Use Case: Legal

The Risk

Law firms and in-house legal teams handle some of the most sensitive documents in existence: M&A contracts, litigation briefs, client communications, and regulatory submissions. AI tools offer compelling productivity gains for drafting, summarizing, and translating — but lawyers routinely upload full documents without considering the data residency or confidentiality implications.

Typical Shadow AI incidents in legal:

Scenario	Data exposed	Obligation triggered
Associate uploads NDA to ChatGPT for redlining	Client names, commercial terms, IP clauses	Attorney-client privilege, GDPR Art. 5
Lawyer pastes litigation brief into AI for summary	Case number, client identity, legal strategy	Bar association secrecy rules (CNB/CCBE)
In-house counsel asks AI to translate a merger agreement	Counterparty names, financial terms, closing conditions	M&A confidentiality, GDPR Art. 6
Legal ops uploads contract database for AI analysis	All client names + contract values in bulk	GDPR Art. 28 (processor obligations)

What Noxys Detects

Tier 1 (browser-side, offline) recognizers for legal:

Recognizer ID	Pattern	Example
`LGL-001`	Case / dossier number (French court format)	`RG 24/08471`, `N° parquet 2024/000123`
`LGL-002`	Contract reference patterns	`REF-CONTRACT-2024-NDA-0047`
`LGL-003`	Legal clause markers (confidentiality headers)	`STRICTLY CONFIDENTIAL`, `CONFIDENTIEL — PRIVILEGE AVOCAT`
`LGL-004`	SIRET / company registration in legal context	SIRET adjacent to party names
`PII-001`	Client full name (NER, Tier 2)	detected in "between [Name], hereinafter..."
`LGL-005`	Bar registration number	`Barreau de Paris — A12345`

Tier 2 (server-side, Presidio NER) adds:

Party name + contract reference + date → active contract
Case number + client name + legal strategy language → litigation document

Policy Configuration

Recommended policy for a French law firm:

# CISO Console → Policies → New Policy
name: "Legal Privilege — Block Confidential Documents"
scope:
  groups: ["lawyers", "associates", "legal-ops", "paralegals"]

rules:
  - condition:
      risk_signals: ["LGL-003"]  # confidentiality header
      ai_services: unsanctioned
    action: Block
    coach_message: >
      A confidentiality marker has been detected in this content.
      Sending privileged documents to unsanctioned AI services may waive
      attorney-client privilege and violates bar association rules.
      Use the firm-approved secure AI workspace.

  - condition:
      risk_signals: ["LGL-001", "LGL-002"]  # case/contract refs
      ai_services: all_external
    action: Coach
    coach_message: >
      Legal case or contract reference detected. Verify this document is
      cleared for external AI processing before proceeding.

  - condition:
      risk_signals: ["LGL-001", "LGL-003"]  # case ref + privilege marker
      ai_services: all
    action: Block  # litigation docs: absolute block

  - condition:
      risk_signals: ["LGL-004", "PII-001"]  # company + client name
      ai_services: unsanctioned
    action: Log
    redact: true

Public research exception: Queries that reference only public legal databases (Légifrance, EUR-Lex) with no client identifiers pass through unimpeded — Noxys only fires when risk signals are present.

Detection Flow

Associate opens Claude.ai
  │
  │  Uploads/pastes: "STRICTLY CONFIDENTIAL
  │                   NDA between Acme Corp (SIRET 362 521 879 00034)
  │                   and NovaTech SAS, ref REF-CONTRACT-2024-NDA-0047
  │                   Please redline clause 8..."
  │
  ▼
Noxys Extension (Tier 1, offline, 1.4ms)
  ├─ LGL-003 match: "STRICTLY CONFIDENTIAL" header
  ├─ LGL-002 match: contract reference detected
  ├─ LGL-004 match: SIRET in legal context
  └─ Risk score: HIGH (3 legal signals)
  │
  ▼
Policy Engine
  └─ Rule: Legal Privilege — Block Confidential Documents
       Action: BLOCK
  │
  ▼
HTTP request CANCELLED
  │
  ├─ User sees: privilege warning overlay
  │             with link to firm-approved AI workspace
  └─ DLP event log: signals, user, target service, timestamp
     → No document content stored

Approved AI Workflow (Allow Path)

For legitimate AI-assisted legal drafting on an approved platform:

Firm provisions a dedicated enterprise AI tenant (e.g. Microsoft Copilot for Legal, or a self-hosted instance)
That service is added to the Noxys AI Service Catalog as sanctioned
Policy is scoped: action: Log for sanctioned services + action: Block for unsanctioned
All AI interactions with client data are logged with full audit trail for file documentation

Configure in: CISO Console → AI Service Catalog → Add Service.

Compliance Mapping

Obligation	Requirement	How Noxys satisfies it
Attorney-client privilege (FR/EU)	Confidential communications must not be disclosed	Block prevents transmission; privilege marker recognizer catches documents at source
CNB / CCBE bar rules	Professional secrecy — avocat cannot share client data without consent	Policy blocks client-identified content to unsanctioned AI; approved workspace logged
GDPR Art. 5(1)(b)	Purpose limitation — client data processed only for specified legal purpose	AI service catalog ensures data only goes to purpose-compatible services
GDPR Art. 28	Processor agreements required for third-party data handling	Unsanctioned AI = no DPA = blocked; sanctioned AI = DPA on file
GDPR Art. 30	Processing records	Per-event log: user, document risk signals, service, action

Evidence for Bar Association and DPO

Noxys generates per-event records showing:

Confidentiality signal IDs triggered (e.g. LGL-003) — no document text stored
Whether the transmission was blocked, coached, or logged
Target AI service (URL + catalog classification)
User pseudonym + timestamp

This audit trail demonstrates proactive controls to bar associations and satisfies GDPR Art. 30 ROPA requirements.

Export path: CISO Console → Reports → DLP Audit Export or API /v1/events?category=legal.

The Risk​

What Noxys Detects​

Policy Configuration​

Detection Flow​

Approved AI Workflow (Allow Path)​

Compliance Mapping​

Evidence for Bar Association and DPO​