First distinction
The project selects one professional activity.
“Manage a matter”, “serve a client” or “prepare advice” includes different sources, steps, decisions and effects. Assigning the whole process to one tool makes it difficult to see which data it reads, how it reaches a result and where it may fail.
A first project selects an observable transformation: find clauses across documents, extract deadlines, compare versions, prepare the structure of a report or connect a request with the correct file. The result can be reviewed before it produces an effect.
It is one precise step assigned to a model or system: read allowed sources, perform a transformation and return a checkable result. It may take place in a chat with attached documents or in a system connected to archives and tools. In both cases, the opening question is: what object should it prepare, from which sources, so that a person can verify it?
Operational possibilities
Five families of activities to assess.
Search and connect sources
Retrieve passages, precedents, messages or documents while preserving the link to the original source.
Extract and classify
Identify fields, deadlines, parties, amounts or categories according to a defined structure.
Compare
Highlight differences between versions, documents, requirements or cases without replacing professional interpretation.
Prepare a draft
Compose an initial structure from authorised sources, showing what is missing and what needs verification.
Coordinate steps
Organise requests, deadlines and status when each update has a source and a responsible owner.
Suitability depends on source quality, repeatability, the consequences of error and the practical ability to check the result.
Operational responsibility
Human oversight has a specific object.
Oversight works when the assigned person understands the system’s capabilities and limits, can see the relevant sources, can interpret the output and has the authority to correct it, disregard it or stop the resulting action. For systems classified as high-risk, Article 14 of the EU AI Act expressly requires oversight proportionate to risk, autonomy and context of use.
Search, extraction, comparison, classification or a draft.
The task, allowed sources and result format are declared.
Completeness, correctness, relevance and case conditions.
Criteria exist before the test and include errors that require a stop.
Use, communication, filing, sending or a system change.
The decision remains assigned according to the role, profession and resulting effect.
Information and confidentiality
Each item enters for a declared purpose.
When the activity uses personal data, the GDPR requires specified purposes, data minimisation, protection by design and appropriate security measures. Processing likely to result in a high risk to people’s rights and freedoms may require a data protection impact assessment before it starts.
The firm also needs to consider confidentiality, professional duties, the client engagement, contracts, special categories of data and sector rules. These conditions differ across professions and cannot be inferred from the selected model alone.
To distinguish local processing, reduced external use, a hybrid route and exclusion, see the insight on company data in local or hybrid AI systems.
Practical object
Activity–Data–Responsibility Map.
Complete the map for one activity. Missing answers show what needs to be clarified before real data is connected or an effect is allowed.
- 01
Activity and result
Which step should be assisted, and what object should it produce?
- 02
Allowed sources
Which documents, messages, archives or applications may the system read?
- 03
Necessary data
Which information changes the result, and what can be removed?
- 04
System task
Should it search, extract, compare, classify, prepare or coordinate?
- 05
Verifiable result
Which format, source citation or criterion makes the output checkable?
- 06
Assigned person
Who has the competence, time and authority to review and correct it?
- 07
Reserved decision
Which judgement or choice remains assigned to the responsible professional?
- 08
Allowed effect
Does the system only prepare, or may it update, send or publish after approval?
- 09
Error and recovery
How is the route stopped, the result corrected and the event reconstructed?
For [activity], the system uses [sources and data] to perform [bounded task] and prepares [result]. [assigned person] verifies it using [criteria] and decides before [effect]. If [error] occurs, the route stops and resumes from [known state].
First experiment
The test should expose quality and limits.
The starting point changes the operational advice, while the activity, result and responsibility remain the same.
One synthetic document and one precise request.
Compare every point in the response with its source and record what the system omits, invents or misinterprets.
A set of ordinary cases, exceptions and expected errors.
Define the result format, measure review time and preserve corrections that improve the method.
Data, access, provider, logs, approvals and stop conditions.
Verify who may read and act, where information remains and how the route returns to a known state.
- 01Prepare representative examples.
Include ordinary cases, incomplete documents, exceptions and situations where the system should state uncertainty.
- 02Use synthetic or authorised data.
Before working with real client files, verify the route with content that does not introduce unnecessary risk.
- 03Compare it with the current method.
Assess completeness, errors, review time and the ability to trace each point to its source.
- 04Keep effects reversible.
A draft or simulation supports learning without sending, filing, publishing or updating real systems.
- 05Record the decision.
Preserve examples, criteria, corrections and the reason for any expansion of the task.
Illustrative scenario
Preparing a meeting from a professional case file.
A firm needs to reconstruct facts, documents, deadlines and open questions before a meeting. The system indexes only authorised sources, extracts dates and parties, links every point to the original document and prepares a structured draft.
The professional checks omissions, interpretations and relevance, adds the judgement required by the engagement and decides which points to discuss with the client. The preparation stage does not send a message or file a document.
This scenario shows one possible configuration. It is not a client case and does not replace rules that apply to a profession or a specific engagement.
Public sources
References for further study.
- Regulation (EU) 2016/679: processing principles, data protection by design, security and data protection impact assessments.
- EDPB, Data protection guide for small business: privacy by design, accountability and DPIA conditions.
- Regulation (EU) 2024/1689: AI literacy and human oversight for high-risk systems.
- EDPB Opinion 28/2024: personal data, anonymity and legal bases in the context of AI models.
This guide provides an initial design method. Professional duties, legal basis, security, impact assessment and responsibility depend on the activity and require the relevant competent functions.
Frequently asked questions
AI, professional firms and responsibility.
Which professional activities are suitable for AI support?
Activities with identifiable sources, a describable result and verification criteria: search, extraction, comparison, drafting and coordination. Consequences and error determine the level of control required.
Can client documents be entered into an AI system?
Assess purpose, necessary data, processing conditions, provider, access controls and professional or contractual duties. Start by defining the minimum content and its allowed route.
Does a local model solve confidentiality concerns?
It can reduce exposure to external services. The device, storage, permissions, logs, updates and connected tools still need protection.
What does meaningful human oversight require?
The assigned person has sources, criteria, competence, time and authority to interpret the result, correct it, disregard it or stop the resulting action.
How should a professional firm test its first AI use?
Choose one bounded activity, prepare representative examples and errors, compare the result with the current method and keep every effect reversible until verified.