AI Software for Solicitors: Data, Supervision and Supplier Checks

Before buying AI software for solicitors, get written answers on five things: where client data is processed and stored, whether the supplier trains on it or lets staff read it, what the UK GDPR contract terms say, who checks the output before it leaves the firm, and how you get your data back if you leave.

The Solicitors Regulation Authority's warning notice of 17 August 2026 names two concerns: inaccurate AI output reaching a court or a client, and confidential client information going into public tools. This checklist turns both into buying questions, grouped as data, contract, internal access, supervision and supplier, so a small firm can score a product before the first demo.

Follow me on Instagram@sagnikteaches

Map what the tool will touch before any supplier call

Write one line per task you want help with and mark whether client information goes into the prompt. Firms that skip this step end up buying for the demo instead of for the work, then find at the contract stage that the tool they liked cannot be used on the matters they had in mind.

Connect on LinkedInSagnik Bhattacharya

If you already use a practice-management platform with an AI add-on (Clio's assistant, for example, is now called Manage AI), run the same checks. An existing supplier is not the same thing as a supplier cleared for this data, and an add-on can bring its own terms and its own model provider, so read it as if it were a new purchase.

Subscribe on YouTube@sagnikteaches

Where client data goes: location, sub-processors and training

Six questions, each with the document that should answer it. If the answer exists only in an email from a salesperson, treat it as unanswered.

1. Location of storage and of processing. These are two different facts. Microsoft's Copilot documentation says calls to the model go to the closest data centres in the region but can be routed to other regions when capacity is tight, and that customers outside the EU may have queries processed in several regions. Ask for the country for storage, for AI processing and for support access. The answer belongs in the data processing addendum or the supplier's trust page.
2. Sub-processors. These are the companies that touch your data on the supplier's behalf, including whoever supplies the AI model. A product built on someone else's model has at least two suppliers. Ask for the current list with locations and purposes, how much notice you get of a new one, and whether you can object. Microsoft's page shows why this matters: it says models supplied by one third-party provider are currently excluded from its EU data boundary commitment.
3. Training. "We don't train on your data" needs three follow-ups: does it cover files and outputs as well as prompts, does it cover feedback, and is it a default or a setting? Anthropic's privacy centre says it does not train on commercial-product data by default, but may use chats you explicitly submit as feedback or bug reports. A thumbs-up or thumbs-down keeps the whole conversation for up to five years, and Anthropic says it de-links feedback from user and customer IDs before use. Owners of Team and Enterprise plans can switch member feedback off with the "Rate chats" control in the organisation's data and privacy settings. Look for the equivalent switch in whatever you buy.
4. Retention and deletion. Ask how long prompts, outputs and uploaded files stay after use, and how long after you leave. OpenAI's help centre says that when a member is removed from a ChatGPT Business workspace, their chats, files and canvas documents are kept indefinitely (and restored if the person is re-added) but are not transferred to the workspace owner, and that self-service export is not available in Business workspaces. For a firm that may need to show what was done on a matter, that is worth knowing before you buy. Check the current help page, because these details move.
5. Human access. Can the supplier's staff read your prompts, for abuse monitoring or support, and under what controls? Microsoft says Copilot services have opted out of the human-review abuse monitoring that its Azure OpenAI service offers. Suppliers differ here, so ask the question and get the answer, with its exceptions, in writing.
6. Connected features. Web search, agents, connectors and plug-ins can each send data elsewhere under separate terms. Microsoft's documentation tells admins to read an agent's own privacy statement and terms before allowing it. Ask which connected features are on by default and who in your firm can switch them off.

The UK GDPR terms the contract has to carry

If the tool handles personal data on your behalf (and law-firm matters are full of it: clients, witnesses, counterparties, employees), the supplier is acting as a processor and UK GDPR requires a written contract. Article 28 sets the minimum content. Use the table as a tick-list against the supplier's data processing terms.

Two timing points sit behind that table. UK GDPR gives a processor no fixed hours: it must tell you of a breach "without undue delay". Your own report to the data-protection regulator is due within 72 hours of becoming aware, where feasible, so a supplier that takes four days to call has used up your window. Put a number of hours in the contract. Second, if any sub-processor handles the data in another country, the transfer rules apply and a lawful transfer mechanism has to be in place. Ask which mechanism the supplier relies on and where it is documented.

Check the liability cap against what a leak would cost you, and check what the supplier will stand behind on output. Indemnities for AI output differ by product: Microsoft's Copilot Copyright Commitment says it will defend commercial customers sued for copyright infringement over use of Copilot or its output, provided they used the built-in guardrails and content filters, while OpenAI's service terms extend their output indemnity to API customers and to Enterprise, Edu and Healthcare workspaces, not to ChatGPT Business. Same vendor, different cover. Tell your professional indemnity broker which tool you are buying and ask whether the policy wording says anything about AI.

