Your firm uses AI. So does your disciplinary judge.

Why the legal profession has a governance problem that recommendations will not solve

At the end of 2025 the NOvA (the Netherlands Bar Association) published its ‘Aanbevelingen AI in de advocatuur’. At the end of 2025 the Rotterdam District Court reprimanded a lawyer who had submitted non-existent case law, presumably generated by ChatGPT. At the start of 2026 three lawyers received a warning from the supervisor for the same offence. One of them then turned up at the same court again with invented rulings.

I don't see that as an anecdotal incident. It is the first visible symptom of a structural problem: the Dutch legal profession is adopting AI at a high pace, without an operational framework that prevents this kind of error from happening again.

The figures are clear, the consequences are not

The Wolters Kluwer Benchmark Rapport 2026, based on a survey of 633 legal professionals, shows that 59.6% of Dutch legal professionals use AI tools. More than 84% plan additional investment. Adoption is no longer experimental but operational.

What that adoption does not include is at least as telling. Ask any managing partner of a firm with 30 lawyers which of their AI applications fall under the high-risk category of the EU AI Act. Ask too for which applications they are ‘deployers’ within the meaning of Article 26, and which use cases require a conformity assessment.

I believe the answers at the vast majority of firms are: we don't know, we haven't thought about it, we didn't know those questions existed.

The NOvA recommendations: direction without a route

The NOvA recommendations are skilfully drafted. They translate the core values (independence, partiality, expertise, integrity, confidentiality) into a context in which generative AI is a daily tool. The lawyer remains ultimately responsible. Check your sources. Carry out a DPIA. Document your considerations.

These are sensible principles, but principles are not processes.

A firm that reads the recommendations knows what it should do and not how. Which tool falls into which risk category? How do you classify an AI application that you use for case law research in an asylum case file, compared with a trade name dispute? Where do you record that classification? Who checks whether an employee uses ChatGPT for draft pleading notes in a criminal case?

The recommendations are a compass, and a compass without a map takes you to the same place as no compass: you walk in the direction that feels logical at that moment.

Supervision under construction, standards still in scaffolding

In its Werkplan 2026 the College van Toezicht Advocatuur (the Bar's supervisory board) has announced that AI use will become part of the conversations with the local deans. That is a step, but the work plan contains no substantive standard-setting. The College wants to learn how deans deal with AI use and does not say how they should do so.

The deans themselves struggle with capacity. The same work plan shows that the 10% norm for preventive firm inspections is structurally missed, and a capacity shortage is a major obstacle. Add a new, complex area of supervision, AI use by lawyers, and effective supervision in this area will not become reality tomorrow. Meanwhile use is accelerating.

The EU AI Act: not somebody else's problem

There is a widespread misunderstanding that the EU AI Act is mainly relevant to tech companies that build AI. That misunderstanding is dangerous, because the Regulation imposes explicit obligations on users of AI systems, the ‘deployers’ or ‘gebruiksverantwoordelijken’ in the Dutch translation.

Article 26 of the AI Act requires every organisation that deploys an AI system to, among other things, arrange technical oversight, carry out a risk analysis, monitor data input, and meet registration obligations. This applies to high-risk systems, but the definition of ‘high risk’ is broader than most firms suspect.

A law firm that uses AI structurally to analyse asylum files, to assess evidence in criminal cases, or to advise on employment law disputes, may be operating in the domain of Annex III. That is not because the tool itself is high-risk, but because the application is.

An article in Advocatie of March 2026 puts it sharply: many firms regard AI primarily as a supporting tool, for case law research, summaries and text suggestions, and do not make the link to the risk categories. Once AI output is used structurally in advice or decision-making, the risk profile rises. In practice the line between a smart word processor and a decision-support system is thinner than it looks.

Personal liability changes this

In the financial sector AI governance is an organisational risk. In the legal profession it is also a personal risk. The lawyer who submits non-existent case law is not reprimanded as a firm but is held personally to account under disciplinary law.

That makes the pain point more concrete here than in other sectors. A partner who has not adequately instructed an employee on AI use shares responsibility. A firm that has no AI policy but does have ten lawyers using ChatGPT every day has a latent disciplinary risk with every set of pleading notes that leaves the building.

I don't think the three warnings of early 2026 are an end point. I expect this pattern to become more frequent as use grows and the disciplinary judge becomes more alert.

The blind spot

That firms use AI is not the real problem, because that is unavoidable and in many cases desirable. The problem is the structural gap between the speed at which AI is adopted and the speed at which firms organise the governance around it.

Reading recommendations does not close that gap, and neither does a course on AI for the bar. Buying LegalPA with built-in anonymisation does not help either, however useful it is as a tool.

The gap is closed by answering three questions operationally, for every AI application the firm uses:

  1. Who is the owner? This is about practice and not about the paperwork. Who monitors whether this application is used for its intended purpose?
  2. What risk profile does this application have? What matters here is the use and not the tool. Case law research in a commercial matter is something different from case analysis in a criminal case.
  3. What happens if the output is wrong? That calls for a concrete protocol. Who checks? How? When?

Any firm that cannot answer those three questions per application has, in practice, a governance gap.

What now?

The legal profession is at a crossroads that most firms do not yet recognise as such. The technology is accelerating, regulation is getting stricter and supervision is intensifying. Because of personal liability, the risk grows every day that there is no operational governance.

As far as I am concerned, whether firms will structure their AI use is not up for discussion. What I don't yet know is whether they will do so before the next reprimand is theirs.

Jan-Willem Rodenhuis is managing partner of Ductus B.V. and writes on miliarium.nl about the effects of AI adoption in regulated sectors.

Sources

  • Wolters Kluwer, Benchmark Rapport 2026: Innovatie en Groei in Kleine Advocatenkantoren (n=633)
  • NOvA, Aanbevelingen AI in de advocatuur, 2025
  • College van Toezicht Advocatuur, Werkplan 2026
  • Advocatie, ‘AI Act-risicocategorieën blijven onderbelicht’, March 2026
  • Advocatie, ‘Advocaten gewaarschuwd na misbruik van AI in processtukken’, February 2026
  • Mr. Online, ‘Nederlandse advocaat valt door AI-mand’, October 2025
  • EU AI Act, Regulation (EU) 2024/1689