Law Firm AI Usage: How to Audit What Your Fee Earners Really Use

Run a five-question staff survey, then compare it with browser extensions, app sign-ins and billing records the firm can lawfully see. Anything missing from the approved list goes into one of four buckets: approve, approve with limits, replace or stop. Do it openly, ask about AI features inside normal software as well as chatbots, and repeat every six months.

Fee earners rarely hide AI use out of bad faith. They have a deadline, a free tool works, and nobody told them not to. The audit exists to replace guessing with a list: what is in use, what client information goes into it, and what the firm will approve instead.

Follow me on Instagram@sagnikteaches

Set the ground rules before asking anyone anything

An audit that feels like an investigation gets tidy, incomplete answers. Three decisions set the tone.

Connect on LinkedInSagnik Bhattacharya

• State the purpose in writing. One short message from a partner: the firm is building an approved list of AI tools, nobody will be disciplined for what they report during the audit window, and unreported use found later is a different conversation.
• Name the person who sees the results. Usually the supervising partner or compliance lead. Everyone else sees only the summary.
• Decide what you will and will not look at. Firm-paid subscriptions, managed browsers and company sign-ins are fair game and the firm owns that data. Personal phones and personal accounts are not, and reading private browsing without telling staff is a bad idea. If you plan anything beyond the firm's own systems, take employment and data-protection advice first.

The regulatory backdrop makes the audit worth doing. The AI warning notice one solicitors' regulator published on 17 August 2026 says the use of AI "does not diminish or transfer your professional responsibilities", expects firms to have governance, systems and controls to manage AI risks and to supervise work effectively, and warns that client material put into public AI tools is likely to breach confidentiality. You cannot supervise what you cannot see. For the pre-use questions to ask of any tool you find, see what solicitors should check before using AI.

Subscribe on YouTube@sagnikteaches

The survey: five questions and why each one is there

Keep it to five questions and five minutes, anonymous if the firm is large enough that anonymity means something, named if the firm has four fee earners and everybody knows everybody. In a tiny firm, a pretend-anonymous survey fools nobody, so say honestly that answers are not anonymous.

1. Which of these have you used for work in the last three months? Give a tick list: ChatGPT, Claude, Gemini, Microsoft Copilot, Grammarly, a note-taker such as a meeting transcription tool, an AI feature in your PDF reader, a legal research tool with AI, other (please say). Listing names prompts memory.
2. What did you use it for? Free text. Answers like "tidy emails" and "summarise a bundle" tell you the risk level quickly.
3. Did anything identifying a client or matter go in? Options: never, anonymised, yes, not sure. "Not sure" is a valuable answer, because it tells you where training is needed.
4. Which account did you use? Firm account, personal account, free account without signing in, don't know. This predicts whether data is retained or used for training, which differs by plan and supplier terms.
5. What would you want to use it for if it were allowed? This turns the audit into a service. It also reveals the unmet need that drove the unofficial use.

Add one sentence at the top: "AI features inside tools you already use count, such as writing assistance in your word processor, email or PDF reader." Without it, many people answer "none" because they think only of chatbots.

A filled-in response, and how to read it

An illustrative answer from one associate in a four fee-earner firm: used ChatGPT and a PDF reader's AI summary; for summarising long email chains and checking tone on client letters; client names sometimes went in, "I removed the address"; personal account; would like it for first drafts of attendance notes. Reading it: client names in a personal account is the headline risk; the use itself is sensible; the want is an approved tool for attendance notes. That is three actions from one form: guidance on anonymising, a decision on the PDF reader's AI feature, and a pilot candidate. Our guide to using ChatGPT without breaching confidentiality covers what to say about the first.

Checks the firm can run on its own systems

The survey tells you what people choose to say. The checks below show what the firm's own systems can see. Run them after the survey, so people have had a chance to be honest first.

Subscriptions and billing

Ask whoever pays the bills to list every recurring charge on firm cards and expense claims for the last twelve months, then mark any that are AI-related. Search for obvious names and for small monthly amounts in a software category. A fee earner paying $20 a month for a chatbot plan (the ChatGPT Plus list price when checked in November 2026) on a firm card, or claiming it back as an expense, means the firm is paying for a tool it has never assessed.

