AI in law firms: what the SRA's warning means for your firm

AI is changing how work is carried out across the legal sector, with firms exploring its potential in areas ranging from research and drafting to document review and everyday administration. As the technology continues to develop, it presents significant opportunities to work differently and consider where it could add value for firms and their clients.

With that opportunity comes a need to understand how AI can be used responsibly. The Solicitors Regulation Authority (SRA) has brought this into sharper focus with a warning notice published on 17 August, highlighting concerns around inaccurate or fabricated AI-generated information making its way into legal work and the potential risks to client confidentiality. Whilst the SRA is not warning firms away from AI, there is a clear focus on using AI responsibly, with appropriate governance, professional judgement and human oversight.

Here, we look at the key issues raised by the SRA, some of the practical questions firms should be asking and how LawNet is working with members as the use of AI across the legal sector develops.

Accountability doesn't disappear when AI is involved

One of the clearest messages from the SRA's warning is that responsibility for legal work remains with the people and firms delivering it. As the regulator puts it, AI has "no separate legal personality", which means solicitors and regulated individuals remain accountable for their work and its outputs, regardless of how that work was prepared.

The SRA has highlighted instances of AI-generated 'hallucinations' appearing in legal work and court submissions, including fictitious cases or references, and assertions which appear credible despite having no factual basis. The SRA is already seeing this issue in practice, receiving reports of potential breaches from senior members of the judiciary, as well as solicitors self-reporting after relying on AI-generated content that proved inaccurate or misleading.

The consequences can extend well beyond an individual piece of work, with inaccurate information potentially causing harm to clients or affecting the work of the courts. The SRA is clear that relying on AI is no defence for putting false citations before the court, with potential consequences including wasted costs, regulatory referral and, in some circumstances, contempt of court. Incidents of this kind can also have a wider impact on public trust and confidence in the profession.

There are additional considerations for anyone supervising others, as the SRA makes clear that supervisors may themselves breach regulatory and professional requirements where false citations reach the court without adequate review or supervision. Firms must have effective governance, systems and controls in place, with effective oversight that reflects how AI is actually being used across the firm, and helps everyone understand where its risks and limitations lie.

Client confidentiality needs equal attention

Client confidentiality is the other major area highlighted by the SRA and, with AI tools now readily available to people throughout a firm, it's easy to see why this is attracting greater scrutiny. Entering information into an AI system can take a matter of seconds, but what happens to that information afterwards can be much less obvious.

What does happen to that information will depend on the tool being used which is why firms need to understand how client data will be handled before it is shared. The SRA says client information should only be entered where appropriate contractual, technical and organisational safeguards are in place. That includes understanding each tool’s security, third party access, use of data for model training and data retention.

Firms shouldn’t assume that paying for an AI tool automatically removes these concerns, as the SRA specifically warns that confidentiality risks can exist with both free and paid-for systems. Inappropriate use may also risk permanently waiving a client’s legal professional privilege. Firms therefore need to understand the protections that apply to each tool before deciding how it can appropriately be used.

Questions law firms should be asking now about AI usage

Every firm's approach to AI will look slightly different, reflecting the SRA's outcomes-focused approach and the flexibility firms have over how they meet the required standards. What matters is that those choices are considered carefully, and there are some useful questions firms can ask themselves when reviewing their current approach:

• What are you trying to achieve through your use of AI? Be clear where it could genuinely improve client service, productivity or the way people work.
• Do you know how AI is currently being used across your firm? This may extend beyond centrally approved systems to freely available tools individual colleagues can access themselves.
• Do you have clear governance and an AI policy? This should cover ownership, approved tools, training, supervision and review. People need practical guidance about what they can and cannot use AI for, rather than being expected to interpret the risks for themselves.
• Which tools are approved and why? Firms should understand the contractual, technical and organisational safeguards surrounding the systems they allow people to use.
• What information can be shared with AI systems? Guidance around client information, personal data, commercially sensitive information and privilege needs to be clear.
• How are AI-generated outputs checked? AI can support professional work, while professional judgement and appropriate verification remain essential. Firms need processes for checking legal authorities, citations and factual assertions.
• Are supervision arrangements keeping pace? Supervisors need to understand how AI is being used by the people whose work they oversee and what effective review looks like in that context.
• Do your people have the right training? Responsible adoption reaches beyond the technology itself. Everyone using AI needs to understand its potential, risks and limitations, alongside their professional and regulatory responsibilities.
• Who owns AI risk within the firm? Clear governance and accountability can assist firms to respond consistently as tools and working practices continue to develop.
• Can you evidence your decisions? Record how tools have been assessed, the safeguards in place and why particular uses have been approved.

