The digital colleague no one hired

Roland Berger is a legal counsel working for a Swiss Federal Office. He is tasked with handling an administrative criminal proceeding. Before him lies an extensive case file: hearing transcripts, emails, reports, receipts, and multiple versions of individual documents. A significant portion of the case records is drafted in French.

Roland wants to understand what happened. To do so, he needs to translate the French hearing records, arrange the events chronologically, and identify inconsistencies between witness statements. At the same time, he requires an overview of the statutory enactments governing the proceedings and the substantive area of law concerned. Ultimately, he wants to cross-reference the chronology of events with these legal foundations: What legal characterization is applicable? Which statutory elements of the offense are relevant? Which penal provisions might apply? And what facts are still missing?

Roland is already familiar with and uses AI via a chat interface. The prospect is enticing: translate French case records in seconds, have hundreds of pages read, draft a timeline, and identify preliminary legal issues. AI seems tailored precisely for such preparatory tasks.

"What could possibly go wrong?"

Roland uses an AI tool provided to him by the Federal Administration. He is permitted to use it for general queries, drafting assistance, and conducting research in publicly accessible sources. Accessing enactments is therefore unproblematic: statutory laws are public and made available on the internet via Fedlex.

However, more stringent rules apply to the criminal case file. The Factsheet of the Federal Chancellery on the Use of Generative AI Tools expressly states that no classified information, no content protected by confidentiality obligations, and no personal data—in particular, no sensitive personal data—may be entered into such tools. In the context of a criminal case file, this does not merely concern peripheral details, but virtually the entire set of facts. The Federal Administration generally permits and promotes the use of AI; however, information security, data protection, and human accountability remain paramount.

As a lawyer, Roland knows that he is not permitted to upload the hearing transcript into this chat interface. The document contains personal data and information subject to official secrecy. Merely redacting names would not necessarily remedy this. Job titles, locations, timestamps, and described events could still allow conclusions to be drawn regarding the data subjects. Furthermore, the anonymized content of an interrogation transcript itself can remain subject to official secrecy: the protection extends not only to the identity of the parties involved, but also to the non-public facts of the case themselves. If, on the other hand, Roland were to edit the document so extensively that neither the persons involved could be identified nor non-public facts disclosed, the contextual links required by the AI for translation, crime reconstruction, and legal analysis would likely be lost. Moreover, the effort required for such redaction would be immense.

Nevertheless, Roland opens the chat interface. The upload button is clearly visible. Compiling the chronology alone would save him hours. To Roland, the risk appears low. The chat interface is provided by the Confederation, the upload takes only a few seconds, and potential damage is not immediately evident. Perhaps, Roland thinks, the file is only processed by machine anyway. And he knows: the Confederation complies with the statutory regulations governing employee monitoring in the workplace. He assumes that his conduct will not be detected immediately. The benefit is only a click away, whereas the potential harm remains abstract.

"What could possibly go wrong?"

Roland uploads the transcript. The chronology appears within seconds and is convincingly structured. Because nothing visibly goes wrong at first, Roland sees his risk assessment confirmed. He decides to upload further documents. The AI translates documents, summarizes testimonies, and points out potential contradictions. The result saves Roland time, tempting him all the more to upload even more material.

This is shadow AI: employees using a tool for information or tasks for which it is neither intended nor authorized. Roland is trying to resolve a real operational problem. While his employer provides him with an AI tool, it is not one authorized for processing protected files in compliance with official secrecy and personal privacy. Roland thus has access to AI, but lacks an approved solution for his actual task. From the employer's perspective, this gap cannot be closed simply by blocking specific tools or features. Employees may use a provided tool beyond its authorized scope or seek an alternative solution on their own—inside or outside the organization. This can also include resorting to private accounts with third-party AI services. What data such a service stores, the purposes for which it uses that data, and the configuration settings available depend on the specific commercial offering.

AI thus becomes a digital coworker whom no one hired and of whom no one is aware. At least officially.

The same issue arises in the private sector. Where law firms, corporate enterprises, or other organizations fail to provide appropriate tools, professional secrets, personal data, or confidential business information may end up in unauthorized services. In the case of staff without legal training, there is the added risk that they may not fully appreciate the legal ramifications of such use.

