EU AI Act compliance for legal AI in 2026

Annex III, point 8(a) of the AI Act covers "AI systems intended to be used by a judicial authority or on their behalf to assist a judicial authority in researching and interpreting facts and the law and in applying the law to a concrete set of facts, or to be used in a similar way in alternative dispute resolution" [1]. This is the core legal-AI high-risk hook. Point 8(b) captures AI used to influence the outcome of an election or referendum.

Private-sector legal AI - contract analysis, due-diligence review, deposition summarisation, e-discovery clustering - is generally not high-risk under Annex III on its own. It can become high-risk if it is sold into a court or used to make a decision about access to essential private services such as legal aid eligibility (Annex III, point 5(a)). The American Bar Association's Formal Opinion 512 sets parallel professional-conduct expectations on competence, confidentiality, supervision and reasonable fees when lawyers use generative AI [2], and the CCBE Guide on the use of AI tools by lawyers gives the European-bar reading of the same principles [3].

For Annex III high-risk systems, Article 43 of the Act sets the conformity assessment route. Most Annex III systems, including legal AI under point 8(a), use the internal-control procedure of Annex VI. The provider runs a self-assessment against the requirements in Articles 8 to 15 (risk management, data governance, technical documentation, record-keeping, transparency, human oversight, accuracy and robustness, cybersecurity), draws up an EU declaration of conformity under Article 47, affixes the CE marking under Article 48, and registers the system in the EU database under Article 49 [1].

A notified-body assessment is only required for the biometric Annex III categories that fall under point 1, which is not where legal AI sits. The practical implication: providers of legal AI for courts can ship without a notified body, but the documentation pack is the deliverable that proves the assessment was actually done.

Three tests in sequence. First, intended purpose. The provider's documentation, marketing material and end-user instructions must state who the system is for. A tool marketed to courts is high-risk; the same model marketed to law firms for contract review is generally not. Second, deployment context. A private-sector tool that ends up integrated into a court workflow can be reclassified, with the deployer assuming provider obligations under Article 25 if they substantially modify the system or use it for a different purpose.

Third, the Article 6(3) carve-out. Even where a system performs a task listed in Annex III, it is not high-risk if it performs a narrow procedural task, improves the result of a previously completed human activity, detects decision-making patterns without replacing or influencing the human assessment, or performs a preparatory task. The carve-out has to be documented; it is not assumed. The European Commission's February 2025 guidelines on prohibited AI practices and ongoing AI Office guidance set the canonical reading [4].

Annex IV of the Act lists the contents of the technical documentation pack. For a high-risk legal AI system that pack must include a general description (intended purpose, version, hardware, software interfaces), a detailed description of the elements and the development process (design specifications, system architecture, computational resources used to develop the model, data requirements, human oversight design, validation and testing procedures), the monitoring, functioning and control systems, a description of the risk management system, the changes made to the system through its lifecycle, the standards applied, and the EU declaration of conformity [1].

For legal AI specifically, Article 10 data-governance evidence is the part that most providers under-invest in. Training data must be relevant, representative, free of errors, complete, and statistically appropriate. For a model trained on EU case law, that means provenance for every corpus, a written treatment of jurisdictional balance across Member States, a written treatment of language balance across the 24 official languages, and a documented bias-evaluation pass against protected categories cited in the source data.

Article 14 requires that high-risk systems be designed so that natural persons can effectively oversee them. For legal AI assisting a judicial authority, the meaningful oversight test is whether the judge or clerk can override the system on a per-case basis and whether the override is logged. A UI confirmation button is not oversight. The system must surface the legal authorities cited, the inference path between authorities and the suggested outcome, and the confidence band associated with the suggestion. The override has to be possible at any step of the workflow and the override has to be the documented default behaviour when confidence is low.

The CCBE Guide and the ABA Formal Opinion 512 converge on the same operational point from a professional-conduct angle: the lawyer or judicial officer is responsible for the legal output, regardless of how the AI was used to produce it [2] [3]. The Council of Europe's Framework Convention on AI, opened for signature in September 2024, sets a parallel international-law floor on AI used in administration of justice [5].

Impetora ships every legal AI system with the five conformity artefacts as named deliverables in the master services agreement: a written risk classification analysis (high-risk yes or no, with the Annex III reasoning written out), a data-governance description aligned with Article 10, a draft technical documentation pack aligned with Annex IV, a human-oversight design spec, and a post-market monitoring plan with named metrics, owners and reporting cadence.

For private-sector legal AI that sits below the high-risk line, the same artefacts still get produced because the next deployment context (a court pilot, a public-sector contract, a regulator request) can trigger high-risk reclassification overnight. Building Annex IV documentation up-front is cheaper than retrofitting it under audit pressure. Cross-references: the EU AI Act overview, the legal industry hub, the document processing automation use case, and the TRACE methodology.