Confidentiality inside the firm: permissions, matters, leavers

For most firms the larger exposure is internal. An assistant that searches your documents inherits your folder permissions, and Microsoft's documentation says Copilot surfaces only organisational data that the person asking can at least view. If a folder is open to everyone, the assistant will cheerfully summarise it for everyone.

A mistake worth rehearsing before it happens, described here as an illustration: a trainee in a seven-person firm asks the assistant to "summarise how we handle redundancies" and gets a paragraph drawn from a partner's confidential staffing paper, because the folder was shared firm-wide years ago. Nothing was hacked. The permission was always wrong, and search was simply never good enough to expose it.

• Review permissions first. Before switching on any assistant that reads your document store, list every "Everyone" or "All staff" share, the folders for conflicted or restricted clients, and the HR and finance areas. Fix those before the pilot, not after the complaint.
• Ask about matter-level exclusion. Can a restricted matter be kept out of the assistant entirely, or does exclusion depend on folder permissions being perfect?
• Check admin controls. Who can enable web search, agents and third-party models? Can an administrator see who used the tool, when and on which matter? Are single sign-on and multi-factor authentication standard or part of a higher tier? Some products put them on upper plans only, so a cheaper plan can quietly remove them.
• Plan for leavers. Removal of access on the last day, and what happens to the person's chat history, should both be written down. Microsoft's documentation says admins can apply retention policies to Copilot interactions through Purview; ask your supplier whether you can match its retention to your file-retention rules.

Supervision: who checks what before it leaves the firm

The SRA's notice says relying on an AI output would not be a suitable defence where false authorities reach a court, that supervisors remain accountable for work done through others, and that firms need governance, systems and controls that cover AI risk, with the compliance officer for legal practice taking all reasonable steps to ensure compliance, supervision included. It adds that anyone with supervisory responsibilities should have appropriate experience. The notice does not give a buying checklist, though it points to safeguards such as data security, third-party access, model training and retention, and it says nothing about telling clients when AI is used. So what follows are your own rules, built on those points.

At the demo, test the tool against that ladder rather than against its own showcase. Ask for authority for a legal proposition you know to be wrong. A good product says it cannot find support. A weak one returns plausible citations, which is exactly the failure the notice describes. Then ask whether every statement in an output links to the source passage it came from, so a checker can verify it in seconds, and whether an administrator can see who used the tool on which matter. Both features are worth paying for if your fee earners will use them. A short note on the file shows the checks happened:

AI use note - matter [number]
Tool and plan: [name], [date]
Task: first draft of [client letter / summary of disclosure]
Client information entered: [yes or no; which documents]
Checked by: [initials], [date]
What was checked: dates and sums against [documents]; authorities 1 to 6 read on [database]
Supervisor: [initials] - approved / amended

Supplier checks that go beyond the security page

1. Certificates. Ask for the actual SOC 2 Type II report or ISO 27001 certificate, not a badge on a web page. Check that it is under a year old, that the scope names the product and its AI features, and read the exceptions section. "We are SOC 2 compliant" is a claim; a report from an independent auditor covering a stated period is evidence.
2. Ownership and runway. Who owns the company, how long has it sold to law firms, and what happens to your data if it is bought or closes? Suppliers do disappear: the scheduling tool Clockwise stopped running on 27 March 2026 and told users that all their data would be deleted shortly afterwards. An exit clause costs nothing at signing and everything if you did not get one.
3. Exit terms. Export formats you can open, a retrieval window in days, written confirmation of deletion, and help moving matter data across.
4. Price and renewal. Cap on increases at renewal, minimum seat counts and usage-based extras; per-seat and pay-as-you-go legal AI pricing compares the two models. ChatGPT Business and Claude Team, for instance, both require at least two seats. OpenAI's billing help says Business seat reductions take effect only at the next billing cycle, with seats on an annual plan committed for the term, and Claude's says removing a Team member brings no immediate credit or refund. On an annual plan, a pilot with five seats can lock in a year of five.
5. Support. Response times in the contract, a named contact, and an out-of-hours route for a suspected breach.
6. Their insurance. Ask what cyber and professional liability cover the supplier carries. It will not replace yours, but a supplier with none tells you something.

For questions that apply to any AI supplier, not only legal ones, asking suppliers where your data goes is a useful companion to this list.

A due-diligence email to send this week

Send the same questions to every supplier on the shortlist, so the answers can be compared line by line. Edit the bracketed parts and keep the numbering.

Subject: Data and supervision questions before we sign

Hi [first name],

We are a [six]-person law firm considering [product] for [drafting and summarising on named matter types]. Before we go further, please answer the questions below in writing and point me to the contract clause or document that backs each answer.

