The authorities are designated. What they can ask for.
Three obligations have been enforceable since 2 August. What changed is not the list, but the machinery that enforces it.
On 2 August, three obligations under the European artificial intelligence regulation became enforceable for law firms and legal departments: the prohibition of certain practices, a duty of means on the competence of teams, and the transparency obligations of Article 50.
Six weeks earlier, an amending regulation had postponed the high-risk obligations to December 2027. Many took note of the postponement and concluded there was nothing to do this autumn. That is the most widespread error of the season: two distinct sets have been conflated.
But the event of 2 August is not the list of obligations, two of which had existed since February 2025. It is the machinery that enforces them. The competent national authorities are now designated, with their powers of investigation and sanction.
For a firm, that shifts the question. The theoretical amount of a fine is not what counts: what counts is that an authority asking about your uses expects a documented answer. And that an absence of documentation is itself a signal.
Three pieces of work follow, none of them dependent on a regulatory timetable. An inventory of uses, bearing in mind that undeclared uses always outnumber declared ones. The characterisation against the high-risk regime, which takes a few hours and produces a dated document. And governance, which already arose before this regulation, from professional secrecy alone.
None of these three concerns the choice of a tool. All three concern the ability to describe what one does.
Reading this month
ChatGPT, Claude and the client matter
Two foreign decisions last winter settled questions nobody had asked.
Share purchase deals: the data room
A liability spotted on the third day of a review, followed to the clause that handles it twelve weeks later.
Legal copilots and professional secrecy
Why a well-drafted confidentiality clause does not answer the question professional secrecy raises.
The full corpus: max-legal.ai/blog
Logging
The automatic recording of the operations a system performs: who did what, when, on which item. Every system produces some. The useful question is not whether it logs, but what you will be able to extract, in what form and for how long.
That is exactly what an authority will ask for.
The full definition →Late news
What three and a half hours of outage showed
On Thursday 3 September, from 3 p.m. to 6.30 p.m., ChatGPT, Claude and Grok were unavailable simultaneously, OpenAI citing a network routing error. Over the same window, two hundred and thirty-six model calls completed from MAX: two hundred and six at OpenAI, twenty-nine at Google, one at Anthropic. No provider error, no degradation in response times.
The explanation is technical rather than meritorious: a consumer interface and the programming interface of the same provider are two distinct services. The first went down, the second held. Had all of them gone down together, MAX would have stopped like everything else. What it establishes is more modest: a firm's work should not stop because a consumer interface is unavailable.
MAX now produces PowerPoint presentations.
Three ways to go about it. From a request and your source documents, the presentation is composed entirely. From a PowerPoint template you supply, it adopts your house style. And an existing presentation can be picked up and amended rather than rebuilt.
The presentation can form part of a wider request: an analysis, the contractual amendments that follow from it, the summary email and the presentation, in one sequence.
Not yet subscribed and would like to
Receive the next one
Once a month, at the start of the month.
Four minutes to read.