EU AI Act for AI providers in legal services

This guide maps the EU AI Act (Regulation (EU) 2024/1689, as amended by the 2026 Digital Omnibus) to the AI systems AI providers actually run in legal services: which uses are high-risk, which only carry transparency duties, and what is due by when. It reflects the post-Omnibus dates — the high-risk regime now applies from 2 December 2027 (Annex III) and 2 August 2028 (Annex I), while Article 50 transparency has applied since 2 August 2026.

Are you the provider?

You are a provider if you develop an AI system (or have one developed) and place it on the market or put it into service under your own name or trade mark — including SaaS companies shipping AI features built on third-party models (Article 3(3)).

Providers carry the heaviest obligations: for high-risk systems the full Chapter III regime (risk management, data governance, technical documentation, conformity assessment, CE marking, registration), and for generative systems the Article 50(2) machine-readable marking duty. If your organisation also acts as a deployer, read the companion guide for AI deployers in legal services too — many companies are both.

Typical AI uses in legal services

• contract review and drafting assistants
• legal research and case summarisation
• client intake chatbots
• e-discovery and document classification

High-risk triggers in legal services

The high-risk classification follows the use context (Article 6), not the underlying technology. These are the categories most relevant to this industry:

• Annex III(8)(a): AI used by or on behalf of a judicial authority to assist in researching and interpreting facts and law and applying the law to facts is high-risk — from 2 December 2027. Law-firm internal tools are generally outside this point.

For high-risk systems, providers carry the full Chapter III regime: risk management (Article 9), data governance (Article 10), technical documentation (Article 11 + Annex IV), logging (Article 12), instructions to deployers (Article 13), human oversight design (Article 14), accuracy and cybersecurity (Article 15), quality management (Article 17), conformity assessment (Article 43), CE marking and EU database registration (Articles 48-49). Note Article 6(3): a system in an Annex III area escapes high-risk status if it only performs a narrow procedural or preparatory task without profiling — document that assessment if you rely on it.

Transparency duties (Article 50) — since 2 August 2026

• Client intake chatbots must disclose they are AI (Article 50(1)).
• AI-drafted client-facing publications may need Article 50(4) labelling unless a lawyer holds editorial responsibility.

Your timeline (post-Digital-Omnibus)

• 2 February 2025 — prohibitions (Article 5) and AI literacy (Article 4) apply. Already in force.
• 2 August 2025 — GPAI model rules (Chapter V) apply.
• 2 August 2026 — general application: Article 50 transparency, governance, penalties. In force.
• 2 December 2026 — Article 50(2) marking grace period ends for systems on the market before 2 August 2026; new Omnibus prohibitions apply.
• 2 December 2027 — high-risk obligations for Annex III systems (moved from 2 August 2026 by the Digital Omnibus).
• 2 August 2028 — high-risk obligations for AI embedded in Annex I regulated products (moved from 2 August 2027).

Penalties

Prohibited practices: up to €35,000,000 or 7% of worldwide annual turnover (Article 99(3)). High-risk and transparency breaches: up to €15,000,000 or 3% (Article 99(4)), whichever is higher. See what you actually risk in practice.

Next step: get your specific list

The fastest way to turn this into your own obligation list is the free 3-minute EU AI Act risk self-assessment — risk tier, obligations with article references, personalised timeline and penalty exposure. If your exposure is chatbots or AI-generated content, the Article 50 checker goes clause by clause.

← All role & industry guides