Articles · intelligence-artificielle
Online AI and professional secrecy: why some professions shouldn't send everything to the cloud
An associate pastes a client's draft pleadings into ChatGPT to "rephrase them more clearly". An accountant drops a company's general ledger into it to spot anomalies. A wealth manager asks for a summary of a family's tax situation. In ten seconds, the work is done — and information covered by professional secrecy has left for the servers of a foreign company.
This isn't a theoretical scenario: it's daily practice in many firms, often without management's knowledge. This article explains what actually happens when you use online AI, why it's a problem for certain professions, and what solutions exist — from the simplest to the most protective.
What happens when you ask an online AI a question
An AI like ChatGPT, Gemini or Copilot doesn't run on your computer. Your text and attachments are sent to the provider's servers, processed, and then the answer comes back to you. The Conseil national des barreaux (the French National Bar Council) recalls this in its guide on ethics and artificial intelligence adopted on 17 March 2026: any request sent to an online generative AI transmits data to the company operating it.
In practice, this raises four questions:
- Who can read this data? The provider, its subcontractors, and possibly its moderation or security teams.
- How long is it kept? Depending on the plan and settings, from a few days to much longer.
- Is it used to train the models? For consumer versions, this is often enabled by default and you have to turn it off yourself; business plans generally exclude it by contract.
- Which law applies? That of the provider's country, even if the servers are in Europe.
Risk #1: US law applies in Europe too
The CLOUD Act, a 2018 US federal law, allows the US justice system to demand from any provider subject to US law the data it holds, wherever it is stored — including in a data center in Paris or Frankfurt.
This isn't an interpretation by anxious lawyers. On 10 June 2025, before the Senate commission of inquiry on public procurement, Microsoft France's director of public and legal affairs stated under oath that "if we are compelled by a US court order, we must hand over the data" (Sénat, Techniques de l'Ingénieur). He could not guarantee that data belonging to French citizens would never be transferred without the agreement of the French authorities.
The legal framework for transfers to the United States also remains fragile. The two previous agreements were struck down by the Court of Justice of the European Union (Safe Harbor in 2015, Privacy Shield in 2020). The current agreement, the Data Privacy Framework, was upheld by the EU General Court on 3 September 2025 (Latombe judgment, T-553/23), but an appeal is pending before the Court of Justice (case C-703/25 P). Building a firm's organization on a framework that has already been struck down twice is a gamble.
Risk #2: your data no longer quite belongs to you
Once sent, your data follows the provider's rules — and sometimes those of a court that has nothing to do with you. In 2025, in the case pitting the New York Times against OpenAI, a US judge ordered OpenAI to preserve ChatGPT conversations, including those users had deleted; that obligation only ended on 26 September 2025 (OpenAI, Ars Technica). For months, "delete" didn't mean delete.
Risk #3: human error, the most common one
In April 2023, Samsung engineers pasted confidential source code into ChatGPT to have it fixed. The company then banned consumer generative AI for its employees (Bloomberg). No hacking: just employees wanting to save time.
This is the most likely scenario in a firm. Banning AI doesn't work — associates use it anyway on their phones. The only effective answer is to give them a tool that is just as convenient, but safe.
The most exposed professions and organizations
| Who | What is protected | Why online AI is a problem |
|---|---|---|
| Lawyers | Absolute professional secrecy (art. 66-5 of the law of 31 December 1971): consultations, correspondence, case documents | Passing a file to a third party without sufficient safeguards can constitute a breach of professional ethics |
| Accountants, statutory auditors | Professional secrecy over clients' accounts, payroll and tax situation | General ledgers, payslips and tax packages contain personal and financial data |
| Notaries | Professional secrecy, deeds, family and wealth situations | The profession itself chose a sovereign solution (see below) |
| Healthcare (doctors, clinics, laboratories) | Medical secrecy (art. L1110-4 of the Code de la santé publique) | Hosting health data requires an HDS-certified host (art. L1111-8 CSP) |
| Banks, family offices, wealth management — notably in Monaco | Banking secrecy, wealth data; Monegasque law n° 1.565 of 3 December 2024 on personal data | Tax and wealth situation of wealthy families: discretion is the heart of the business |
| Government administrations and state operators | Sensitive state data | Since décret n° 2026-272 of 14 April 2026 (SREN law, art. 31), they must use a SecNumCloud-qualified cloud for this data |
| Industry, R&D, defense | Trade secrets, plans, source code, know-how | A leak can cost a patent, a contract or a competitive edge |
| Human resources | Personnel files, health, sanctions, pay | Sensitive personal data within the meaning of the GDPR |
For regulated professions, breaching professional secrecy is also a criminal offence: up to one year's imprisonment and a €15,000 fine (art. 226-13 of the Code pénal, the French criminal code). Not to mention the most concrete risk for a firm: losing a client's trust.
The cloud isn't banned: you need to choose the right level
It would be wrong to say that any use of online AI is illegal. There are several levels, from the least to the most protective:
| Solution | Data sent outside | Applicable law | Suited to |
|---|---|---|---|
| Free or personal consumer AI | Yes, default settings often unfavourable | The provider's | Nothing confidential |
| "Enterprise" plan from a US provider | Yes, without training, GDPR contract | US law (CLOUD Act) in addition to the GDPR | Low-sensitivity internal data |
| Sovereign European cloud (SecNumCloud-qualified, e.g. Mistral on Scaleway) | Yes, but with a player subject only to European law | European law | A large share of professional uses, if the contract is well negotiated |
| Private AI installed on your premises | No | Yours | Files covered by secrecy, the most sensitive data |
This is exactly the reasoning of the Conseil supérieur du notariat (CSN, the French notaries' high council): in July 2026, it chose Mistral AI and the French host Scaleway to offer notary offices an AI on sovereign infrastructure (CSN). For an independent firm, the next step is to let nothing out at all.
What an AI installed on your premises brings
A model like Mistral can today run on a machine the size of a box or a small server, placed in the office:
- nothing leaves: documents, questions and answers stay on your hardware;
- no foreign law: there is no provider from whom a judge could demand anything;
- controlled access: accounts per associate, usage log, only on the firm's network;
- fixed cost: no per-user subscription or request quota;
- works offline: you can cut the Internet, the AI keeps answering.
It also has its limits, and it's better to know them:
- a local model is slightly less powerful than the largest online models — sufficient for searching your documents, summaries and first drafts, less so for very long reasoning;
- the machine's security becomes your responsibility: encrypted backups, updates, access control;
- you need an initial investment in hardware, of a few thousand euros.
Before choosing: five questions to ask
- What data are your teams already pasting into online AI today? (The answer is often surprising.)
- Is this data covered by professional, medical, banking or trade secrecy?
- Is the provider subject to non-European law, even if it hosts in Europe?
- Is your data used for training, and how long is it kept?
- Could you explain your choice to a client, to your professional body or to the CNIL (the French data protection authority)?
If the answer to the second question is "yes", consumer cloud is ruled out and private AI deserves serious consideration.
In summary
Online AI isn't dangerous in itself: it's dangerous for certain data. For lawyers, accountants, notaries, healthcare, family offices and government bodies, the question isn't "should we use AI?" but "where do my clients' files go when I use it?".
I install Mistral-based private AI in firms in Strasbourg, Alsace, on the French Riviera and in Monaco: hardware selection, installation, indexing of your documents, accounts and security, team training. The hardware calculator gives a first estimate based on the size of your team and your archives. Let's talk about your firm →
This article is general information and does not constitute legal advice. For a specific ethics question, consult your professional body.