1. In which countries are our prompts, uploaded files and outputs (a) stored, (b) processed by the AI model, (c) reachable by your support staff?
2. Please list every sub-processor, including the AI model provider, with location and purpose, and tell me how much notice we get of changes and whether we can object.
3. Is any of our content used to train or improve any model, yours or a third party's? Does that include feedback buttons, flagged content and support tickets?
4. How long are prompts, outputs and files retained, including backups, and what is the deletion period after termination? Can you confirm deletion in writing?
5. Can your staff, or a sub-processor's staff, read our content? In what circumstances, and is access logged?
6. How quickly will you tell us about a personal data breach? Please give hours, not "without undue delay".
7. Which mechanism covers any transfer of personal data to another country, and where is it documented?
8. Please send your latest SOC 2 Type II report or ISO 27001 certificate, with the scope and date.
9. What admin controls exist for permissions, matter-level exclusions, usage logs and leaver removal, and which plan are they on?
10. What export formats do we get at the end, and how long do we have to retrieve our data?

Thanks,
[your name]

Read the replies sceptically. "We never use customer data to train our models" is a good start; follow up with "does that cover feedback, flagged content and support tickets, and which clause says so?" "Your data is stored in a secure cloud" is not an answer, because it names neither country nor processing location. "Our sub-processors are listed on our trust page" is useful only if the page gives locations and purposes, names the model provider and lets you subscribe to change notices. "We are SOC 2 compliant" should draw a request for the Type II report and the period it covers.

Scoring two tools for a six-person firm, with the sums

A six-person firm, four fee earners and two support staff, shortlists a general assistant on a business plan (Tool A) and a legal-specific assistant (Tool B). Weight the criteria before anyone sees a demo, score each tool from 0 to 5 using the supplier's written answers and your own test, and multiply. The weights below reflect a firm that worries more about data and supervision than price.

All figures here are illustrative. The weighted score is each weight multiplied by the score and divided by five, so 25 x 3 / 5 gives 15. Tool B leads by eight points, mostly on supervision features and data handling, but the cost line is where the argument usually starts. At the November 2026 list price of $20 a user a month billed annually (the standard seat on ChatGPT Business or Claude Team), six business-plan seats for Tool A cost 6 x $20 x 12 = $1,440 a year. Tool B, quoted here at an invented $110 a user a month for the four fee earners only, costs 4 x $110 x 12 = $5,280. The premium is $3,840.

Turn the premium into hours. Value a fee earner's recoverable hour at $150 and the premium needs to save 3,840 / 150 = 25.6 hours a year across the firm, which is 6.4 hours per fee earner, or about 32 minutes a month each. That is a low bar if the citation click-through and audit log are used, and a high one if they are not. So the score does not settle it; the pilot does, and it should test whether people actually use the features you are paying extra for.

A 30-day pilot, and the evidence that it worked

1. Before day one, do the impact assessment. Article 35 requires one where processing, in particular using new technologies, is likely to result in a high risk to people. Client files in an AI tool is a reasonable candidate, so complete it first; a worked DPIA example shows the shape. Also check that the pilot account sits under the business contract. A free trial can sit under consumer terms with different training and retention rules.
2. Pick 20 tasks. Use closed or low-risk matters, or redacted documents, and give both tools the same 20 so the comparison is fair. A two-week trial scorecard covers accuracy, privacy and cost scoring if you want a ready-made sheet.
3. Log every error. Each output gets a reviewer and a row in the error log.
4. Set stop rules. Client data entered into a non-approved tool pauses the pilot for review. An invented authority that reaches a second reader before anyone catches it stops the pilot until supervision has been reviewed.
5. Review on day 30. Count tasks completed, minutes saved net of checking time, errors by type and near misses. Decide go, change or stop, and write the decision in the register.

A filled-in error log, with invented entries, shows what to record:

My starting pass marks, to adjust to your own risk appetite: no invented authority survives the first checker, wrong-party errors are zero by day 30, and minutes saved after checking are positive on at least three of the five task types. A tool that fails the first mark is not ready for court-facing work, whatever it does for letters.

What to re-check after you sign

Most problems arrive after the contract, through quiet changes: a terms update, a new sub-processor, a feature switched on by default, a price rise at renewal, or a member of staff using a personal account because the approved one felt slow. Calendar a 20-minute review each quarter and put the same five items on it: the supplier's sub-processor page and terms for changes, the list of newly released features and whether each is on, the usage log for accounts that should not exist, the error log for patterns, and the register entry itself.

The register entry can be one row per tool: tool and plan, supplier, data allowed, data barred, owner, supervisor, date approved, next review date. In a small firm the compliance officer for legal practice, or whoever holds that role, keeps it. Where this tutorial quotes a supplier's help page or terms, check the page again before relying on it, because these details change often. For the wider basics of confidentiality with general chat tools, the confidentiality tutorial for solicitors goes through what to keep out of prompts, and a checklist built on the regulator's AI guidance covers the rules side in more detail than a buying guide can.

