AI for professional firms: the complete guide to rules, tools and method

Monday, 9 a.m. In a six-person firm, one person asks ChatGPT to summarize a contract, another pastes a client's financial statements into a free chatbot, and a third refuses to touch it on principle. Nobody has talked to anybody about it. This guide is meant to turn that situation into a method: what the law says, where artificial intelligence really saves time, which tools to choose and how to protect client data. The legal references are Italian, because that is where our readers work, but the method travels well.

Rolandino's formulary: automation, 1255 edition

Allow me to start in Bologna, in the middle of the thirteenth century. The city is full of contracts: sales, dowries, wills, loans. Every deed has to be drawn up by a notary, and every notary has to know the right form. Around 1255 a notary and teacher of the notarial art, Rolandino de' Passaggeri, assembled the Summa artis notariae: an organized collection of models and explanations for drafting deeds. People simply called it "the Rolandina," and according to the University of Bologna it quickly became a reference text for notaries across Europe. It was copied by hand for generations and later printed.

You may ask: what does a medieval formulary have to do with AI? Quite a lot. The Rolandina was a machine for not starting from scratch. The notary took the template, adapted it to the case, added the names of the parties, the conditions, the clauses. The repetitive work was standardized; the judgment was not. No Bolognese client would have accepted a deed that said "as per the formulary": they wanted the seal and signature of a person who answered for what was written.

Your firm today is in that same workshop. Generative AI is a Rolandina that writes by itself and answers in seconds. The point, then as now, is deciding what stays in the professional's hands. And since 2025, in Italy, there is a law about it.

What the rules say: Law 132/2025, professional ethics and GDPR

Italy's AI law

Law no. 132 of 23 September 2025, in force since 10 October 2025, has an article devoted to the intellectual professions, Article 13. In short, as the Bar of Sondrio also summarizes:

• paragraph 1: AI may be used in the intellectual professions for instrumental and support activities, and the professional's intellectual work must remain predominant;
• paragraph 2: the professional must inform the client about the AI systems used, in clear, simple and comprehensive language, to preserve the relationship of trust.

The rule applies to all intellectual professions, whether or not they belong to a professional order. The orders moved quickly: Italy's national council of accountants released a model clause for engagement letters on 9 October 2025, the national council of labor consultants sent the provincial orders a notice on AI use, and back in December 2024 the Milan Bar had published the HOROS charter of principles for the responsible use of AI in legal practice.

Ethics haven't changed; they've become more concrete

Professional secrecy, confidentiality, competence, personal responsibility: the codes of conduct already said everything needed. AI only adds new ways to break them. Pasting a client's file into a free service that trains on conversations is a secrecy problem before it is a technical one. Signing a brief with citations you haven't checked is a diligence problem. In March 2025 the Court of Florence faced a brief citing Supreme Court rulings that did not exist, produced by ChatGPT and never verified. We cover this in our guide to AI for case-law research.

GDPR and client data

If you use an AI service to process clients' personal data, the vendor is normally a data processor (GDPR Art. 28) and you need a contract that governs it. If the data concern health, as for doctors and pharmacies, you enter the "special categories" of Art. 9 and caution doubles. The broader picture is in our guide to GDPR and AI.

The EU AI Act

The EU AI Act (Regulation 2024/1689) is aimed mainly at those who build and sell AI systems, but it touches firms in two practical places. First, a virtual assistant on your website or phone line must make clear that people are talking to a machine (Art. 50, applicable since 2 August 2026). Second, systems used to select, evaluate or manage workers are high-risk; with the digital Omnibus package approved in 2026, obligations for these systems were pushed to 2 December 2027. That matters a lot to labor consultants, and we cover it in a dedicated article.

Where AI really helps a professional firm

Let's set the promises aside. In a professional firm, time leaks in three places: finding information, writing repetitive text and chasing people (clients, documents, deadlines). That is where AI pays off.

A practical rule: the more a task is repetitive, verifiable and low-impact if wrong, the better it suits AI. The more it requires judgment, accountability to the client or knowledge of the case, the more AI must remain an assistant that prepares, not an author who signs.

Profession by profession

Lawyers: research, not drafting the brief

The biggest gain for a law firm is not having AI write briefs, but cutting the time needed to find precedents and arguments, starting from reliable databases and verifying every citation. The full method is in AI for lawyers and case-law research; for a general first look, start with AI for law firms.

Accountants: document flows

Invoices, bank statements, tax forms: an accounting firm is an assembly line of paper. AI helps it come in tidy and extracts the data, leaving the advice to the professional. We compared the tool families in AI software for accountants.

