AI & Data Guidlines

1. Saxerlegal(e) Internal Guidelines; Purpose, Scope and Definitions

These guidelines set firm-wide rules for the responsible use of Thomson Reuters’ CoCounsel Legal and other cloud-based data processing solutions, aligned with European Union data protection law (GDPR), Swiss data protection law (revised FADP/DSG), and professional secrecy obligations. They apply to all partners, fee earners, trainees, paralegals, consultants, contractors, and staff, and to all client matters and internal projects.

For these guidelines: - CoCounsel means Thomson Reuters’ CoCounsel Legal AI-based legal assistance system provided as a cloud service. - AI tool means any software or service that uses machine learning or generative AI to assist with legal or business tasks, whether standalone or integrated into other systems. - Cloud processor means any third-party provider that processes data for the firm via remote infrastructure, platforms, or software (including sub-processors). - Client confidential information means information subject to legal professional privilege, professional secrecy, or confidentiality obligations owed to a client or prospective client. - Personal data means any information relating to an identified or identifiable natural person under GDPR and the revised FADP. - Special category data means personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for identification, health data, or data concerning sex life or sexual orientation (and data on criminal convictions where applicable). - Cross-border transfer means making personal data available to, or otherwise transferring or permitting access by, recipients in another country, or to an international organisation, including remote access from abroad.

2. Roles and Responsibilities

Partners are accountable for compliance on their matters, must ensure appropriate approvals, and supervise fee earners’ use of CoCounsel and cloud tools. Fee earners must follow these guidelines, minimise data disclosed, validate outputs, and escalate risks. IT/Security is responsible for technical due diligence, security configuration, access management, monitoring, and incident response. The DPO/Privacy Lead oversees data protection compliance, conducts or signs off DPIAs, transfer assessments and Article 28/FADP outsourcing terms, and advises on transparency and consent requirements.

3. Permitted and Prohibited Uses

CoCounsel and approved cloud AI tools may be used for research assistance, drafting support, summarisation, structuring documents, pattern or issue spotting, and workflow automation where human review is maintained and confidentiality is protected.

The following are prohibited: - Uploading highly sensitive client secrets, settlement strategies, unfiled pleadings, or identifiable factual matrices unless partner-approved and the DPO/Privacy Lead confirms suitable safeguards. - Entering credentials, security tokens, or internal system information. - Using non-approved or consumer AI accounts, personal cloud storage, or free trials for client work. - Relying on AI outputs as final legal advice without documented human review and verification. - Entering special category data or criminal data unless strictly necessary, authorised, and covered by an appropriate lawful basis and safeguards. - Uploading third-party confidential information contrary to legal or contractual restrictions.

4. Client Confidentiality and Professional Secrecy

The firm must preserve legal professional privilege and professional secrecy under EU Member State and Swiss law. Disclosure of client confidential information to a third party (including a processor) is only permitted where necessary, proportionate, and consistent with professional secrecy rules, and where contractual and technical measures preserve secrecy and privilege.

Decision tree: - Does the proposed use involve disclosing client confidential information to CoCounsel or another cloud processor? If no, proceed. If yes, continue. - Is disclosure strictly necessary and proportionate for the task, with adequate minimisation and pseudonymisation where possible? If no, redesign the workflow. If yes, continue. - Is the processor under enforceable confidentiality/processing terms that preserve secrecy and privilege, with appropriate technical and organisational measures? If no, do not proceed until in place. If yes, continue. - Will the disclosure involve cross-border transfer or access from outside the EEA/UK/Switzerland? If yes, ensure transfer safeguards as set out below. If no, continue. - Do professional secrecy or bar rules require client notice/authorisation due to the nature or sensitivity of the disclosure or reliance on consent for transfers? If yes, obtain client notice/authorisation/consent using Appendix A. If no, proceed. - Record the assessment and approvals in the matter file.

Where professional secrecy would be compromised or the international transfer compliance relies on client consent, client notice/authorisation/consent is required. For routine processor use covered by robust secrecy-preserving terms and adequate safeguards, there is no categorical client approval rule; apply the above assessment and document the outcome.

