offers a structure that can be adapted:

1. A closed list of tools. Judges can only use authorised systems. A firm can decide which tools are contracted, under what confidentiality conditions and for which tasks.
2. Permitted and prohibited uses. The instruction distinguishes between search, analysis, outlines and internal drafts, permitted as support, and the delegation of decisions, prohibited. At a firm, the line may lie between preparing a first draft and filing a document unreviewed.
3. Data protection. The instruction prohibits entering judicial data into systems that have not been provided. The firm's equivalent is not entering client information into services that do not guarantee confidentiality by contract.
4. Training. The CGPJ commits to training the judiciary. A firm should do the same with its team.

A European duty, though softened

The European AI Act obliges those who deploy these systems to adopt measures on the AI literacy of their staff. The digital Omnibus, in force since July, has softened the wording of that duty, which now consists of adopting measures to support that literacy. That the duty is more flexible does not make it unnecessary. It makes it easier to meet with a short, well-applied policy.

Our proposal: one page

A hundred-page manual is not needed. A useful policy fits on one page:

• Which tools are authorised.
• What information is never entered.
• Who verifies citations and references, and how.
• When the client is told about the use of AI.
• What training the team receives and how often.

The CCBE guide on generative AI for lawyers offers practical recommendations for drafting it, and the CGPJ instruction, a model structure. Judges already have their rules. It is a good time for every firm to write its own. More editorials in Opinion.