Labor consultants: payslips, contracts and the new transparency

Labor consultants use AI for themselves (reading collective agreements, answering client questions) but also help client companies meet new duties to inform workers. Two roles, twice the care: see AI for labor consultants.

Doctors: the front desk before the diagnosis

For a medical practice, the first sensible use of AI isn't clinical: it's the ringing phone, bookings, cancellations, prescription requests. With health data, every choice must be weighed. Steps and precautions are in AI for the medical practice front desk.

Pharmacies: the counter and beyond

A pharmacy lives on relationships. AI can lighten repetitive requests without touching the pharmacist's advice. See AI for pharmacy customer service; for orders and stock, read AI for pharmacies: orders and inventory.

How to choose an AI tool for your firm

There are three families of tools, and it helps to know which one you're buying.

1. General assistants (business versions of the big chatbots and assistants built into office suites). Flexible, inexpensive, good for writing and summarizing. They don't know your files unless you give them.
2. Industry software (practice management for law or accounting firms, legal and tax databases with AI features). More expensive, but they work on controlled sources and inside the workflows the firm already uses.
3. Custom solutions (an assistant connected to the firm's archive, automation between email, practice software and calendar). They need a project, but they fix the specific bottleneck.

Before signing, ask the vendor:

• Where is the data processed? Prefer EU-based servers or adequate transfer safeguards.
• Is my data used to train your models? The answer must be no, written in the contract.
• Is there a data processing agreement (GDPR Art. 28)? Without one, don't start.
• Who in the firm can see what? Access profiles, activity logs, deletion.
• How do I leave? Data export and deletion timelines.
• Are sources cited? For legal research, a tool that doesn't show where answers come from should be discarded.

What it costs

Prices change often, so think in orders of magnitude. Business versions of general assistants typically cost a few tens of euros per user per month. Industry software usually starts higher and is often sold as an add-on. A custom project has a setup cost and a maintenance cost. The right question isn't "what does the tool cost" but "how many hours does it free up, for whom, and what will the firm do with them".

The five-step method

A typical scenario: a five-person firm, two professionals, two associates, one assistant.

1. Map the present (one week). For five days everyone notes the repetitive tasks that take the most time.
2. Pick one use case. The one with the most hours lost and the least risk.
3. Write usage rules (one page). Approved tools, data never to be entered, who checks what. Update the engagement letter with the disclosure required by Law 132/2025.
4. Test for thirty days and measure. Hours saved, errors caught in review, user satisfaction.
5. Extend or change course. Only when the first case works do you move to the second, as we explain in automate what makes sense.

Who does what in the firm

• The lead: knows the approved tools, maintains the usage rules and gathers colleagues' doubts.
• The reviewer: for every automated flow, someone explicitly checks the output before it reaches the client. If the reviewer is "everyone", it's no one.
• The data owner: usually the firm's principal, with the DPO or privacy adviser, decides which data can go into which tools and signs vendor contracts.

Talking to clients is simple when it's honest: "We use an AI tool to prepare drafts and summarize documents; every opinion is written and signed by the professional; your data stays in Europe and trains no model." Three sentences, no jargon.

Common mistakes

• Letting everyone use whatever tool they like. The fastest way to lose control of client data.
• Using free versions for confidential data. Consumer terms may allow conversations to be used to improve the service.
• Trusting citations. Every ruling, statute or circular cited by AI must be opened and read at the source.
• Forgetting the client disclosure. In Italy, since 10 October 2025, it isn't optional.
• Buying before understanding. Choose the tool after understanding the problem.

Frequently asked questions

Can a professional use ChatGPT with client data?

AI tools can be used, but professional secrecy and GDPR apply. In practice you need a business version with a data processing agreement, no use of your data for training and, where possible, anonymized information. Free versions are not suitable for confidential data.

What should the client disclosure contain?

Article 13 of Law 132/2025 requires informing the client about the AI systems used in clear, simple and comprehensive language. Typically it states what AI is used for, that intellectual work and decisions remain the professional's, and how data is protected.

Who is liable if AI gets it wrong?

The professional. AI is a support tool and responsibility for the work remains personal, both civil and disciplinary.

Where should a firm start?

With a repetitive, easy-to-check task involving low-sensitivity data: summaries, standard communications, sorting incoming documents.

A last word from the Professor

Rolandino didn't make notaries useless. He made it useless to rewrite the structure of a dowry contract from memory, and left notaries more time to understand the people in front of them. AI does the same only if someone in the firm decides what to automate and what not to. If you want to do it with a method, see how we work with professional firms and our services, or book a free intro call: we start from people and your firm, not from tools.