5. Data Protection Compliance

Lawful basis: Identify a lawful basis before processing personal data via CoCounsel or cloud tools, typically legitimate interests or performance of a contract with the client; for special category data rely on an appropriate derogation and implement enhanced safeguards. Transparency: Ensure privacy notices to clients, counterparties, and staff describe AI and cloud processing in clear terms, including categories of recipients, transfers, and retention. Records of processing: Maintain and update ROPA entries for AI and cloud processing activities. DPIA triggers: Conduct a DPIA where processing may result in high risk, including large-scale processing, special category data, systematic monitoring, novel AI uses, or cross-border transfers with residual risk. Data minimisation and retention: Limit inputs to what is necessary, prefer redaction or pseudonymisation, and align retention with matter schedules; prevent AI tools from training on client data unless contractually disabled. Data subject rights: Route access, rectification, erasure, restriction, objection, and portability requests to the DPO/Privacy Lead; verify identity and evaluate privilege/secrecy limits before disclosure.

6. Vendor and Processor Management

Due diligence must cover ownership, security certifications, data location, sub-processor chain, access controls, encryption, logging, audit, incident response, model training policies, and support for EU/Swiss data protection. Contracts must include GDPR Article 28-style processor terms and Swiss FADP Article 9-style outsourcing terms, including scope, instructions, confidentiality, security, assistance with rights and DPIAs, sub-processor approval and flow-downs, data location and transfer safeguards, audit and inspection rights, breach notification, deletion/return, and restrictions on training on client data without explicit approval. Sub-processors require prior specific or general written authorisation with notice and objection mechanisms. Maintain an approved vendor register.

7. International Transfers

Transfers to countries with adequacy decisions may proceed subject to contract and security. For other destinations, implement appropriate safeguards, typically Standard Contractual Clauses or equivalent Swiss mechanisms, with necessary modules and appendices populated, and supplemental measures where needed. Complete a transfer impact assessment to evaluate local laws and practical risks and document conclusions and mitigations. Explicit consent may be used only as a last resort where no other safeguard is feasible, the transfer is occasional and not repetitive, the data subject is fully informed of risks, and consent is documented; this may not suffice for professional secrecy without client authorisation. Record all transfer mechanisms and assessments in the matter file.

8. Security Controls

Access control: Use least-privilege access, role-based permissions, and timely offboarding. MFA: Enforce multi-factor authentication for all administrative and user access to AI and cloud tools. Encryption: Require encryption in transit and at rest; for highly sensitive matters, require client-side encryption or field-level encryption where supported. Logging and monitoring: Enable immutable logs of access, prompts, outputs, admin actions, and data exports; review regularly. Secure configuration: Disable data retention and training on client data where possible, restrict data export, enforce IP allowlisting for admin access, and segregate environments. Incident response: Follow the firm’s incident response plan; promptly contain, assess, and notify. Breach notification workflow: Immediately inform IT/Security and the DPO/Privacy Lead; assess notification obligations to clients and authorities under GDPR/FADP and professional secrecy constraints; coordinate communications and remedial measures.

9. Quality and Risk Controls for AI Use

Prompt hygiene: Avoid unnecessary identifiers; use neutral descriptors, pseudonyms, or redactions; do not disclose non-essential facts. Verification: Treat outputs as drafts; verify citations, quotations, and legal analysis against authoritative sources; record verification steps. Hallucination risk: Cross-check factual assertions; do not attribute facts to clients or counterparties based on AI output without independent support. Supervision: Partners must review AI-assisted work products before they go to clients, courts, or counterparties. Training: Mandatory periodic training on these guidelines, data protection, security, and effective AI prompting and validation. Model updates: Monitor release notes; reassess risks after significant tool changes.

10. Documentation and Approvals

Tool onboarding: Submit a request to IT/Security and the DPO/Privacy Lead with business need, data categories, processing purposes, locations, sub-processors, security features, training policies, and proposed contract terms. Approvals require completed due diligence, contractual safeguards, and, if needed, a DPIA and transfer assessment. Matter-level approvals: Partners decide whether AI/cloud use is appropriate on the matter, considering secrecy, sensitivity, and transfer implications; seek DPO/Privacy Lead input for high-risk or cross-border scenarios; document the decision and any client notice/authorisation/consent. Periodic review: Review approved tools, contracts, and these guidelines at least annually or after material legal or technological changes; retire or re-assess tools as needed. Record-keeping: Maintain approvals, DPIAs, TIAs, ROPA entries, training logs, and incident records.