AI Compliance for Solicitors
2026 Risk Assessment

1. AI Use Policy in place and aligned with SRA guidance Your firm has a written policy covering which AI tools are approved, who may use them, and how outputs must be handled — consistent with the SRA's updated 2024 position on AI in legal services.

2. Client confidentiality risk assessed for each AI tool used Before any AI tool processes matter data, your firm has assessed whether doing so is consistent with your duty of confidentiality under SRA Code of Conduct paragraph 6.3.

3. Legal privilege risk understood for AI drafting tools Inputting privileged matter content into third-party AI systems may waive privilege. Your fee earners understand this risk and have guidance on what can and cannot be input.

4. Clients informed of AI use where material to their matter Where AI has materially assisted in drafting advice, documents, or correspondence, clients have been informed. This is increasingly expected as a matter of transparency under SRA guidance.

5. Data Processing Agreements signed with all AI vendors UK GDPR Article 28 requires a DPA with any processor handling personal data. Client matter data processed by AI tools triggers this obligation. No exceptions for "small amounts" of data.

6. Consumer-grade AI tools prohibited for client matter work Fee earners are explicitly prohibited from using free/consumer tiers of ChatGPT, Claude, or similar tools for any work containing client identity or matter information.

7. A qualified solicitor reviews and takes responsibility for all AI-generated legal content No AI-assisted advice, court document, or correspondence leaves the firm without review and sign-off by a qualified solicitor who takes professional responsibility for its accuracy.

8. File retention obligations reviewed to cover AI-generated documents Your file retention schedule is clear on whether AI-generated drafts, prompts, and outputs form part of the client file — and how long they must be retained versus deleted.

9. Conflicts check extended to AI tool providers You have considered whether the AI tools your firm uses also serve opposing parties in your matters — a developing risk as enterprise AI vendors work with law firms on both sides of disputes.

10. Annual AI compliance review scheduled A calendar date exists to review AI tools, update your policy, and re-assess risk. The SRA has signalled it will revisit its AI guidance regularly — your firm must keep pace.

All High Risk Medium Risk Lower Risk

Tool	Risk Level	Key Concern	Minimum Requirement
ChatGPT (free/Plus) for drafting	HIGH	Inputting client or matter information risks both a confidentiality breach and potential privilege waiver. No DPA for free/Plus tiers.	Prohibit use with any client or matter data. Enterprise tier only with signed DPA if required for generic drafting.
Grammarly (on privileged content)	HIGH	Pasting privileged legal advice or client correspondence into Grammarly sends that content to third-party servers — a potential privilege waiver and confidentiality breach.	Prohibit use on privileged content. Business plan DPA available for non-privileged drafts only.
Microsoft Copilot for M365	MEDIUM	DPA via M365 agreement, but Copilot can access and summarise all documents in your tenant — including privileged files. Scope controls must be configured correctly.	Audit which files Copilot can access. Configure sensitivity labels on privileged documents. Verify EU data residency.
Harvey AI (legal-specific)	MEDIUM	Purpose-built for legal work with DPA available. Still processes matter content on external servers — privilege considerations apply. Review DPA carefully for data retention terms.	Sign DPA before use. Review data retention and deletion provisions. Document in your data register.
Clio AI features	MEDIUM	Legal practice management with DPA available. AI features process matter data including client details and billing. Review each AI feature's data handling separately.	Confirm Clio DPA covers AI features. Review data residency. Update your data register.
Kira Systems (contract review)	LOWER	Enterprise-grade contract AI with strong data controls. DPA available, data residency options. Privilege risk is lower as it reviews rather than drafts.	Review DPA. Confirm data residency. Document in your processing register. Client consent or DPA still required for their contract data.
Luminance (legal AI platform)	LOWER	UK-founded, purpose-built for law firms. Strong DPA, data residency options, and established audit trail. Lower baseline risk, but privilege considerations still apply.	Standard enterprise due diligence — sign DPA, confirm data location, document in register.

[Firm Name] AI Use Policy — Effective [Date]

[Firm Name] operates an AI Use Policy consistent with SRA guidance on AI in legal services (2024) and our obligations under UK GDPR.

APPROVED TOOLS: Only the following AI tools may be used in connection with client matters: [list approved tools]. Any other AI tool requires written approval from the COLP before use on client work.

CONFIDENTIALITY: No client identity, matter reference, privileged content, or personal data relating to a client may be entered into any AI tool that does not have a signed Data Processing Agreement with this firm. Consumer-grade AI tools (free/Plus tiers of ChatGPT, Claude, Gemini, etc.) are prohibited for all client-related work.

PRIVILEGE: Fee earners must not input content that is subject to legal professional privilege into third-party AI tools without explicit written guidance from the COLP confirming that doing so does not risk waiver.

DISCLOSURE: Where AI has materially assisted in preparing advice, a document, or correspondence for a client, the fee earner must inform their supervising solicitor, who will determine whether client disclosure is appropriate.

VERIFICATION: All AI-generated or AI-assisted content must be reviewed, verified for accuracy, and approved by a qualified solicitor before it is sent to a client, filed with a court, or submitted to any third party.

BREACH: Any suspected breach — including accidental input of privileged content into an unapproved tool — must be reported to the COLP immediately. Breach may trigger ICO and/or SRA notification obligations.

Policy reviewed: [Date] | Next review: [Date + 12 months] | COLP: [Name]

Copy

Not sure where your firm stands?

Get a free AI compliance assessment. We'll review your tool stack, identify your highest-risk exposures, and tell you exactly what to fix — at no cost.

Claim Your Free Assessment →

Thanks — we'll be in touch within one business day.

No spam. We'll contact you once. Unsubscribe any time.