Nearly every lawyer uses AI. Half worry about what it leaks.
Research, summarising, drafting and review are now routine. So are invented case citations and client papers pasted into public tools. The Solicitors Regulation Authority (SRA) has put firms on notice.
of UK lawyers use AI; one in three daily
LexisNexis, 2026, vendor surveyworry about invented content, up 26 points since early 2024
LexisNexis, 2026, vendor surveyreports to the SRA of possible AI misuse in the year to July 2026
SRA warning notice of 17 August 2026, as reported by commentatorsResponsibility stays with the solicitor and the firm.
The SRA's warning notice, 'Misuse of AI' (17 August 2026), says using AI does not reduce, remove or transfer a solicitor's responsibilities. Firms must keep governance, supervision and controls. It points to two risks: false or fabricated content, citing the 2025 High Court case of Ayinde v Haringey, and confidential client information entered into tools without proper safeguards, citing an Upper Tribunal decision of 2026. Professional indemnity insurers have long looked at AI through their cyber wording; ask your broker what your insurer now asks at renewal.
Summarised from the SRA notice as reported by law firms and the Law Society press. Read the notice at sra.org.uk before quoting it. The insurer point is not yet verified against a 2026 source. Not legal advice.
Six problems that keep coming back.
Each is named in the SRA's notice or in surveys of the profession.
Fabricated citations have already reached a court. One unchecked paragraph in a skeleton argument can lead to a referral, a costs order and a front-page story.
Documents pasted into a free chatbot may be stored, reused or seen by others. The SRA treats that as a confidentiality risk the firm must prevent.
AI makes first drafts quick and convincing. Partners need to see what was generated, what was checked and by whom, or supervision becomes a signature on trust.
Each practice group buys its own assistant. There is no register, no common rule and no single answer to a client's question about AI use.
Clients and panel managers now ask how you use AI and how you protect their data. A vague answer loses work.
AI helps with client due diligence, but the duty to verify and record stays with the firm, and the record has to survive an inspection.
One bad citation can outweigh a year of efficiency.
The gains from faster research and drafting are real and spread thinly across many matters. The cost of a single failure is concentrated: a disciplinary investigation, loss of a client who learns their documents were in a public tool, or a difficult renewal conversation with your insurer. With 42 reports to the SRA in a single year, the question is not whether a regulator will ask, but whether you can answer.
Banning AI does not stop it. Controlling it does.
Surveys show most lawyers already use AI. A ban pushes use onto personal accounts, where you have no record at all. The workable answer is approved tools on managed accounts, redaction of client details, a rule for what needs a second check, and a record of who accepted each output. That serves the SRA, your insurer and your clients with the same evidence.
- Legal research and case summaries
- Contract review and clause extraction
- Drafting and first-pass review
- Client intake and anti-money-laundering checks
- Client material in personal or public accounts
- Fabricated citations reaching a client or a court
- Partners buying tools per team with no register
GenWA puts managed accounts and redaction in front of the tools fee-earners already use, shows use by practice group, and keeps a log of what was asked and who accepted the result. A shared library of precedents and prompts is being built next, and is not live.
Four agents, trained for this sector.
The rules, as controls.
- SRA Standards and Regulations
- SRA warning notice on misuse of AI (17 August 2026)
- Client confidentiality and legal professional privilege
- Money Laundering Regulations 2017
- UK GDPR and the Data (Use and Access) Act 2025
- Insurer and client panel questionnaires
Built around partnerships, practice groups and the compliance officer.
Law firms decide by partner consensus and carry personal liability. We shape each route to that.
An independent audit by practice group, and a short briefing for the partnership so the decision is made once, with facts.
Start the health checkAdvice: policy and trainingAn AI policy, supervision rules and training that the Compliance Officer for Legal Practice (COLP) can defend to the SRA and to your insurer.
See advisoryProduct: control toolkitManaged accounts, redaction, Guard rules, log and Evidence Packs, hosted in your AWS or Azure account, or GenWA AWS as agreed.
Find the right productProduct: agents at workIntake checks, document classification and invoice processing, each with a named partner or manager as owner.
Meet the teamIncubator: one practice functionWe define, build and run one controlled function, such as intake or disclosure review, in twelve weeks. You own the intellectual property.
See the incubatorAccelerator: for legal technology foundersBy application only, ten places a year. Senior AI leadership time, advisory and platform access, paid for by equity, project, retainer or licence.
See the acceleratorWhat Guard and Evidence typically hold for this sector.
Control-mapped, not certified. We prepare the evidence; regulators, insurers and accredited bodies decide.
The SRA's conduct rules, mapped to supervision, confidentiality and competence controls.
The August 2026 notice, mapped to approved tools, checks on authorities and client-data safeguards.
Your own confidentiality rules and client engagement terms, loaded as rules on what may be shared.
Client due diligence and record-keeping duties, mapped to intake checks.
Data protection and automated-decision safeguards, with redaction evidence.
AI management, information security and baseline cyber standards that clients ask for. Readiness evidence only.
Three role holders, three different problems.
Carries the risk and must answer clients and insurers. GenWA gives one view of AI use by practice group, with a record that shows who checked what.
Must prove supervision and confidentiality controls to the SRA. GenWA enforces rules on connected tools and produces evidence on request.
Pays for the tools and runs the back office. GenWA shows spend by team, replaces duplicate subscriptions and automates intake and invoices under a named owner.
From this sector.
How can a law firm keep client material out of public AI tools?
Use managed accounts with redaction for the tools fee-earners use, a rule on what may be shared, and a log as the record. Usage Insight shows use by practice group. Redaction applies to connected, routed tools, so the audit confirms coverage.
What does the SRA expect on AI?
The SRA's warning notice of 17 August 2026 says AI does not reduce a solicitor's responsibilities and highlights false content and confidentiality risks. Read it at sra.org.uk. GenWA helps you show who used what, with which data and who checked the output. Not legal advice.
Our insurer is asking about AI. What can we show?
Evidence Packs give the register, the controls and the exception log. We prepare the pack and your insurer decides what is sufficient. Ask your broker what your insurer requires, as practice varies.
Can we send client material to a third-party model at all?
Redaction removes personal data before approved external model calls, and hosting is your AWS or Azure account, or GenWA AWS as agreed. Whether any use fits your confidentiality duties is for you and your legal adviser; we make the choice visible and enforceable.
How many UK lawyers use AI?
LexisNexis's 2026 vendor survey found 94% use AI and one in three use it daily, and 83% worry about invented content. Treat it as vendor survey evidence. It shows why managed access matters.
Is there a shared library of precedents and prompts?
A Library is being built next and is not live. Today, Usage Insight and the log show what is used by practice group. We confirm status in writing before you buy.
How does a law firm get started?
Take the AI health check. A usage-export check runs locally in your browser with no AI API calls. First findings arrive within 48 hours and the audit with a 90-day plan within ten working days. The audit fee is credited in full against year one of a platform plan.
Could you tell a client exactly how your firm uses AI?
First findings within 48 hours of the health check. Audit fee credited in full against year one of a platform plan.