What Roland actually needs

Roland is not looking for a machine to deliver a final legal assessment. He requires assistance with several distinct procedural steps:

• locating and completely capturing relevant documents;

• reliably translating French-language case records into German;

• extracting persons, events, and timestamps;

• identifying evidentiary contradictions and information gaps;

• finding current statutory enactments and other legal authorities;

• cross-referencing the factual record with potential statutory elements of the offense;

• substantiating every assertion with citations to the record.

How reliably the AI can assist Roland depends critically on the available context. The case file may be incomplete, and a new witness statement could alter the existing chronology. A term in a French testimony might carry a different nuance than in its German translation. Furthermore, a legally material detail might reside in a document to which the AI lacks access.

AI can significantly streamline this work. However, it can only operate on the material it receives or is authorized to retrieve. And its outputs remain subject to mandatory verification.

From chat interface to digital coworker

A chat interface responds to individual prompts. Roland must select the relevant documents, provide the necessary context, and manually transfer the results from one work step to the next. With an extensive case file, Roland becomes the human patch cable between the records registry, the legal database, and the AI.

An AI agent, by contrast, can pursue an objective across multiple steps. It can retrieve documents, translate French records, draft a chronology, and reconcile it with the governing statutory provisions. Through standardized interfaces such as the Model Context Protocol (MCP), the AI can also utilize specialized business applications and tools. In simple terms, MCP can be understood as an electrical outlet for AI systems: it defines how an application makes selected data and functionality accessible to the AI.

Within an integrated working environment, the agent is granted access to case files, administrative circulars, and legal sources within the scope of Roland’s access rights. Furthermore, a memory layer can preserve prior corrections, workflow preferences, and interim results for subsequent tasks. Without such memory, every new context starts from scratch.

Roland no longer needs to instruct the agent on every discrete task and document. The organization determines which sources and tools the agent may access and what information it may permanently retain.

Does AI resolve the legal case?

No. Even an integrated and agentic AI cannot assess whether the case file is complete. It can juxtapose statements, but it cannot readily evaluate their credibility. It can identify potentially applicable penal provisions, but it cannot assume professional responsibility for their statutory interpretation and application.

Roland must verify whether the French statements were translated accurately and whether legal terms preserved their substantive meaning. He must ascertain whether the chronology is based on the correct documents, whether exculpatory evidence was considered, and whether the cited enactments remain in force. Above all, he must determine which facts are legally material and which conclusions are tenable.

The frequently posed question of whether AI will replace legal professionals therefore misses the point. AI transforms individual operational steps. It can unlock information, prepare translations, compare documents, and highlight potential issues. Contextual understanding, legal evaluation, strategy, communication, and professional accountability remain human responsibilities.

Regarding the limits of verification and the risk of deskilling through uncritical adoption, see also Legal AI and the Verification-Value Paradox and Thinking Without AI.

Who else is reading along?

A suitable working environment must meet both functional requirements and regulatory compliance standards. Merely examining the user interface is insufficient. Behind the visible digital coworker operate at least two technical layers.

The harness is the application software. It functions like a conventional, rule-based application and can be hosted on a dedicated server or in the cloud. The harness receives Roland’s prompt, checks access rights, searches authorized sources, integrates documents and tools, and compiles the request to the language model.

The actual AI process commences with LLM inference: the harness transmits the prompt and the necessary context to the language model; the model computes the response from this data. The harness and inference do not need to be hosted in the same environment. For example, the harness can run on an on-premise server and call a model hosted in a third-party cloud for inference.

For inference, two categories of models can be distinguished. In the case of open-weights models, the trained model parameters are available. They can therefore, in principle, be deployed on self-selected infrastructure. With so-called frontier models, these parameters remain with the vendor. The harness can only query the model via an API; prompt and context thus leave the perimeter of the harness.

The harness, document repositories, MCP servers, search infrastructure, and inference can therefore be operated by distinct commercial entities and across different jurisdictions.

This reframes Roland’s case into a new question: Where is protected information processed, and where is it stored? Who has technical access to inspect this data during storage, retrieval, and inference? What contractual safeguards suffice, and under what circumstances is protected information disclosed to a third-party vendor? This is the subject of Part Two: The Digital Coworker’s Employment Contract.