Accounts and sign-ins

If the firm uses Microsoft 365 or Google Workspace, the admin console can list third-party apps that staff have connected using their firm sign-in. In the Microsoft Entra admin center the path is Entra ID, then Enterprise apps, then All applications; open any app and its Permissions page has a User consent tab showing what individual staff granted with their own sign-in. In the Google Admin console it is Security, then Access and data control, then API controls, then Manage App Access, which lists configured and accessed apps with the access each one requests. Look for apps with names you do not recognise, and for apps with permission to read mail or files. Menu names change, so if a path has moved, search the vendor's admin help for the same words. If you cannot see this yourself, your IT provider can pull it quickly.

One detail from Microsoft's documentation is worth knowing before you act on the list: revoking a permission does not stop the same person consenting again the next day. If the audit finds several AI apps added this way, ask your IT provider whether user consent should be restricted, so that new connections need an administrator's approval, and route those requests to the supervising partner.

Browser extensions and desktop apps

On firm-managed browsers, the administrator can see the extension list, but often only after reporting is switched on: in Chrome's enterprise tools, managed browser reporting has to be enabled before each browser uploads its extensions with their version, install type and permissions. Ask your IT provider whether it is on. AI writing helpers, summarisers and meeting recorders are common extensions, and many request access to every page the user visits, including the practice management system. Check each one's permissions as well as its name. A desktop installation list on firm laptops can show note-takers and transcription programs.

Meeting tools and plug-ins

Look at calendar invitations for uninvited note-taking bots joining client calls, and at the video-meeting platform's settings for recording and transcription. An AI note-taker that joins a call with a client has captured privileged content, and may have sent it to a third-party service. Ask in the survey too, but also look at the calls.

Sampling the matter files for AI use that went unrecorded

Surveys and system checks show tools. They do not show what ended up in client work. Pick a sample of recent matters, say five per fee earner across the last three months, and look for signs of AI involvement that nobody mentioned. You are not hunting for wrongdoing, only for the gap between what people say and what the files show.

• Style tells. Letters with an unusually even tone, generic opening lines or sign-offs that do not match the fee earner's habits. These are only hints and prove nothing, so ask the author casually.
• Citations. Any case reference or quotation in a document: confirm it exists and says what is claimed. Invented or misdescribed authorities are the failure the profession already knows about; our checking routine for invented case law covers how.
• Time entries. A matter where an hour of drafting was recorded for a document that took ten minutes, or a long document with no drafting time at all. Be careful: this is a prompt for a conversation, not a conclusion.
• Metadata. Document properties and tracked changes sometimes show which application produced a file, though they are easy to alter and often blank.

Treat five suspicious letters out of sixty as five invitations for a friendly question: "Did you use anything to help draft this? That is fine, I'd like to know what you used." The answer often names a tool that nobody had listed.

What to ask your IT provider, ready to send

Many small firms have an outside IT provider and nobody in the firm knows what to ask for. This request is specific enough to be answered in one reply. Adapt the names for your systems:

Hello [name],

We are reviewing which AI tools are connected to our firm accounts. Please send, by [date]:

1. The list of third-party apps that users have connected to our Microsoft 365 / Google
   Workspace sign-ins, with the permissions each has (especially read access to mail or files).
2. The list of browser extensions installed on firm-managed browsers, by user.
3. Any note-taking, transcription or meeting-recorder apps installed on firm laptops.
4. Whether our meeting platform allows outside note-taking bots to join calls, and the
   current setting for recording and transcription.
5. Any AI features switched on by default in our email, word processing and PDF tools.

A spreadsheet is fine. We are not looking for names to discipline; we are building an
approved list.

Thanks,
[your name]

Item 5 surprises people. Many productivity suites and document tools add AI features by default or through an opt-in banner that a staff member can accept alone. Knowing what is on, and who can turn it on, is half the audit.