Having an AI policy can provide an important foundation, but its real value comes from how well people understand and apply it in practice. As the technology becomes part of everyday working life, thinking about AI risk also needs to become part of the decisions people make about how they work and the information they handle.

Leadership, training and culture matter too. People need confidence to explore new technology, ask questions and challenge outputs when something does not look right. Good governance should support responsible use, rather than simply constrain it.

The value of sharing experience

One of the challenges with AI is the pace at which both the technology and firms' understanding of it are developing. Approaches that seemed appropriate a year ago may already need revisiting, which makes the ability to learn from the experience of others particularly valuable.

Across LawNet, AI and the issues surrounding its use have been regular themes within our peer communities over the last few years. Members of our Risk & Compliance, People Management, Leadership & Strategy, and Technology & Innovation groups have been able to explore the subject from different perspectives, sharing experiences and practical learning as they consider the opportunities and challenges within their own firms.

Those groups provide a trusted space where people can ask questions openly and test their thinking with peers, while hearing how other firms are approaching similar issues. At a time when there is unlikely to be a single answer to many of the questions firms are facing around AI, that shared experience can enable members to make more informed decisions about the approach that is right for their firm.

We have also been exploring the practical application of AI with members, beginning with a webinar on the Claude for Legal plugin, followed by the formation of the LawNet AI Working Group. Through the group, firms are now trialling the plugin and testing different use cases to understand where the technology could add value and the considerations around its use.

The risk and compliance implications have also formed part of the conversation. At our risk event in June, members discussed AI with insurers and other experts, exploring the some of the broader issues firms need to consider as use of the technology develops.

The SRA's warning also reinforces the value of the principles that sit behind our LawNet Quality Standard. Its emphasis on governance, competence and supervision closely reflects the approach the Standard seeks to embed. Strong processes and procedures need to be supported by a culture where risk management and business improvement forms part of everyday thinking across the firm. With AI tools increasingly accessible to colleagues across different roles and levels of seniority, that culture becomes particularly important.

A profession in transition

Helen Hamilton-Shaw, Chief Executive at LawNet, said:

"AI is already changing the way legal services are delivered, and we're still at a relatively early stage of understanding what its longer-term impact will be. The roles people perform within firms will evolve as the technology develops, and someone starting their legal career today could follow a very different path to those who joined the profession before them.

"For law firms, there is a real opportunity to think differently about how they work and where their people can add the greatest value. The firms that benefit most will be those that think carefully about how technology, people, client experience and their business model work together. The challenge is that those decisions are being made in a rapidly evolving environment, often without an established blueprint to follow.

“That's when the value of being part of LawNet really comes to the fore. Our members can draw on the experiences and perspectives of firms facing many of the same decisions, using that insight to inform the approach that's right for them. There will be times when firms reach different conclusions, and that is part of the value of the network. Having a trusted environment where different views can be shared openly helps members challenge their thinking and make better informed decisions for their own firm.”

"None of us can say with certainty what the legal profession will look like in five or ten years' time, but we do know that AI will continue to influence it. Our role is to help members understand what is changing, test ideas responsibly and learn from one another, giving them access to the people and insight that can support them in making informed decisions for their firm. That shared learning is Further Together in practice."

We will continue to work closely with member firms as they explore the opportunities and challenges presented by AI, sharing learning from across the network and bringing in wider expertise to assist firms in developing their approach.

If you’d like to find out more about the work we’re doing around AI, or how LawNet membership could support your firm, please get in touch with the LawNet team.

You can read the SRA's warning notice on the misuse of artificial intelligence on the SRA website.