Private legal knowledge, with its boundaries intact

Every firm that has practised for twenty years owns a second practice in its archive: the clause that survived three negotiations, the opinion on a foundation’s governance, the letter that settled a dispute. Private AI retrieval makes that archive searchable in plain language. It also makes it easy to pool material that the firm has kept apart for good reasons. The design question is not whether the model is capable. It is whether every boundary the firm observes on paper survives inside the index.

This note rests on texts in force by 9 December 2025.

The boundaries that already exist

Three sets of rules shape what a Monaco practice may share internally.

Secrecy. Article 308 of the Criminal Code, in the wording set by Law No. 1.444 of 2016, punishes anyone entrusted with secrets by state or profession who reveals them, outside the cases where the law requires or permits disclosure. The penalty is six months to one year of imprisonment, a fine, or either one. The article names no profession; the rules specific to lawyers sit elsewhere. Under Law No. 1.047, the Conseil de l’Ordre des avocats-défenseurs et avocats keeps discipline among its members.

Matter walls. Conflicts rules and client instructions often require that a team on one matter cannot see another. These walls live in the document management system, in staffing decisions and in the memory of partners.

Anti-money-laundering duties. Law No. 1.362 applies to lawyers only in defined circumstances. Under article 2, in the version in force since 30 September 2023, the law reaches them when they act for a client in a financial or property transaction, or assist a client in preparing or carrying out transactions such as buying or selling property or businesses, managing client funds or accounts, organising contributions to companies, or setting up and running companies, trusts and foundations.

Advice and transactions carry different duties

The distinction in article 2 matters for design. Under article 40, a lawyer who, in those transactional activities, knows or suspects that facts are linked to money laundering, terrorist financing or corruption must inform the Conseil de l’Ordre without delay. The same article releases lawyers from that duty for information received from or obtained about a client during a legal consultation, while assessing the client’s legal position, in defence or representation in proceedings, or in advice on starting, conducting or avoiding proceedings.

Retention follows the same line. Article 23, in force in its current wording since 2 March 2024, requires those within the law’s scope to keep customer due diligence records for five years after the relationship ends, and transaction records for five years from the transaction. The period can be extended by up to five more years in defined cases. For a lawyer, those duties attach to the transactional work in article 2, not to every file.

A knowledge system that mixes due diligence files with advice files blurs a line the law draws on purpose. Each matter needs a label for the kind of work it records: advisory, litigation or transactional within article 2. That label then governs who may retrieve the material, how long it stays and whether it may feed a general precedent bank at all.

Where retrieval tools break walls

The OWASP Top 10 for LLM applications names the failure plainly. Where several groups of users share one vector database, embeddings from one group can be retrieved in answer to another group’s query. OWASP’s remedy is permission-aware vector stores with strict logical and access partitioning.

The failure looks ordinary in practice. An associate on one matter asks for precedent drag-along clauses. The system returns a paragraph from a draft on a walled matter, with the client’s name in the defined terms. Nobody opened the other file, yet the wall has been crossed.

A second risk arrives with the documents themselves. OWASP’s entry on prompt injection describes indirect injection: instructions hidden in files or web pages that the model reads and follows. A disclosure bundle from an opposing party is external content. It should be indexed as untrusted, and the assistant should never act on text found inside it.

Designing the boundaries in

The controls that hold up are dull and structural:

• The matter is the unit. Every chunk in the index carries its matter, client and access list, inherited from the document management system at ingestion.
• Filter before generation. The retrieval layer removes what the user may not open before the model sees anything. A prompt that tells the model to ignore restricted text is not a control.
• Walls override roles. An ethical wall is a deny rule that beats seniority. A partner walled off a matter gets no results from it.
• Separate stores by duty. Due diligence records sit in their own index, reachable only by the compliance function, on the retention clock of article 23.
• Retrieve, do not train. ANSSI’s security recommendations for generative AI systems, published on 28 April 2024, point out that data used to train a model cannot carry access rights, while data supplied at query time can. Client material belongs in retrieval, not in model weights.
• Deletion reaches the index. When a file is destroyed at the end of its retention period, its embeddings and cached answers go with it.
• Answers cite sources. Each answer links to the documents it used, and the user can open only those they could already open.

Data protection applies in full

The firm is the controller for the personal data in its files under Law No. 1.565. Article 23 requires that, by default, personal data is not made accessible to an indeterminate number of people. A firm-wide index with open access fails that test on its face. Article 35 requires an impact assessment where processing, in particular through new technologies, is likely to create a high risk. The listed cases include large-scale processing of data on offences or on suspicions of unlawful activity, which describes a due diligence archive. Where a vendor hosts the system, article 26 requires a written processor contract.

Where the system runs

A retrieval system hosted by a third party adds a processor, and possibly a foreign jurisdiction, to every secret it indexes. Running the index and the model on hardware the firm controls removes that layer. It does not make the firm immune from lawful orders or from its own duties, and it does not require cutting the system off from the network. It reduces the number of people and legal systems that stand between a client’s secret and a disclosure.

Questions before rollout

• Which matters are excluded from the index entirely?
• Who maintains matter labels and walls, and how fast do changes reach the index?
• Can the system prove, from its logs, who retrieved which passage and when?
• What happens to embeddings when a client instructs the firm to return or destroy files?

Limits of this note

This is not legal advice or guidance on professional conduct. It reflects texts in force by 9 December 2025, read in their consolidated versions. Rules of the Ordre and later amendments are outside its scope. Firms should confirm their position with the Conseil de l’Ordre and their own counsel. To discuss a design, write to contact@desgarde.com.