AI in the small law firm: getting started without an IT department

Anyone running a law firm with two or three lawyers rarely has time for technology projects. That is precisely why AI is interesting for small law firms: getting started requires no servers, no interfaces and no IT department. It requires three things, and what they mainly cost is attention: a clearly defined first task, a tool that client data may be entrusted to, and the habit of checking every result before it leaves the firm.

Where small law firms stand

The figures paint a mixed picture. In a Wolters Kluwer survey from the summer of 2025, around 63 per cent of the small German law firms surveyed said they were already using AI. For generative AI such as ChatGPT, the figure was even above 80 per cent. A survey by legal-tech.de from the same year came to a different result: only 16 per cent were using specific AI tools there, but more than half used ChatGPT often or sometimes.

Both sets of figures fit together. Many lawyers try out general chatbots, but few have built their use into their workflows. In the Wolters Kluwer survey, respondents named lack of familiarity, data protection and cost as the main obstacles. The first obstacle can be removed without money, the second with a little care.

Start with one task

The most common mistake when getting started is looking for the one piece of software that can do everything. The reverse approach makes more sense: first the task, then the tool. Good first tasks are those that come up daily, contain a lot of text and carry little risk. These include summarising long documents, outlines for pleadings, drafts of client letters in plain language, or rephrasing your own texts.

The legal-tech.de survey names document analysis, legal research and document drafting as the fields with the greatest potential. Of these, research is the least suitable for a start, because it places the highest demands on verification. Anyone who begins with summarising and rephrasing learns the strengths and weaknesses of the tools without an error ending up in a pleading straight away.

Confidentiality comes first

The duty of confidentiality covers everything a lawyer learns in the course of a matter, right down to the client's name and the fact that a matter exists at all. In December 2024, the German Federal Bar (BRAK) published guidance on the use of AI. It concerns confidentiality, verification duties and transparency towards clients, and is recommendatory in nature.

For day-to-day work this means: client data belongs only in a tool where it is contractually settled what happens to the inputs. Free versions of general chatbots are usually unsuitable for this, because providers may use inputs to train their models. Anyone who does not want to examine the contracts can still make a start: with anonymised texts, with their own templates and with everything that has no connection to a matter. Anonymisation does not, however, offer absolute protection. The professional law committee of the German Bar Association (DAV) points out that modern methods can, in individual cases, re-identify data.

Check every result

Language models invent content that sounds convincing. References, judgments and provisions that do not exist are not a rare slip but a feature of the technology. The German Federal Bar's guidance therefore names lawyer review as the central duty. The Bar Association puts it even more plainly: references are to be checked without exception. Anyone who relies on an AI result, does not check it and does not have a command of its substance breaches the duty to practise the profession conscientiously.

In practice, a simple rule works: AI delivers drafts, never final versions. That applies to the summary just as much as to the pleading. Every text is read like a trainee lawyer's draft on day one, kindly but without any advance trust. That costs time, but less than a pleading with an invented judgment costs in court.

AI literacy is already mandatory

Since 2 February 2025, the AI Act has required everyone who uses AI systems professionally to ensure that the staff involved have sufficient AI literacy. That also applies to a law firm with three lawyers and one paralegal. The regulation prescribes neither a particular level nor a particular format. An expensive certificate is therefore not necessary, but documenting the training is advisable.

For a start, a short written rule for the firm is enough: which tools are permitted, which data may go into them, who checks the results, and when the client is informed about the use of AI. One page is enough. More important than the length is that everyone in the office knows it and that it is adjusted regularly as new tools are added.