A tool card: what to record for each discovery

For every tool that makes it onto your list, keep a short record. A filled-in, illustrative example for a meeting note-taker found in the audit:

Where the entry says "not yet read", that is an honest and useful state; it means the action is to read the terms, not to guess. If a supplier will not tell you whether it uses data for training, that tells you something too.

Sort what you find into four buckets

Each tool and use goes into exactly one bucket, and each bucket has an action and a date. Resist the urge to leave anything "to discuss".

An illustrative sort for a four fee-earner firm: a chatbot on personal accounts for tidying emails goes to approve with limits (firm account only, no client names); a meeting note-taker that joined three client calls goes to stop until it can be assessed; an AI summary feature in the PDF reader goes to approve once the vendor's data terms are read; a free grammar checker used on client letters goes to replace with the firm's licensed equivalent.

Before moving a tool to approved, put it through the questions in what to check in an AI tool's privacy policy and terms: does it retain prompts, does it train on them, where is data processed, and who can see it. Record the answers next to the entry, with the date you checked.

The approved-tool list: one page, kept current

The output of the audit is a single page every fee earner can find. An illustrative extract:

APPROVED AI TOOLS (reviewed [date], next review [date])

Tool: [chatbot on firm business plan]
  Allowed: drafting routine letters, summarising documents the user already holds,
           tidying internal emails.
  Not allowed: pasting client names, matter numbers or privileged advice unless the
           matter partner agrees.
  Account: firm sign-in only.
  Owner: [partner name]

Tool: [PDF reader AI summary]
  Allowed: first-pass summary of non-confidential documents.
  Not allowed: bundles containing client special-category data.
  Account: firm licence only.

Request a new tool: email [supervising partner]; decision within five working days.

The last line matters more than it looks. If requesting a tool is slow or unwelcome, people go back to using what they like without asking. A five-working-day answer, even a no, keeps the list honest. Keep each Allowed line to tasks, not tools: "summarising documents the user already holds" can be checked, while "general use" cannot.

A worked example: a law firm with four fee earners, one week

Illustratively, the firm has four fee earners, a practice manager and a paralegal. The supervising partner sets aside a week and about eight hours.

• Monday (1 hour): The partner sends the purpose message and the five-question survey to all six staff, asking for answers by Wednesday.
• Tuesday (1 hour): The practice manager lists twelve months of recurring software charges and expense claims. Two AI-related items appear: a $20 monthly chatbot plan claimed by one associate, and a $10 monthly transcription service on a firm card.
• Wednesday (1.5 hours): Five of six surveys are back. Four people have used a chatbot; three used a personal account; two admit client names went in sometimes; one reports an AI feature in the PDF reader nobody knew was switched on.
• Thursday (2 hours): The IT provider sends the list of connected third-party apps and browser extensions: seven connected apps, of which two are AI-related, and one browser extension with permission to read all pages visited. The partner also spots a meeting bot in the calendar of a client call.
• Friday (2.5 hours): A 45-minute meeting sorts everything into the four buckets. The partner drafts the one-page list, books a 30-minute briefing for the following Monday and diarises the next review for six months out.

Result: six tools found where the partner had assumed two, a clear list of what is allowed and a named person for new requests. Figures are illustrative; the pattern is the point: survey first, systems second, decide in one sitting.

Reporting the findings to the other partners in one page

Partners will not read a twelve-page audit, so give them one page with four headings: what we looked at, what we found, what we decided and what we need from them. An illustrative findings paragraph for a four fee-earner firm: "Six staff surveyed, six replied. Four use a chatbot, three of them on personal accounts, and two have entered client names. Billing review found two AI subscriptions on firm cards. A meeting bot joined one client call. We have approved two tools with limits, stopped one, and will pilot a firm-licensed note-taker next month. We ask partners to agree the one-page list and to appoint [name] to decide new requests within five working days."

Include the number of staff who said they would use an approved tool if offered, because that is the figure that justifies the licence spend. Then put the next audit date in the partners' diary before the meeting ends; an audit with no second date quietly becomes a one-off.

