AI Act and lawyers: what really changes on 2 August 2026

For a few weeks now, lawyers have been receiving the same message under various wrappings: "On 2 August, your AI becomes high-risk. Get compliant."

That is inaccurate. And any lawyer who spends ten minutes opening the regulation will notice it — a poor starting point for a trust relationship with a software vendor.

We prefer the opposite approach: say what the text actually provides, what it does not, and where the real risk lies for a law firm. It exists, but not where it is being shown to you.

What the timetable actually says

Regulation (EU) 2024/1689 applies in stages:

• 2 February 2025: prohibition of unacceptable practices (Art. 5) and AI literacy obligation (Art. 4). The latter has been in force for eighteen months and directly concerns law firms.
• 2 August 2025: obligations for general-purpose AI models, governance, penalty regime.
• 2 August 2026: general application of the regulation — obligations for high-risk systems in Annex III and transparency obligations in Article 50.
• 2 August 2027: final stage — systems integrated into regulated products.

So 2 August 2026 is indeed approaching. The question is what it actually triggers for you.

No, your drafting assistant is not 'high-risk'

Annex III, point 8(a) classifies as high-risk AI systems

"intended to be used by a judicial authority or on its behalf to assist a judicial authority in researching and interpreting facts and the law and in applying the law to a concrete set of facts".

The decisive element is the user: a court. A tool that you use, as counsel for a party, to draft submissions, analyse a contract or organise a case file, does not fall under that category. Recital 61 confirms this by expressly excluding ancillary administrative activities: document management, anonymisation, internal communication.

In other words: the heavy Annex III regime — quality management system, technical documentation, conformity assessment, CE marking — does not weigh on your firm merely because you use a legal assistant.

Let us also correct the often-misquoted penalty scale. The EUR 35 million or 7% of worldwide turnover cap targets only the prohibited practices of Article 5. Other breaches fall under a EUR 15 million or 3% cap.

A major exception: lawyers acting as judicial officers, arbitrators and mediators

This reasoning holds for a lawyer acting as counsel for a party. It stops holding for part of the profession, and this is the point no one is making.

Annex III, point 8(a) covers systems used by a judicial authority or on its behalf, and adds those used "in a similar way in alternative dispute resolution".

Two categories are therefore concerned:

• Lawyers holding a judicial appointment: insolvency trustee, judicial administrator, liquidator, provisional administrator, property administrator, debt mediator. When AI assists them in qualifying facts and applying the law to them — verification and admission of claims being the clearest illustration — the use falls within assistance to the judicial function, and not within the ancillary administrative activities set aside by Recital 61.
• Lawyers sitting as arbitrator or acting as mediator. The mention of alternative dispute resolution is express: no interpretation is required.

For those uses, the high-risk regime applies. It is split between the provider of the system — bound to a quality management system, technical documentation, logging, human oversight, accuracy and robustness, CE marking and registration in the Union database — and the deployer, that is the professional: use in accordance with instructions, oversight entrusted to a competent person, logs kept for a minimum of six months. Judicial officers exercising a public-service mission must also consider the fundamental rights impact assessment under Article 27.

Worth noting, as it is often misunderstood: for Annex III point 8, conformity assessment is based on internal control (Annex VI, Article 43(2)). No notified body is involved.

Our position, without detours. KAIUS is not, at this stage, qualified for a use falling under high-risk, and we do not intend to let anyone believe otherwise. A software used in the context of a judicial appointment or an arbitration must come with complete technical documentation and a formalised quality system — a project that takes months, not weeks. We have begun it and it is a priority on our roadmap for the coming months.

If you exercise a judicial appointment or an arbitration mission and this timetable concerns you, write to us: we are building this compliance with the professionals of the segment, not in their place.

What actually obliges you

Three things, two of which do not come from the AI Act.

1. AI literacy (Art. 4), already applicable

Every deployer of an AI system must take the necessary measures to ensure a sufficient level of AI literacy among the persons who use it on its behalf, in proportion to their knowledge and the context of use.

