KAIUS est-il conforme au RGPD ?

Oui. KAIUS est entièrement conforme au RGPD. Toutes les données sont hébergées exclusivement en Europe et chiffrées de bout en bout.

Puis-je essayer KAIUS gratuitement ?

Oui. Un essai gratuit de 14 jours est disponible sans carte bancaire. Vous accédez à toutes les fonctionnalités du plan PRO pendant la période d'essai.

Pour quels cabinets KAIUS est-il adapté ?

KAIUS s'adresse aux avocats indépendants, aux cabinets de droit des affaires, aux juristes d'entreprise et à toute structure de 1 à 100 avocats.

Comment l'IA de KAIUS aide-t-elle au quotidien ?

L'assistant IA rédige des projets de conclusions, résume des dossiers volumineux, recherche dans la jurisprudence et automatise les tâches répétitives — tout en respectant le secret professionnel.

Kaius resource · AI Act + GDPR checklist

AI Act + GDPR checklist for law firms

Thirty control points grounded in the official texts (Regulation EU 2024/1689 and GDPR) to assess your firm's maturity on AI.

1. AI mapping and governance

Foundational: know which AI tools are used at the firm, by whom, for what matters, and train the team.

0/4

We maintain an up-to-date inventory of the AI systems used at the firm (ChatGPT, Copilot, Claude, legal tools, plugins, etc.).

Reference · AI Act art. 4 · RGPD art. 30

An AI lead is designated at the firm (partner, DPO or dedicated officer).

Reference · AI Act art. 4 (mesure d'accompagnement)

A written internal policy governs AI use (allowed tools, data forbidden in prompts, mandatory human review).

Reference · AI Act art. 4

Staff using AI tools have been trained on their risks, limits and biases ('AI literacy').

Reference · AI Act art. 4 (applicable depuis le 2 fév. 2025)

2. Classifying use cases

The AI Act follows a risk-based approach. Each use case must be classified: prohibited, high-risk, transparency-specific, or limited risk.

0/4

No planned use falls under the prohibited practices of Article 5 (social scoring, biometric categorisation based on sensitive data, subliminal manipulation, etc.).

Reference · AI Act art. 5 et art. 99

We have checked whether our use cases fall within the high-risk systems list (Annex III), notably point 8 on the administration of justice.

Reference · AI Act art. 6 et Annexe III (§ 8) — deadline haut risque reportée au 2 décembre 2027 (Digital Omnibus, 2026)

When we generate AI content (text, image, audio) intended for third parties, we apply the transparency obligations of Article 50.

Reference · AI Act art. 50 (applicable au 2 août 2026)

Our clients are informed when AI is used significantly in the handling of their matter.

Reference · AI Act art. 50 · déontologie de l'avocat

3. Vendors and GPAI models

Using a general-purpose AI model (Anthropic, OpenAI, Mistral, Google…) involves a chain of responsibilities between the model provider, the solution provider and the deploying firm.

0/4

We have signed a Data Processing Agreement (DPA) with each AI vendor processing data from our matters.

Reference · RGPD art. 28

We have verified and documented that the vendor does not use our prompts and data to train its models (or we have disabled this).

Reference · RGPD art. 5.1.b · secret professionnel

We know the exact location of the processing (EU or third country) and the applicable transfer mechanism.

Reference · RGPD art. 44 à 49

For general-purpose models, we have obtained the technical documentation and training-data summary made available by the provider.

Reference · AI Act art. 53 (GPAI, applicable au 2 août 2025)

4. GDPR — Legal basis and minimisation

Every submission of personal data to an AI model is a processing operation under the GDPR and must rest on a clear legal basis.

0/4

For each AI use case, we have identified the legal basis (mandate performance, legitimate interest, legal obligation, consent…).

Reference · RGPD art. 6 · EDPB Opinion 28/2024

We minimise the data sent to the model: prompts contain only the information strictly necessary for the task.

Reference · RGPD art. 5.1.c

GDPR Article 9 data (health, convictions, political opinions, orientation…) is only sent to a model after specific analysis and, if needed, anonymisation.

Reference · RGPD art. 9

Where possible, data sent to the model is pseudonymised or anonymised (masking names, dates, identifying amounts).

Reference · RGPD art. 32.1.a

5. GDPR — Data subject rights and DPIA

AI use must remain compatible with informing data subjects and enabling their rights, especially in the case of automated decision-making.

0/4

A Data Protection Impact Assessment (DPIA) has been performed for AI uses likely to result in a high risk to individuals' rights.

Reference · RGPD art. 35

Our privacy notice explicitly informs data subjects of the use of AI tools and their purposes.

Reference · RGPD art. 13-14

We can respond to access, erasure and objection requests, including for data transmitted to an AI vendor.

Reference · RGPD art. 15 à 22 · art. 28.3.e

No decision producing significant legal effects on a person is taken solely by AI without substantive human involvement.

Reference · RGPD art. 22

6. Security, transfers and legal privilege

AI use must strengthen — never weaken — the level of security and the legal privilege that apply to the lawyer.

0/4

Data exchanged with the AI vendor is encrypted in transit (TLS) and at rest.

Reference · RGPD art. 32.1.a

Access to sensitive prompts and AI responses is logged and auditable.

Reference · RGPD art. 5.2 (accountability)

Transfers to a third country (typically the United States) are covered by a valid mechanism: adequacy decision, SCC or BCR, with a transfer impact assessment.

Reference · RGPD art. 46 · CJUE, Schrems II (C-311/18)

AI use has been validated in light of the lawyer's professional secrecy (specific analysis, no vendor access to privileged content).

Reference · Secret professionnel · règles de l'ordre professionnel applicable

Your maturity

0% · High risk

0 item(s) validated out of 24

Educational tool published by Kaius. It does not constitute legal advice and does not replace the analysis of a lawyer or your DPO. Sources: Regulation (EU) 2024/1689 (AI Act) and Regulation (EU) 2016/679 (GDPR).