AI Policy for Law Firms: A Practical UK Governance Framework
Why you need an AI policy for law firms even if you haven't adopted AI
You need a policy because the risk comes from use, not from purchase. If a fee earner puts client information into a consumer tool, the firm carries the confidentiality and data protection exposure, whether or not the partners signed off on it.
The regulatory hooks already exist. The SRA Code of Conduct for Solicitors says at 6.3 that you keep the affairs of current and former clients confidential. Paragraph 3.2 requires a competent service. Paragraph 3.5 keeps you accountable for work done by people you supervise. None of these mention AI, and none of them need to.
The Code for Firms adds two duties that matter here. Firms must identify, monitor and manage all material risks to the business (2.5), and they must have an effective system for supervising client matters (4.4). An unmanaged chatbot habit across the office is a material risk. So a written policy is simply how you show the SRA that you have a system.
What an AI policy must cover
- ✓
Supervision: supervisors check AI-assisted work the same way they check a trainee’s draft.
- ✓
Client disclosure: decide when you tell clients about AI use, and put it in your client care letter or terms.
- ✓
Training: nobody gets access to an approved tool until they’ve done a short session on the policy.
- ✓
Incidents: if someone puts client data into the wrong tool, they report it the same day to a named person, and that person decides whether it’s a data breach.
AI risk assessment for law firms: a table by use case
The simplest AI risk assessment for law firms rates each use case, not each tool. The same tool can be low risk for one job and high risk for another, depending on the data it touches and who relies on the output.
| Use case | Data involved | Risk | Controls |
|---|---|---|---|
| Marketing copy, internal emails | Public or internal | Low | Approved tool, author reviews |
| Summarising public case law | Public | Low | Check every citation at source |
| First drafts from firm templates | Client data | Medium | Enterprise tool, fee earner review |
| Summarising disclosure bundles | Client data | Medium | Enterprise tool, sampled supervisor check |
| Advice to clients | Client data | High | Partner sign-off, full source check |
| Court submissions | Client data | High | Named reviewer, every authority verified |
Read it left to right. The data column drives most of the rating, and the reliance column (who acts on the output) pushes it up a level. Anything going to a court or to a client as advice sits at high risk, whatever tool produced it.
How to roll out an AI policy, step by step
- 01
Run an anonymous usage survey. Ask every fee earner and support team member which AI tools they use and for what. You’ll get honest answers only if nobody is in trouble.
- 02
List the use cases. Group the answers into jobs, such as drafting, summarising, research and admin.
- 03
Rate each use case with the risk table above.
- 04
Choose approved tools for the low and medium risk jobs. Prefer enterprise versions with a data processing agreement and no training on your inputs.
- 05
Complete a DPIA for any tool that touches personal data.
- 06
Write the one-page policy and a short FAQ for staff.
- 07
Train everyone in a 45-minute session, then grant access.
- 08
Review monthly for the first quarter, then quarterly.
A one-page AI policy skeleton
- ✓
Purpose: why the firm allows AI and what it protects (client confidentiality, quality, trust).
- ✓
Scope: everyone, including partners, consultants and contractors, on any device used for firm work.
- ✓
Approved tools: see the register in Appendix A. Anything not listed is not allowed for client work.
- ✓
Data rules: client and matter data only in tools marked “client data approved”.
- ✓
Review: a named human checks every output before it leaves the firm. Every citation gets checked at source.
- ✓
Disclosure: how and when we tell clients.
- ✓
Training: required before access. Keep a record of who has done it.
- ✓
Incidents: report to the policy owner the same day.
- ✓
Owner and review date: name the partner and set a date.
Worked example: a 30-lawyer firm
Take a 30-lawyer regional firm with 18 support staff, so 48 people in total. This is an illustrative example, and the figures are assumptions for the arithmetic, not client data.
The anonymous survey comes back with 11 distinct use cases. The risk table sorts them into five low, four medium and two high. The firm approves one enterprise AI assistant for low and medium risk work and bans consumer tools for anything involving client data.
Training takes 45 minutes per person. Across 48 people, that’s 36 hours of time in total. The firm licenses 20 seats at an assumed £25 per user per month, which comes to £500 a month, or £6,000 a year.
Supervision is where firms usually get vague, so make it a number. Say the medium-risk jobs produce 60 AI-assisted documents a month. A 10% supervisor sample means six checks a month. At 20 minutes each, that’s two hours of partner time a month to evidence an effective supervision system.
Compare that with one confidentiality breach, and the case for the policy makes itself. For measuring the upside once tools are in use, our guide on how to measure AI ROI sets out a baseline method.
Should law firms use AI at all?
Yes, for defined jobs with clear review rules. AI adoption for law firms works best on structured, repetitive work, and a policy is what makes that work safe to scale.
The honest answer on where AI earns its keep sits in our guide to AI for UK law firms. Often the biggest early win isn’t AI at all. Our legal document automation guide explains why template-based drafting comes first. In one engagement, a 38-lawyer City firm cut standard document production time by 70% after we rationalised six NDA templates into one (read the commercial law firm case study). No generative AI was needed for that result.
Severus works as a business automation and operations partner, so we start with the business problem and pick technology second. Sometimes that means buying a tool. Sometimes it means a business operations audit and fixing the process first, as a 62-lawyer regional practice did when it cut matter opening from 75 minutes to 18 (see the law firm workflow automation case).
Common mistakes with an AI policy for law firms
- ✓
Banning everything. A blanket ban just moves AI use onto personal phones, where you can’t see it.
- ✓
Copying a big-firm template. A 40-page policy written for an international firm won’t get read in a 30-person practice.
- ✓
Approving tools before rating use cases. You end up with a licence and no rules for what goes into it.
- ✓
No named owner. The approved list goes stale and staff stop trusting it.
- ✓
Forgetting barristers and experts. If you instruct counsel, ask how they use AI too. The Bar Council updated its guidance on generative AI for the Bar in November 2025, and it flags hallucination and confidential data as key risks.
Frequently asked questions
Does the SRA require law firms to have an AI policy?
The SRA doesn't require a document called an AI policy. However, the Code for Firms requires you to manage material risks and to run an effective supervision system, and the Code for Solicitors covers confidentiality and competence. A written AI policy is the simplest way to show you meet those duties when staff use AI tools.
Can solicitors put client data into ChatGPT?
Not into a free consumer version. The Law Society advises against putting confidential data into tools where you have no operational relationship with the vendor. Enterprise versions with a data processing agreement, no training on your inputs and a completed DPIA can be acceptable for some client data, if your policy approves them.
What should an AI risk assessment for law firms include?
It should list each use case, the data involved, who relies on the output and the resulting risk level. Then it sets controls for each level, such as enterprise-only tools, supervisor sampling or partner sign-off. Rate use cases rather than tools, because one tool can serve both low and high risk work.
How long does it take to put an AI policy in place?
Most small and mid-sized firms can get from survey to trained staff in four to eight weeks. The policy itself takes a few days to write. The time goes into the usage survey, rating use cases, agreeing approved tools with partners and completing DPIAs for tools that handle personal data.
Who should own AI governance in a law firm?
A named partner should own it, usually the COLP or the partner responsible for risk. They need an operations or IT lead to maintain the tool register and handle vendor terms. If you want outside help with AI readiness and governance, our AI Readiness & Governance service covers exactly this, and our law firms page shows the wider work.
Business problem first. Technology second.
Not sure what your team is already pasting into AI tools? Book a first consultation with Severus