Legal translation and AI: translating a contract without publishing it
Translation is the one common AI use that transmits the entire document, unfiltered and in sequence. For a profession bound by secrecy, that shifts the question: it is no longer about choosing a provider, but about whether the file leaves the firm at all.
Why translation is a special case
Most legal uses of AI handle nothing more than extracts, whether a question, a paragraph or a clause, whereas translation sends the entire document, in full and in sequence, which is what sets it apart and what makes it risky although it looks harmless.
Three consequences follow from that, and together they explain why this usage escapes the usual control mechanisms.
The volume transmitted is maximal, a share purchase agreement contains the parties, the amounts, the warranties, sometimes named annexes. Nothing is filtered, since translation requires the complete text and the whole document therefore leaves for the provider.
Context survives naive anonymisation, replacing names with variables protects little when the document describes an identifiable transaction : an acquisition in a narrow sector, a dispute covered by the press. Re-identification therefore remains within reach of anyone who holds the text.
The usage is spontaneous and decentralised, translation is almost never an IT project. It happens in a browser tab, by a lawyer in a hurry, on a consumer tool no department approved. It escapes the processing register precisely because nobody has ever thought to declare it.
Two regimes that stack
The common reflex consists in treating the question under GDPR alone, which is insufficient in legal work, because two distinct obligations apply at once and are not cured by the same remedies.
| Data protection | Professional secrecy | |
|---|---|---|
| What is protected | The personal data of the data subjects | The information entrusted, personal or not |
| Who can lift it | The data subject, in some cases | Nobody, in the case of a lawyer |
| Contractual remedy | A processing agreement frames the processing | A contract does not undo the communication |
| Effect of sending to a third party | A transfer to frame and document | A disclosure of entrusted information |
The last row of the table is the one that decides, because a well-drafted processing agreement settles the GDPR question without making the document un-sent. For a secrecy duty whose protection does not depend on consent, the only measure that answers the problem is not to transmit.
That distinction explains why legal departments that run the analysis seriously often reach the same conclusion: on documents covered by secrecy, the debate is not about choosing a provider but about whether the file leaves the firm at all.
What "we do not retain your data" does not cover
Online translators all display a reassuring policy, which deserves to be read for what it states and even more for what it passes over in silence.
- Non-retention is not non-transmission, the document was sent, decrypted and processed on third-party infrastructure. That fact stands whatever the retention period afterwards.
- Technical retention remains, application logs, queues, caches and backups have their own periods, rarely aligned with the commercial promise. We cover this in zero retention: what the clause really guarantees.
- Free and enterprise tiers differ, the non-reuse policy is almost always attached to the paid contract. Someone using the public version is covered by nothing.
- Declared location is not verifiable, you depend on it without being able to observe it, and that is exactly what the assessment must record.
On-premises translation, concretely
Machine translation is technically one of the most accessible tasks to run locally, since it needs neither long reasoning, nor an extended context, nor the largest model available on the market.
Three technical properties help here, and they compound rather than merely adding up. The work splits naturally by paragraph, so the required context window stays modest even for a hundred-page document. The task is well covered by mid-sized multilingual open-weight models, which fit on accessible hardware : see which open source LLM to choose. Finally, throughput barely matters: nobody expects a contract translated in three seconds, which allows far more modest hardware than a conversational assistant.
Typical sizing for a firm or a legal department fits on a dedicated workstation, at the level of a DGX Spark or a Mac Studio, with a runtime such as vLLM to serve several users. The sizing matrix sets out which combinations of model and hardware actually fit together on a given machine.
The real difficulty lies not in available compute but in the terminological quality of the result. A general model will render a term such as "consideration" literally where contract law expects a specific equivalent, and two measures close that gap: a glossary enforced at generation time, and human review, which remains mandatory : assisted translation does not replace the legal translator, it spares them the first pass.
A realistic sequence
Banning online translators without offering an alternative does not work: the usage continues, simply more discreetly, and the organisation loses the visibility it had. The sequence that holds is graduated.
- Classify documents into two categories only: covered by secrecy, or not. A finer classification will not be applied by users.
- Open an internal route for the first category before banning anything. A ban is only tenable once the alternative exists.
- Set the domain glossary at go-live, not after the first complaints about quality.
- Log internal translations: which document, by whom, when. That is what turns a policy into evidence, and it also shows real adoption.
- Measure the shift in usage before closing access to public tools. Closing too early creates workarounds.
This article describes architectural consequences and is not legal advice; the professional duties specific to each regulated profession should be assessed with the relevant bar or body. Sources: CNIL recommendations on AI and GDPR, CNIL practical AI sheets, Regulation (EU) 2024/1689. Accessed August 28, 2026.
What to remember
Translation is the one common AI use that transmits the entire document. That makes it structurally different from the others, and it explains why a good processing agreement only half answers it: it frames the processing of data, it does not undo the communication of entrusted information.
It is also, fortunately, one of the easiest uses to bring back in-house: short context, mid-sized model, non-critical throughput. We develop the topic for the profession on our legal sector page, and a conversation is enough to size an internal translation workstation.
Frequently asked questions
Can you use an online translator for a contract?
Technically yes, legally it is a communication of the whole document to a third party. Two regimes then apply at once: data protection, which a processing agreement can frame, and professional secrecy, which no contract undoes since the document was indeed transmitted. On a document covered by secrecy, the only measure that answers the problem is not to send it.
Is anonymising the document before translating it enough?
Rarely. Replacing names does not protect when the document describes an identifiable transaction: an acquisition in a narrow sector, a dispute covered by the press, a structure whose amounts are distinctive. Re-identification stays available to whoever holds the text, and translation requires transmitting the complete text.
What is the promise 'we do not retain your data' worth?
It covers retention, not transmission: the document was sent, decrypted and processed on third-party infrastructure, which stands whatever the period afterwards. It also leaves out logs, queues, caches and backups, which have their own periods. Finally it is almost always attached to the paid tier, not the public version.
What hardware does local translation need in a law firm?
Less than a conversational assistant. Translation splits by paragraph, so the context window stays modest, and throughput is not critical since nobody expects a contract translated in three seconds. A dedicated workstation at the level of a DGX Spark or a Mac Studio, with a mid-sized multilingual open-weight model, covers a firm's need.
Does AI translation replace a legal translator?
No. A general model gets contractual terminology wrong, where the everyday word and the legal term diverge. Two measures narrow the gap: a glossary enforced at generation time, and mandatory human review. AI does the first pass; it does not sign off the translation.