AI pilot · firm readiness
Is your law firm ready for an AI pilot in France?
A law firm is not ready for AI merely because it has selected a tool. It is ready when it has a narrow use case, a named human owner, permitted data, access controls and a review rule. The Viavoice survey for the French National Bar Council shows that professional use is now common; it does not show that every rollout is mature. This self-assessment places a first pilot in one of four readiness profiles and identifies the next control to establish. It does not certify compliance, classify a system under the AI Act or recommend a vendor.
A limited pilot still needs governance. Use no client matter until intended use, permitted data, owner, review and incident route are written.
Six controls for a first AI pilot
The entire framework is visible before interaction and independent of any supplier.
| Control | Useful baseline | Evidence to keep | Stop signal |
|---|---|---|---|
| Use case | Internal, repeatable and reversible task | Scope statement and expected output | Unreviewed client or person-affecting use |
| Owner | Named pilot owner | Record, date and escalation route | No owner |
| Data | Approved, minimised set | Input and exclusion rule | Sensitive matter or unknown rule |
| Review | Reviewer and pre-release rule | Checklist and approval trace | Direct-to-client output |
| Access and supplier | Necessary roles and recorded evidence | Accounts, removal and supplier version | Diffuse access or unknown chain |
| Literacy and incident | Role briefing and known route | Dated material and internal contact | No reporting rule |
Place a first pilot in one of four profiles
All categories are general. Enter no client or matter information.
Complete all six controls to display the pilot profile.
Internal escalation required
Client-facing work without an owner, data rule or review is not suitable for a first pilot.
Foundations to establish
The use, owner, data or review rule is insufficiently defined.
Pilot possible after scoping
The pilot is bounded, but one control remains informal or partial.
Ready for a limited pilot
Reversible use, owner, data, review, access and briefing are declared.
Why assess readiness before an AI pilot?
A tool without a defined use case, owner, permitted data and review rule creates an uncontrolled pilot. The assessment checks those foundations before any supplier comparison.
What does the CNB/Viavoice survey measure?
It measures reported use among 4,457 lawyers surveyed online from 17 April to 27 May 2025. The 62% professional-use figure, including 32% advanced users, proves neither firm maturity nor compliance.
Which first use case fits a pilot?
Choose a repeatable, reversible task with verifiable output and a named human reviewer. An internal summary of public decisions is easier to control than client-facing content.
What data may enter a pilot?
Use a firm-approved, minimised dataset. Sensitive matters, professional secrecy and third-party data need prior review of the workflow, supplier evidence and responsibilities.
Who owns the pilot?
A named owner keeps the decision record, organises controls, resolves exceptions and triggers escalation. Without an owner, a limited test can turn into an unmanaged practice.
Why define human review first?
The rule identifies who checks citations, reasoning and facts, and what must never reach a client without approval. It should exist before the first output, not after an incident.
How should team access work?
Use roles, least-necessary access, protected accounts and removal rules when people move. Keep the supplier record and incident route alongside the pilot.
Does everyone need training?
Everyone in scope should know prohibited data, tool limits, review duties and the incident route. Training follows the role; this assessment does not grade its sufficiency.
Does the AI Act answer compliance?
No. Applicability depends on role, system, intended use and dates. This assessment structures a pilot but neither classifies the system nor confirms compliance.
What does “scope before pilot” mean?
Narrow the use case, name an owner, document permitted data and review, then reassess. Do not move to client matters simply to work around a missing control.