In concrete terms, for a firm: your staff must know what the tool does, what it does not do, and when its outputs must be verified. It is not a certifying training, it is an ability to account for it. It has been in force since February 2025, and it is the most widely ignored obligation in the text.

2. Transparency (Art. 50), on 2 August 2026

Natural persons must be informed when they interact with an AI system, unless it is manifestly obvious. Synthetic content must be marked in a machine-readable format. For a firm, the practical scope is limited but real: intake chatbot on your website, generated content published online.

3. Professional secrecy and the GDPR — the real issue

This is where your exposure lies, and the AI Act has nothing to do with it.

Sending a document covered by professional secrecy to a third-party model without contractual and technical safeguards is an ethics breach, in light of Article 66-5 of the French Law of 31 December 1971 and Article 458 of the Belgian Penal Code, before it is a data protection matter. Add Article 28 of the GDPR (processor contract), Article 32 (security of processing) and the minimisation principle in Article 5.

And there is the risk that no AI Act brochure mentions: fabricated citations. It is the only AI use that has already produced sanctions against lawyers, in France and elsewhere. No European regulation protects you from it. Only the tool's architecture can.

What your bar association will ask you

Not a compliance certificate. Precise answers:

• Which model processes my data, and where?
• Can the provider reuse my data to train its models?
• What exactly leaves the firm when I run an analysis?
• Where does this case-law citation come from, and can it be verified?
• Who reviewed it, and under what process?

Compliance, in 2026, is not a ticked box. It is an ability to produce evidence.

How KAIUS answers, point by point

You can bring your own AI

The Studio plan (EUR 9/month) runs in bring-your-own-AI mode: you use your own key with the provider of your choice. KAIUS runs no processing with its own models. For a firm whose litigation is particularly sensitive, this is the clearest available answer to the professional secrecy question, and to our knowledge, no other European law-firm management software offers it.

We disclose which models we use

By default, KAIUS relies on OpenAI (GPT) and Anthropic (Claude) models, along with Mistral — a European alternative that we offer to firms wanting processing by an EU-established provider, while stating clearly that its performance still lags behind on the most demanding legal tasks. The choice is yours; we do not hide it behind the phrase 'cutting-edge AI'.

Only relevant excerpts leave the firm

KAIUS relies on a RAG architecture: instead of sending your documents to the model, the system identifies the relevant passages and only forwards those. On a ten-thousand-page file, a few hundred lines are sent, not the file. Minimisation within the meaning of Article 5 GDPR, not by declaration but by design.

Answers are grounded on real sources, not on the model's memory

KAIUS does not only query the model: it queries the databases. Official public sources — EUR-Lex, Légifrance, Belgian Official Gazette, Justel and Juportal — but also, via MCP connector or API, all documentary databases your firm subscribes to. The architecture is open: any database exposing a programmable interface can be plugged in, including your firm's internal document repositories.

The consequence is decisive. A reference cited by KAIUS comes from an existing record, viewable and verifiable in one click; it is not reconstructed from memory by a statistical model. It is the only serious protection against case-law hallucination — the kind that has already cost colleagues dearly.

Playbooks document your process

A KAIUS playbook is a written and reproducible procedure: which steps, which sources, which human control points. It produces two effects. It materialises the human oversight that ethics require. And it constitutes, in fact, the AI-literacy mechanism expected by Article 4 — a document you can show.

Hosting and jurisdiction

Data hosted exclusively in Europe. KAIUS is published by Okipio Management SPRL, a Belgian company. Neither the company nor its control falls under a non-European jurisdiction — which is not the case for the American solutions arriving on the European market.

In summary

2 August 2026 does not make your firm a high-risk operator, unless you exercise a judicial appointment, an arbitration or a mediation mission — in which case the question arises seriously and deserves to be treated on its own terms. For all others, the text makes you accountable for explaining what you do. And the literacy obligation has already been on you since February 2025.

The right question to ask your vendor is therefore not 'are you AI-Act compliant?'. It is: 'what evidence can you give me if I am asked?'

We built KAIUS so that the answer is short.

This article presents a general analysis of Regulation (EU) 2024/1689 and does not constitute individualised legal advice. Applicable obligations depend on each firm's configuration.