Summarising a contract, drafting a letter, translating a document, explaining a regulation: generative artificial intelligence tools save real time. Many staff members already use them, often with their own personal account and without saying so. The problem is not using ChatGPT in a professional office, but how it is used and with what data.
What is generative AI?
Generative AI is a type of artificial intelligence that can produce new content (text, images, audio, code) from a request written in natural language, called a prompt. ChatGPT, Claude, Gemini, Copilot and similar tools are based on language models trained on enormous amounts of text.
The key point to remember: they do not “know” things the way a database does. They produce the most plausible answer, which is often correct, but sometimes is not.
What are the real risks for an office?
1. Data confidentiality
Everything you paste into an AI service is sent to the provider’s servers. Depending on the service and the plan (free, paid personal, business), it may be stored, read during reviews or used to improve the models. For an office bound by professional secrecy and the GDPR, entering clients’ names, tax codes, contracts or financial statements into an unauthorised service may amount to unlawful processing or even a data breach (→ GDPR security measures and data breaches).
2. Errors and “hallucinations”
Models can invent legal references, court rulings, figures and quotations with complete confidence. In Italy and elsewhere there have already been reported cases of legal filings citing non-existent case law generated by AI. Responsibility remains with the professional.
3. Hidden use (shadow AI)
If the office provides no rules and no tools, staff will use AI anyway, with personal accounts and without any oversight. This is the riskiest situation of all.
4. New scams
Criminals also use AI to write flawless phishing emails and to clone voices. And documents received from third parties may contain hidden instructions designed to trick the AI assistants that read them (prompt injection).
What Italian law says: Law 132/2025
Law no. 132 of 23 September 2025, in force since 10 October 2025, is Italy’s first law on artificial intelligence. For the intellectual professions (Article 13) it essentially sets out two principles:
- AI may be used only for instrumental and support activities: the professional’s own intellectual work must remain predominant;
- to safeguard the relationship of trust, professionals must inform clients about the AI systems they use, in clear, simple and comprehensive language.
In practice: it is a good idea to update your engagement letter or privacy notice with a clause on the use of AI.
What about the European AI Act?
Regulation (EU) 2024/1689 (the AI Act) is being applied in stages. For those who use AI systems in a professional setting, the main topics are:
- AI literacy: measures to ensure that people who use these tools understand what they can and cannot do (Article 4, whose text was revised in 2026 by the so-called Digital Omnibus);
- transparency obligations (Article 50), applicable from 2 August 2026, for example for artificially generated or manipulated content such as deepfakes;
- the heaviest obligations concern high-risk systems, whose application was postponed by the Digital Omnibus to December 2027 and August 2028.
For most offices, using an assistant to write or summarise is not “high risk”, but staff training and transparency towards clients are good practice all the same, and partly legal obligations.
A 10-point internal AI policy
Here is a starting point to adapt with your own adviser:
- Authorised tools: only those specified by the office, with office accounts, not personal ones.
- Professional plans with contractual commitments on data use (no training on your content, limited retention, servers in the EU where possible).
- Never enter identifying client data into unauthorised tools: names, tax codes, IBANs, health data, litigation.
- Anonymise before pasting: replace names and details with placeholders.
- Always check every legal reference, court ruling, figure or quotation against official sources.
- The professional signs and is accountable: AI prepares drafts, it does not decide.
- Inform clients about the use of AI, as Law 132/2025 requires.
- Protect the accounts of your AI tools with strong passwords and two-factor authentication: they contain your conversation history.
- Short training for everyone: what is allowed, what is not, how to spot errors.
- A point of contact to ask when in doubt and to report problems to.
Safe use: practical examples
| Fine | Better avoided |
|---|---|
| “Write a draft payment reminder letter in a friendly tone” | Pasting the list of late-paying clients with names and amounts |
| “Explain in simple terms what the cedolare secca is” (Italy’s flat-rate tax on rental income) | Asking for tax advice and forwarding it to the client without checking it |
| “Summarise this publicly available legal text” | Uploading a client’s confidential contract to a free service |
| “Suggest a structure for a technical report” | Copying quotations from court rulings without checking them |
Security: AI is no substitute for the basics
An office that adopts AI in an orderly way is also an office that pays more attention to security in general. AI, however, does not protect your network or your computers: for that you need backups, updates, two-factor authentication and a monitored network. Strega Defence was created for exactly this: it protects the office network and alerts the owner in plain language when something that matters happens. To find out more about the relationship between AI and security, read artificial intelligence and cybersecurity; to take stock, try the 10-question checklist.
This article is for general information only and does not constitute legal advice. The rules on artificial intelligence are evolving: always check the latest texts.
Frequently asked questions
Can I put client data into ChatGPT?
Not into a service that the office has not authorised and that offers no contractual guarantees on how data is processed. You risk breaching professional secrecy and the GDPR. If you really need to, use approved professional tools and anonymise the data before entering it.
Do I have to tell clients that I use artificial intelligence?
Yes. Law 132/2025 requires professionals to inform clients about the artificial intelligence systems they use, in clear, simple and comprehensive language. It is best to do so in writing, for example in the engagement letter.
What are artificial intelligence hallucinations?
They are false answers presented as true: laws, court rulings, figures or quotations invented by the model in a plausible way. That is why every piece of generated content must be checked against official sources before it is used.
Is the paid version of ChatGPT safer for privacy?
Professional and business versions usually offer stronger contractual commitments, such as excluding your content from model training, and administrative controls. Terms change over time and from one provider to another: read and check them before adopting a tool.
Does a small office need an internal policy on AI use?
Yes, and it can be a single page. It makes clear which tools to use, which data must not be entered and who checks the results. Without rules, staff will use AI anyway, but with personal accounts and without any oversight.
Does the AI Act apply to professional offices?
Yes, to anyone who uses artificial intelligence systems in their professional activity, with obligations proportionate to the type of use. For use as a writing aid the obligations are limited, but staff training and transparency are still recommended.
Sources and further reading
- Legge 23 settembre 2025, n. 132 – Gazzetta Ufficiale n. 223 del 25/09/2025 (PDF) (in Italian) — Gazzetta Ufficiale, Italy’s Official Journal.
- Legge sull’intelligenza artificiale: scheda (in Italian) — Normattiva.
- Regulation (EU) 2024/1689 on artificial intelligence (AI Act) — EUR-Lex.
- Digital Omnibus on AI: Regulation (EU) 2026/1744 has been published — Cuatrecasas.
- Intelligenza artificiale: documenti e provvedimenti (in Italian) — the Italian Data Protection Authority (Garante per la protezione dei dati personali).
- Regulation (EU) 2016/679 (GDPR) — EUR-Lex.
Written by Ing. Sergio Florio, founder of Strega Byte, an engineer with over twenty years of experience across research, development and business. Article updated on 11 October 2026.
