The 5 CGAE Recommendations

Context: CGAE and AI

The Spanish General Council of the Bar (CGAE) published in 2024 a document with 5 fundamental recommendations for AI use in legal practice. While these are Spanish-specific, similar guidelines have been issued by the ABA (US), SRA (UK), and CCBE (EU): making these principles universally applicable.

The document was published after finding that:

• 64.7% of Spanish lawyers had received no AI training.
• Only 3% of firms had a formal AI usage protocol.
• Incidents of AI-fabricated citations were increasing internationally.

---

Recommendation 1: Transparency with the client

"The lawyer must inform the client when using AI tools in the provision of legal services."

What it means

• Include a clause in the engagement letter informing about AI tool use.
• Explain to the client what AI is used for (research, drafts, analysis) and what not (final decisions, signing briefs).
• The client has the right to object to AI use in their case.
• Transparency doesn't weaken the lawyer: it strengthens them as an updated and honest professional.

Example clause

"This firm may use artificial intelligence tools to support legal research, draft preparation, and document analysis. All AI-generated information is reviewed and verified by a licensed lawyer before incorporation into any document. The client may request that AI tools not be used in their matter."

Common mistakes

• ❌ Not informing the client because "everyone uses AI".
• ❌ Using AI for sensitive tasks without specific consent.
• ❌ Delegating to AI without review and signing as own work.

---

Recommendation 2: Verification of results

"All AI-generated results must be verified and cross-checked before professional use."

Verification protocol

1. Legal citations: verify against official databases that the article or ruling exists and says what the AI claims.
2. Numerical data: check deadlines, amounts, percentages against the original source.
3. Legal reasoning: evaluate if the argumentation is sound or if the AI has mixed concepts from different areas of law.
4. Currency: check that the cited norm is still in force and hasn't been repealed or amended.

The "AI self-confirmation" trap

If you ask ChatGPT: "Is this citation correct?", it will answer "Yes, ruling STS 1234/2023 indeed establishes...": even if it fabricated it itself. AI has no internal mechanism to distinguish what it "knows" from what it "invented".

Rule: Only the original source (official gazette, case law database) serves as verification. AI verifying itself doesn't count.

---

Recommendation 3: Continuous training

"Lawyers must receive specific training in AI use, its possibilities, and its limitations."

Why it matters

• A lawyer who doesn't understand how an LLM works cannot correctly evaluate its results.
• Training is not just "learning to use the tool": it's understanding its technical limitations.
• Bar associations are starting to include AI in their training programs.
• The market rewards professionals who combine legal expertise with technological competence.

Recommended training areas

Area	Why it matters
LLM fundamentals	Understand hallucinations, limitations, training cutoff
Effective prompting	Know how to formulate questions that produce useful answers
Privacy and data	GDPR, anonymization, secure infrastructure
Specific tools	Master the tools your firm uses
Ethics and deontology	Limits of AI use in the profession

The lawyer of the future (already present)

It's not about AI replacing the lawyer. It's about the lawyer who uses AI replacing the one who doesn't. The competitive advantage isn't in having AI, but in knowing how to use it with professional judgment.

---

Recommendation 4: Professional responsibility

"The lawyer is always responsible for the final result, regardless of whether AI was used."

Fundamental principle

AI is a tool, like a legal database or a word processor. The lawyer signs, the lawyer answers.

Practical implications

• Civil liability: if a brief contains an error from blindly trusting AI, the responsibility is the lawyer's.
• Deontological responsibility: negligent AI use can lead to disciplinary proceedings.
• Malpractice: including unverified citations in a procedural brief may constitute professional negligence.
• Insurance: review if your policy covers AI-related errors.

Useful analogy

If an intern drafts a brief with errors and you sign it without reviewing, the responsibility is yours, not the intern's. The same applies to AI.

---

Recommendation 5: Professional secrecy and confidentiality

"AI use must not compromise professional secrecy or client data confidentiality."

Concrete obligations

1. Do not upload client data to public AI services without anonymizing.
2. Use tools with data processing agreements (DPA).
3. Prefer infrastructure within the EEA for data processing.
4. Inform clients about implemented security measures.
5. Train the team in secure data handling protocols with AI.

Case study: the model firm

A 10-lawyer firm implements legal AI with the following protocol:

• Tool with EU infrastructure and signed DPA.
• Internal policy that prohibits using ChatGPT with client data.
• Mandatory quarterly training for the entire team.
• AI clause in all engagement letters.
• Semi-annual audit of AI use in the firm.

Result: 40% productivity increase, zero privacy incidents.

---

Module summary

Recommendation	Key action
1. Transparency	Engagement letter clause + inform client
2. Verification	All AI results verified against original source
3. Training	Understand technical limitations, not just "use the tool"
4. Responsibility	Lawyer signs, lawyer answers: always
5. Confidentiality	DPA, EU infrastructure, internal protocol, training