How to remove client and matter details from AI prompts

"May a lawyer use a chat-based AI tool?" is usually the first question. A more useful one is narrower: what does the prompt reveal about the client and the matter?

The German Federal Bar's (BRAK) guidance on AI recommends keeping prompts abstract and anonymising client data. It does not show how. This piece walks through a method, step by step, with a fictional before-and-after example.

Not legal advice. Whether a given use meets professional secrecy and the German rules on attorney service providers (BRAO §43e) is for counsel to decide. For the overall chain of selection, written agreement, configuration and human review, start with how German attorney service-provider rules apply to AI tools in a law firm.

Why removing the name is not enough

A prompt can point to a matter without naming anyone. A file number, an unusual date, a town, a contract value, a niche industry and a sequence of events can together be as clear as a name, especially to someone who already knows the case. Even the fact that a person or company is a client of the firm can be confidential.

So the goal is not "no names". The goal is a prompt from which nobody outside the firm could reasonably tell whose matter it is.

Step 1: Write down what the task actually needs

Before editing anything, write the question the tool should answer in one sentence, with no facts at all. Many questions turn out to be general. "Which points should a reply to an early termination of a long-term service contract address?" needs no names, dates or amounts.

Add facts only where the answer depends on them. Everything else stays in the file.

Step 2: Remove direct identifiers

Delete everything that names or points to a person, a company or a file:

• names of clients, counterparties, witnesses, employees and advisers
• company names, brands and product names that are specific to the matter
• addresses, email addresses, phone numbers
• internal file numbers and court reference numbers
• contract, customer, account, tax and registration numbers
• signatures, letterheads and links to internal systems

Step 3: Replace people with roles

Describe each party by its function in the matter: "the client (service provider)", "the counterparty (customer)", "the client's managing director". Roles keep the prompt readable and the answer usable. If several parties share a role, number them: "Customer 1", "Customer 2".

If you keep a list that maps roles back to real parties, that list stays inside the firm and never goes into the tool. Placeholders that can be mapped back are pseudonymisation, not anonymisation, and under data protection law pseudonymised data generally remains personal data. What protects the client in practice is that the tool never receives the mapping and that the context in steps 4 and 5 no longer gives the matter away.

Step 4: Generalise what makes the matter recognisable

• Dates: turn exact dates into relative timing ("shortly after", "about three months after signing"). If the answer depends on a real deadline calculation, do that calculation inside the firm, not in the tool.
• Amounts: drop them if size does not matter. If it does, describe the order of magnitude rather than the figure.
• Places: "in Germany" is often enough when the governing law matters. Name a region or court level only when the question depends on it.
• Industry and products: go one level broader. "A building services company" rather than the specific niche it works in.
• Unusual events: press coverage, a rare incident, a well-known dispute. Remove them or describe them in general terms.

Step 5: Cut every fact the question does not need

Go through the prompt sentence by sentence and ask: would the answer change without this? If not, delete it. Shorter prompts reveal less and usually get more focused answers.

Step 6: Read the prompt as an outsider

Before sending, read the prompt as three people would: the counterparty, someone in the client's industry in the same region, and a journalist who followed a related story. Could any of them recognise the matter?

If yes, generalise further or do not use the tool for this question. For sensitive matters, have a second person in the firm do this reading.

Step 7: Paste clean text, not files

Files carry more than their visible text: file names, document properties, tracked changes, comments, headers and footers, email signatures and quoted threads. Copy the edited excerpt into a clean text instead of uploading the original document.

Step 8: Put the specifics back inside the firm

The answer comes back in general terms. Apply it to the real matter in the firm's own systems. Do not paste the real names and details back into the tool to "finish" the draft, because that undoes every step above.

A fictional before and after

Fictional example. All names, places, numbers and facts are invented and do not describe any real matter.

Before:

Our client Example Building Services, Stuttgart, file 2026/0815, received notice on 14 March 2026 from Sample Logistics terminating the maintenance contract for its warehouse near Stuttgart, worth 480,000 euros a year. Managing director Jana Example says the notice came two days after she complained about late payments. Draft a reply to Sample Logistics rejecting the termination.

After:

A service company in Germany has a multi-year maintenance contract with a logistics customer. The annual contract value is significant. The customer terminated early, without stating a reason, shortly after the service company had raised late payments. Which points should a reply rejecting the termination address, and which contract clauses should be checked first?

What changed:

• Client, counterparty and managing director became roles, or dropped out where the question did not need them.
• The file number, the city and the warehouse location are gone. "In Germany" stays because the governing law matters.
• The exact date became "shortly after". The exact amount became "significant".
• The task changed from drafting a letter to a named counterparty to a list of points the firm then applies to the real matter itself.

When anonymising is not the right tool

Some tasks only work with the real matter: reviewing a full contract, summarising an entire file, drafting the actual letter. Stripping these down until nothing is recognisable usually also strips out what the task needs.

Then the question is no longer how to write the prompt, but which tool, under which agreement and which settings, may see the matter at all. That is the decision chain in the hub piece. If the tool reaches your files directly, see how to connect AI to your law firm software through an interface.

A short checklist

1. Write the question in one sentence, without facts.
2. Remove names, numbers, addresses and references.
3. Replace people and companies with roles, and keep any mapping inside the firm.
4. Generalise dates, places, amounts, industries and unusual events.
5. Delete every fact the answer does not depend on.
6. Read the prompt as the counterparty, a competitor or a journalist would.
7. Paste clean text, not files.
8. Apply the answer to the real matter inside the firm.

FAQ

Does an anonymised prompt make using a chat-based AI tool allowed? No method makes a use allowed on its own. Removing client and matter details reduces what leaves the firm and makes the decision easier to explain. Whether a specific use meets professional rules is for counsel to assess. Not legal advice.

Is replacing names with codes enough? Codes help, but on their own they leave dates, places, amounts and events that can still identify the matter. Generalise the context as well, and keep any mapping inside the firm.

Can software remove the details automatically? Automatic redaction can find many direct identifiers such as names and numbers. The context that makes a matter recognisable is harder to catch automatically. Treat it as a first pass and keep the outsider reading in step 6 with a person.

How we build this at AETOP

We build agents on Spectacle on the same principle: a model gets only the objects a task needs, arithmetic runs in code while the model handles language, every request is logged, and a person releases before anything changes. A model rarely needs to know whose matter it is to do its part of the work. The aim is time back for the people who still do this coordination by hand, without taking the decision away from them. Approval-gated actions are on our roadmap and not bookable yet; we will not describe them as live before they are. If you want to talk through your own setup, see Spectacle.

Not legal advice. This article describes operational practice and does not replace review by counsel.