Questions small firms ask before signing

Is 'we don't train on your data' enough to go ahead?

No, it answers one question out of several. Ask whether it covers uploaded files, outputs and feedback buttons, whether it is the default or a setting, how long content is kept, whether supplier staff can read it, and which sub-processors see it. Get each answer in the contract or data processing terms, because a sales email can be changed or forgotten.

Can staff use a free chatbot for tasks with no client data?

In principle yes, but the regulator's notice is concerned with confidential client information going into public tools, so staff must be able to tell the two apart in seconds. Give them a short list of examples on each side, such as a rota template (fine) and a client's witness statement (never), and put the list in your AI use policy.

Who should own the AI decision in a firm of three partners?

Name one person. In a regulated firm the compliance officer for legal practice is the natural owner of the register of approved tools, the partners approve the purchase, and each supervisor owns the checks on the work they sign off. Spreading it across everyone usually means nobody notices when a supplier changes its terms.

Does a legal-specific tool remove the need for these checks?

No. A legal-specific tool may bring better citation features and sector-aware contract terms, but it still processes client data through sub-processors, still needs a processor contract and still needs supervised output. Some are built on third-party models, which is one more sub-processor to ask about. Score it on the same checklist as a general assistant and compare the results.

Further reads

• Law Firm AI Usage: How to Audit What Your Fee Earners Really Use — Find out what fee earners already use before you buy anything.
• AI Training for Solicitors' Firms: A One-Hour Team Session Plan — A one-hour session to teach the rules once the tool is chosen.
• Best AI Chatbot for Lawyers: General Models vs CoCounsel — General models and a legal-specific product, compared head to head.
• CoCounsel Pricing: What a Small Firm Should Ask Before Buying — Quote questions for one legal AI product, usable as a template.
• AI Implementation Plan for a Small Law Firm: The First 90 Days — A 90-day plan for rolling out the tool you choose.
• Law Firms AI UK: What Solicitors Should Check Before Using AI — Tool-agnostic checks to run before anyone uses AI on a matter.
• ChatGPT or a Legal AI Tool: Which Should a Small Firm Use? — When a general assistant is enough and when it is not.
• Best AI for Solicitors in the UK: Matched to Each Task — Match AI tools to research, drafting, client emails and contracts in a small UK firm, with list prices, data-location answers and a supervision record.
• Clio Manage AI Pricing: What It Costs and How to Switch It On — Manage AI (formerly Clio Duo) is bundled into Core and above. What Clio publishes, what needs a quote, and the admin steps to switch it on.
• Clio vs Smokeball: Which AI Assistant Suits a Small Firm? — Eight tasks to run on both Clio Manage AI and Smokeball's Archie, a sample scorecard, and the cost caveats that feature lists skip.
• CoCounsel or Lexis+ With Protégé? Legal Research AI for a Small Firm — Run the same five research questions through CoCounsel and Lexis+ with Protégé, check every citation, and score the answers before you pay.
• Conflict Check Software for Small Law Firms: Where AI Helps — Where AI helps in a conflict check, where it must not decide, and what a partner signs off, with a worked example and a 20-minute test of your own tool.
• E-Discovery Software for Small Law Firms: Costs, Limits and AI Review — Six e-discovery pricing models, one matter costed from your own data, and a sampling test for AI review, written for a firm with a handful of lawyers.
• Smokeball Archie: What the AI Assistant Does and Which Plans Add It — What Smokeball's Archie reads, drafts and cannot see, which plans can add it, and how to price a quote-only add-on tier by tier.
• Spellbook Pricing: How a Small Firm Should Read the Quote — Spellbook is quote-only with a 7-day free trial. How a small firm can read the quote beside Copilot and Gavel Exec, line by line, and test all three on one NDA.
• AI Content for Law Firms: Website Articles That Pass Advertising Rules — A topic brief, drafting prompt, twelve advertising-rule checks and a before-and-after rewrite for law firm website articles.
• ChatGPT for Solicitors: Five Safe Tasks and Three to Avoid — Five tasks a solicitor can safely give ChatGPT, three to avoid, and the settings and client-data rules that go with them.
• AI Tools and AI Development: The Complete 2026 Guide — the AI hub, including every tutorial in the AI-for-business series.

Sources: the SRA warning notice on the misuse of AI (17 August 2026), UK GDPR Articles 28, 33 and 35 on legislation.gov.uk, Microsoft's Copilot data, privacy and security documentation, Anthropic's privacy centre page on model training, OpenAI's help centre (member removal, data export, Business billing) and Service Terms, Claude's Team billing help, Clockwise's shutdown notice, and the ChatGPT Business and Claude Team pricing pages, all checked on 4 November 2026.