Your file goes into AI.
Where does it go next?
Summarising a document or preparing a contract saves time. You also share information, a way of working and sometimes a strategy. Six facts to help you make an informed choice.
These tools must fund enormous infrastructure.
On 21 January 2025, a major AI provider announced a planned investment of $500 billion over four years for a joint infrastructure project. On 18 January 2026, its CFO reported an annualised revenue run rate of more than $20 billion in 2025.
Two historical measures of scale, not an accounting subtraction: the first is a project with partners, not capital already spent by that provider; the second extrapolates a revenue rate, rather than reporting profit or revenue collected over the year.
The economic question is future revenue. The provider describes subscriptions, usage charges, advertising and, in future, licensing and outcome-based pricing. Our interpretation: providers seek a growing share of the value of work done with their tools.
A paid subscription does not settle the data question.
Training changes what a model has learned for future answers. Processing a document does not automatically mean training on it. Consider the specific provider documented in our sources. Its Europe terms for individuals in Switzerland allow content to improve services, with an option to opt out of training. Business, Enterprise and API offerings fall under a different agreement.
Individual plans: the cited terms allow content to improve services, with an account setting to opt out of training.
Business agreement: the cited clause excludes service improvement using customer content unless the customer explicitly agrees.
Training and retention are separate questions. Ordinary chats remain saved until deleted or removed by an applicable retention policy. After deletion, permanent removal is scheduled within 30 days, with exceptions including legal or security needs. A separately saved file must also be deleted separately.
Enterprise administrators set retention periods. For the API, abuse-monitoring logs may contain requests and remain for up to 30 days by default, sometimes longer under exceptions; certain features also store their own application state. Check the actual plan, settings and features being used.
Providers already offer legal tasks.
A major AI provider’s legal module advertises contract review, non-disclosure agreement triage and compliance workflows. It can apply an organisation’s negotiating positions. The provider says outputs should be reviewed by licensed attorneys.
These are tasks, not an entire profession. Automating them may shift some billable value towards software: a possible economic consequence, not a prediction that law firms will disappear. Your clause templates, judgement and client knowledge remain assets to organise and protect. Sending them does not establish either a transfer of ownership or their use in model training.
In Switzerland, confidentiality remains your responsibility.
Article 13 of the Lawyers Act protects professional secrecy; article 321 of the Criminal Code penalises a breach when the elements of the offence are met. The Data Protection Act governs matters including security, outsourcing and disclosures abroad. A commercial contract does not remove the need to assess these duties.
The Swiss Bar Association’s guidelines, adopted on 14 June 2024, call for clarification of who can access data and where it is stored. They envisage internal AI, outsourcing with safeguards, and a route based on informed consent. Cloud services are not prohibited in principle. Removing a name is insufficient if the context still identifies the client.
Running AI at the firm changes the route your files take.
AI on your network can process documents without sending them to a remote model provider. The Swiss Bar Association describes this option with a condition: data stays inside the firm’s infrastructure.
“Local” needs checking across the whole system. Documents, text recognition, search, backups, logs and support: one external service can reintroduce a transfer. This check is our practical recommendation. Access still needs securing, the machine needs maintenance, and answers need quality control. The firm gains technical control and takes on operational responsibility.
In two years, could you explain what you did?
This is a scenario, not a legal deadline. The Code of Obligations already requires proper and faithful performance of the mandate (art. 398) and an account of its management at the client’s request (art. 400). This does not automatically grant access to every IT contract or log.
“Where did you send my file? Under which safeguards? What can you show me today?”
Keep proportionate records: approved tools and plans, dated terms, settings, recipients, retention and human review. Avoid unnecessarily copying secrets into logs. The aim is to demonstrate appropriate safeguards, without promising to prove that no incident has ever occurred.
Three things to do at the firm
- List the tools, accounts and types of files already being used.
- Decide what may leave, with which safeguards, and what must remain internal.
- Test a useful task with fictional documents, then record the decision.
And Brigitte Box? It is a project for AI within the firm’s infrastructure, accompanied by a review of uses and safeguards. Its suitability should be judged on verified data flows, work quality and clear responsibilities. The first step is to understand your situation.
Educational document · 5 November 2026. Terms change: review your applicable contract when making a decision.