Realistic ways an audit misleads you

• The silent survey. Everyone answers "none". Fix: add the line about features inside normal software, and cross-check with billing and app records.
• Only checking the obvious names. A search for "ChatGPT" misses a dozen smaller tools. Fix: search billing and extension lists by function (transcription, summarise, writing assistant), not only by brand.
• Treating the list as permanent. New AI features arrive inside existing software monthly. Fix: a six-monthly re-run of the survey and the app review, and a standing item at partners' meetings.
• Confusing tool with use. The same chatbot is fine for tidying a diary note and wrong for pasting a client's medical history. Fix: the list approves tasks, not just products.
• A policy nobody has heard. Fix: a 30-minute briefing and a one-line reminder in the monthly team meeting. If you are planning that rollout, our four-week training plan for a new AI program shows how.

If something serious turns up, such as client documents sitting in a free account, handle it the same day: stop the use, record what was entered and where, and take advice on whether the client or the regulator needs to be told. Do not wait for the next partners' meeting. And if you would like a second pair of eyes on how to set the audit up in your firm, that is part of an AI implementation consultation; you can get in touch here. For the free-tools problem in particular, stopping staff pasting client data into free tools goes into the next step.

Questions partners ask before auditing AI use

Should the audit be announced to staff?

Yes. Tell the team what you are reviewing, why and that the aim is an approved list, not discipline. Checking browser or billing records without telling people damages trust and may raise employment and data-protection issues. Take advice if you plan anything beyond looking at firm-paid subscriptions and managed accounts.

How long does an audit take for a small firm?

For a firm of four to ten fee earners, about a week of elapsed time and roughly six to ten hours of work: a day to design the survey, three days for responses, a day for the browser and billing review and a final session to set the approved list.

What if the survey says nobody uses AI?

Treat that with caution. Staff may be unsure what counts, or afraid to say. AI is built into word processors, email, note-takers and PDF tools, so ask about features as well as products. Then compare the survey with the billing and account records.

Is a blanket ban a sensible result?

Rarely. A ban tends to push use onto personal phones and free accounts, where the firm sees nothing. Most firms do better with a short approved list, clear rules on client data and an easy way to ask for a new tool to be added.

Further reads

• AI Readiness Checklist for Accountants, Solicitors, Consultants — Check the wider firm is ready for approved AI use.
• Does a Five-Person Business Really Need an AI Policy? — Whether the findings justify a written policy.
• AI Acceptable Use Policy for a Small Professional Firm — A policy template to adapt after the audit.
• AI App for Lawyers: Score Accuracy, Privacy and Cost in a Short Trial — Trial a replacement tool before approving it.
• ChatGPT or a Legal AI Tool: Which Should a Small Firm Use? — Decide what the approved replacement should be.
• Who in Your Team Actually Needs a Paid AI Licence? — Work out who needs a firm licence.
• How to Write an AI Usage Policy for Your Small Business — Fit the one-page approved list inside a short policy.
• ChatGPT for Solicitors: Five Safe Tasks and Three to Avoid — Decide what goes in the Allowed lines.
• E-Discovery Software for Small Law Firms: Costs, Limits and AI Review — Six e-discovery pricing models, one matter costed from your own data, and a sampling test for AI review, written for a firm with a handful of lawyers.
• AI Software for Solicitors: Data, Supervision and Supplier Checks — A buying checklist for small law firms: where client data goes, what the contract must say, who checks AI output and which supplier answers to chase.
• AI for Personal Injury Lawyers: Seven Jobs to Hand Over First — Seven injury-matter workflows with sample outputs, review gates and a clear boundary around legal judgement and confidential records.
• AI Tools and AI Development: The Complete 2026 Guide — the AI hub, including every tutorial in the AI-for-business series.

Sources: SRA warning notice Misuse of AI (published 17 August 2026); Microsoft Entra documentation on viewing enterprise apps and reviewing app permissions; Google Workspace Admin Help on controlling which apps access Workspace data; Chrome Enterprise Help on browser reporting; ChatGPT pricing page; all checked November 2026.