Legal AI for In-House Counsel in the Philippines: A Practical Guide

In-house legal teams in the Philippines can use legal AI to draft and review contracts, summarize statutes and issuances, track regulatory deadlines, and manage compliance workflows. The technology is a tool, not a substitute for legal judgment. The main legal constraint is the Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules and Regulations, which govern how personal data may be collected and processed. Before feeding any document into an AI tool, the team must confirm that the processing has a lawful basis and that appropriate security measures are in place.

What legal AI can do for an in-house team

Legal AI refers to software that uses automation, machine learning, or language models to perform legal tasks. For a Philippine in-house legal team, common uses include:

• Reviewing and comparing contracts against a playbook.
• Summarizing long statutes, rules, and issuances.
• Drafting first-pass templates for routine agreements.
• Tracking compliance obligations and renewal dates.

These tools reduce time spent on repetitive work. They do not remove the need for a lawyer to verify the output. A draft produced by AI must still be reviewed against Philippine law and the company's own policies.

The data privacy rules that apply

Any AI tool that processes personal data falls within the scope of the Data Privacy Act of 2012 and its IRR. Section 3 of the IRR defines key terms for purposes of the Rules, including "personal information" and "processing." Under that definition, processing covers collection, recording, storage, retrieval, consultation, use, and destruction of data, and may be performed through automated means or manually where the data is contained or intended to be contained in a filing system.

Section 4 of the IRR states that the Act and the Rules apply to the processing of personal data by any natural and juridical person in the government or private sector, including entities established in the Philippines or processing data about Philippine citizens or residents.

Section 17 of the IRR requires adherence to the principles of transparency, legitimate purpose, and proportionality. Section 18 explains that the data subject must be aware of the nature, purpose, and extent of the processing, and that personal data must be adequate, relevant, suitable, necessary, and not excessive in relation to a declared purpose.

For an in-house team, this means the company must be able to explain why personal data is being placed into an AI tool, what the tool does with it, and how the data is protected.

Lawful processing and consent

Section 21 of the IRR lists the conditions for lawful processing of personal information. Processing is allowed if any of the following applies:

• The data subject gave consent prior to collection.
• Processing is needed to fulfill a contract with the data subject.
• Processing is necessary for compliance with a legal obligation.
• Processing is necessary to protect vitally important interests of the data subject.
• Processing is necessary to respond to a national emergency or public order and safety requirements.
• Processing is necessary for the fulfillment of a constitutional or statutory mandate of a public authority.
• Processing is necessary to pursue the legitimate interests of the personal information controller, subject to the rights of the data subject.

Consent, where used, must be freely given, specific, and informed, and may be withdrawn. Section 19 of the IRR adds that consent must be time-bound in relation to the declared purpose.

Sensitive personal information and privileged information

Section 22 of the IRR provides that the processing of sensitive personal information and privileged information is prohibited, except in specified cases. Sensitive personal information, as defined in Section 3 of the IRR, includes data about race, ethnic origin, marital status, age, color, religious or political affiliations, health, education, genetic or sexual life, and government-issued identifiers such as social security numbers and tax returns.

In-house teams handling employment records, health data, or government-issued numbers should treat these categories with extra care. Feeding such data into an AI tool without a clear lawful basis and adequate safeguards creates compliance risk.

Outsourcing, subcontracting, and accountability

Section 43 of the IRR addresses subcontracting of personal data, and Section 44 covers agreements for outsourcing. Section 45 sets out the duty of a personal information processor. When a company engages a third-party AI provider, the provider may be a personal information processor. The agreement should establish adequate safeguards for data privacy and security.

Section 50 of the IRR provides for accountability for transfer of personal information, and Section 51 covers accountability for violations of the Act and the Rules. The company remains accountable even when processing is delegated.

Security measures

Section 25 of the IRR requires data privacy and security measures. Sections 26, 27, and 28 address organizational, physical, and technical security. Section 29 requires an appropriate level of security.

In practice, an in-house team should confirm that the AI tool encrypts data, restricts access, and does not use company data to train models without authorization. Section 38 of the IRR covers data breach notification, and Section 39 sets out the contents of the notification.

Frequently asked questions

Is it legal to use AI tools for legal work in the Philippines? Yes, provided the processing of any personal data complies with the Data Privacy Act of 2012 and its IRR. The law regulates how data is processed, not the use of AI itself.

Can an in-house lawyer put client contracts into an AI tool? Only if there is a lawful basis under Section 21 of the IRR and adequate security measures are in place. Contracts with personal data, and especially sensitive personal information under Section 22, require closer review.

Who is liable if an AI vendor mishandles personal data? Under Sections 50 and 51 of the IRR, accountability rests with the personal information controller. The company remains responsible for ensuring the processor complies with the Act and the Rules.

Practical takeaways

• Confirm the lawful basis under Section 21 of the IRR before processing personal data through any AI tool.
• Treat sensitive personal information under Section 22 of the IRR with heightened caution.
• Put a written agreement in place with any AI vendor, consistent with Sections 43 to 45 of the IRR.
• Maintain organizational, physical, and technical security measures under Sections 26 to 28 of the IRR.
• Keep a human lawyer in the loop to verify all AI-generated output against Philippine law.

Primary sources

The rules discussed above are drawn from the following primary sources, as published in the Official Gazette and the national statute book.

• NPC IRR OF REPUBLIC ACT NO. 10173, August 24, 2016

• REPUBLIC ACT NO. 11232 - AN ACT PROVIDING FOR THE REVISED CORPORATION CODE OF THE PHILIPPINES

This article is general information and not legal advice. For your specific situation, consult a lawyer or ask ASG Legal AI.