Why now — the EU AI Act, GDPR and secreto profesional

AI is no longer experimental in practice. It reviews documents in minutes, searches across more material than any one person could read, and reasons through more variations than a team has time for. Clients and regulators have both noticed, and a firm that ignores it is increasingly the outlier.

The question has shifted from whether to use AI to how to use it in a way you can stand behind. That is the question this workspace is built to answer.

[Source — pending verification (research pass)]

In Spain, the Consejo General de la Abogacía Española is explicit: the lawyer is the sole party responsible for the content of the documents they sign, AI results must never be used without a complete critical reading, and internal traceability of AI use must be kept.[1]

Under the EU AI Act, the high-risk classification attaches to AI used by or for a judicial authority or for alternative dispute resolution. A private firm's drafting and research assistant is a different thing in the regulation's own terms — this is a question of scope, not an exemption you have to argue for.[2]

Acta is designed to keep you on the right side of that line by default: the human lawyer decides, the system assists, and the record shows it.

Client files are personal data, and often special-category data. Where that data is processed, who can compel access to it, and whether it is ever used to train a model are all live questions under the GDPR.[3]

Acta's answer is structural: storage stays in the firm's own Google Drive or OneDrive, inference runs against European providers under zero-data-retention terms, and no part of a matter is used to train any model. The Architecture article covers exactly where data flows and where it does not.

Spanish secreto profesional is a duty of the lawyer under the Ley Orgánica del Poder Judicial. AI hosted on non-EU infrastructure can be exposed to foreign access regimes that no commercial contract fully removes — a risk to professional secrecy that sits alongside, and independently of, GDPR.[7]

The pressures point the same way: use AI, but be able to prove how. A workspace that verifies citations against the official source, keeps the lawyer in the approval seat, holds client data inside the firm, and logs every step turns each of those obligations into something you can show, not just assert.