Sonntagsausgabe · Part 13
Professional secrecy is no reason against AI
Somewhere in your law firm lies the answer to a question someone is asking right now. In a mail from two years ago, in a set of minutes, in an agreement someone else handled back then. The question is almost always the same: where does it already say that?
AI tools would be made for exactly that question. And exactly here the conversation stops in most firms. With one sentence: we are not allowed to, because of professional secrecy.
This Sunday edition takes that sentence seriously. And still reaches a different conclusion.
The concerns are justified
A well-known Swiss data-protection lawyer recently put it in a nutshell: professional secrecy is becoming a competitive disadvantage in the age of AI. His reasons cannot be brushed aside:
- The big providers guarantee no confidentiality you could promise a client.
- Anonymising destroys the workflow. Whoever strips every request of names first is slower than without AI.
- Client consent is not always obtainable.
- Local models running in your own building are weaker.
Add that up and you end at an either-or: everything into the cloud and risk the secret, or stay out and watch others get faster.
Secrecy forbids losing control, not the technology
The mistake is the either-or. Professional secrecy does not demand that no machine ever reads a document. It demands that nobody unauthorised reads it, and that you know at all times where it lies and who has access. That is a question of control. And control can be built.
Instead of one big question («cloud or not?») three smaller ones follow.
1. Which task?
Most questions in a law firm are not thinking tasks. They are finding tasks. When did we last talk to this counterparty? What did the agreement back then say? Who handled the file?
That does not need a top model that thinks for you. It needs one that searches your own records reliably and answers with the source.
This is how it looks at our company: our whole archive, mails and filed documents, can be asked questions in plain language. The search runs on our own servers. The answer is written by a model running on a graphics card in our own building. No document leaves the building. And every person only sees the collections released to them — whoever may not see a collection gets no answer from it either.
2. Which access?
The second concern is less obvious but just as important: a machine that works for you needs access. To portals, to accounts, to filing systems. Where do the passwords live then? In a script? In a chat history?
At our company, in none of those. The credentials live in a vault that only one single service opens. The machine tells that service «log me in to this portal», and the service fills in the login window itself. The machine never sees the password.
That is how the machine at our company collects receipts from portals, logs in and files them, without a password ever leaving the vault. Allowed to act without having to know — that is the technical form of confidentiality.
3. Which model?
Now the point where the concerns are right: local models are weaker. The question is where, and by how much.
We measured it. An open model on a single graphics card against a top model from the cloud, on our own accounting data, every answer checked by hand. The result:
| Task | Own graphics card | Top cloud model |
|---|---|---|
| Sorting mail | 92.0 % | 86.0 % |
| Reading fields from documents | 97.0 % | 95.6 % |
| Questions to the archive | 95 % | 100 % |
| Reading scans | 92.9 % | 85.3 % |
Four of five disciplines went to the graphics card. But exactly the task this is about — questions to the archive — was better in the cloud: 100 against 95 percent. That is about phrasing, and the big models are stronger at it.
In return the whole run cost 0 francs locally instead of 8, and a typical answer arrived after 1.3 seconds instead of 5.3.
So the honest calculation for a law firm is not «local is just as good». It is: for questions about client data you accept five percentage points of phrasing quality and keep full control in return. For anything that does not touch client data — drafting a newsletter, summarising a public legal situation — you can use the stronger model.
Where we ourselves are not on top
The model in our own building is not the strongest. We would not use it for «think for me», and with longer, nested questions you notice the difference. And the machine around the graphics card is not the newest — we deliberately postponed a new platform.
And not every law firm wants its own hardware in the building. It does not have to. The alternative is a provider who answers five questions in writing: where is it computed? Who can read along? Does the model learn from your data? Does each person see only what they may? Can you get out again? Whoever cannot answer these five is the wrong provider for client data.
The first step
Write down the ten questions asked most often in your firm. Then sort them into two columns: does the question touch client data, yes or no? And does it need thinking or finding?
You will notice that most of them land in the same corner: client data, finding. Exactly that corner can be solved in your own building — with a model that does not have to be the strongest, just a reliable one.
Professional secrecy is no reason to do without AI. It is a good reason to look closely at where it computes.