SRA AI Guidance for Solicitors: A Checklist for Small Firms

The SRA expects a small firm to use AI only with human verification of every output, particularly case citations, and only with client information protected by proper contractual and technical safeguards. Responsibility stays with the solicitor and the firm. Change now: list the tools in use, ban unapproved ones for client work, and add a citation check.

The source to work from is the SRA's warning notice on the misuse of AI, published on 17 August 2026. The SRA says it will have regard to the notice when exercising its regulatory functions, and that failing to have proper regard to it puts you at risk of disciplinary action. The plan below applies it to a ten-person firm with a named owner and a date for each step. It is practical guidance, not legal advice, so read the current notice yourself and take advice from your COLP or professional adviser on anything specific to your firm.

Follow me on Instagram@sagnikteaches

What the SRA actually says

The notice makes five points that matter to a small firm.

Connect on LinkedInSagnik Bhattacharya

1. It is not anti-AI. The SRA describes an outcomes-focused approach: it sets the standards but does not prescribe how firms meet them, so firms have freedom to use AI provided they meet them.
2. Two concerns lead. First, court or other documents containing false or incorrect information, including citations, because of AI hallucinations. Second, firms not fully considering and mitigating risks to client confidentiality, especially clients' personal data.
3. Paid tools are not automatically safe. Both paid and free tools may lack the safeguards needed, so firms should understand the safeguards and ensure they suit the sensitivity of the information.
4. Accountability does not move. AI has no separate legal personality. Solicitors who use AI remain accountable for their work and outputs, and those who supervise others remain accountable for what is done through them.
5. Firms need governance. The notice points to the firm code's requirement for effective governance structures, systems and controls to manage risk, including from AI.

The notice cites court decisions where false citations were put before a court, including a 2025 decision in which a solicitor and a barrister faced wasted costs applications and referrals to their regulators. It also cites a 2026 tribunal decision observing that putting client letters into an open AI tool places the information on the internet in the public domain, and the SRA adds that using tools that way will likely breach confidentiality, with legal professional privilege possibly waived for good. Those are the stakes: not a tidy-up, but privilege and conduct.

Subscribe on YouTube@sagnikteaches

The same notice lists Code provisions as particularly relevant, among them those on not misleading the court or clients, only making properly arguable submissions, competent service, supervision, confidentiality and being able to justify decisions. You do not need to memorise numbers. You need a policy that a reader can map to them.

What the February 2026 compliance tips add

The SRA's page of compliance tips on AI and technology, updated on 9 February 2026, covers the governance side that the warning notice only points to. Three lines from it belong in a small firm's plan.

• The COLP owns it. As a minimum, the SRA expects the COLP to be responsible for regulatory compliance when new technology is introduced, and it highlights oversight of both the purchase and the ongoing use.
• Governance has five parts. Leadership and oversight, risk and impact assessments, policies and procedures, training and awareness, and monitoring the technology's impact to avoid unintended consequences.
• Some clients will not use it. Not everyone can or wants to use legal technology, so give those clients another way to work with you.

Each line maps to a row in the plan: the COLP holds the confidentiality decisions and the record, the vendor decision record is your risk assessment, Step 5 is the training, Step 8 is the monitoring, and Step 7 covers clients who want a non-AI route. The tips also point to the data-protection regulator's material on explaining how personal data is processed and on automated decision-making, worth reading if a tool makes or shapes decisions about clients.

Eight actions, one owner and one date each

The dates are an illustration starting the week of 9 November 2026. Move them to suit you, but keep one owner per row and one date. A task with two owners is owned by nobody.

Step 1: Find every AI tool, by 13 November

Owner: the practice manager. Ask each person the same five questions in a short form: which AI tools do you use for work, on what device, with which account, for which tasks, and have you ever entered client names or documents? Also scan expense claims and browser extensions, and check features inside the case management, document and email systems the firm already has, because AI appears there as an update.

In an illustrative ten-person firm (three partners, three associates, two paralegals, an office manager and an administrator), the form finds: a general-purpose chatbot used by four people on personal accounts, a transcription tool on one partner's phone, an AI drafting feature inside the document system, and a legal research tool the firm pays for. Four tools, two of them unknown to the managing partner. That is the normal result and the reason to start here.

Step 2: Confidentiality decisions, by 20 November

Owner: the COLP. For each tool, decide approved, approved with limits, or not for client work. The SRA's notice says client information should only be entered where appropriate contractual, technical and organisational safeguards protect confidentiality, and that firms should satisfy themselves that data stays in a secure environment, is not accessed by unauthorised third parties, is not used to train models unless explicitly authorised and appropriate, and is not retained longer than necessary. Turn that into questions for each vendor:

• Is client content used to train models? Can that be turned off, and who controls the setting?
• How long are prompts and files retained, and can the firm delete them?
• Who are the sub-processors, and where is data processed?
• Is there a business or enterprise agreement, not only a consumer account?
• Can the firm control who has accounts, and can it remove a leaver's access?

The privacy terms tutorial shows where to find each answer in a vendor's documents. Write the decision and the date on a one-page record. An illustrative outcome: the legal research tool is approved for client matters; the document-system feature is approved after training use is confirmed off; the general chatbot is approved for non-client tasks only; the transcription app is not approved because its terms allow retention the firm cannot control.

A rule staff can follow

Policies fail when they are long. Put the confidentiality rule on one page, in plain words:

AI at [FIRM NAME]: the rules
1. Use only tools on the approved list for client work.
2. Never enter client names, addresses, ID numbers, documents or facts that identify a matter into any tool that is not marked "client use approved".
3. Everything an AI tool produces is a draft. You are responsible for it.
4. Every case, statute or quotation in anything that leaves the firm must be checked against the original source by the person who signs it.
5. If you think you have put something in the wrong place, tell [COLP] the same day. We would rather know.
Last reviewed: [DATE]. Questions: [NAME].

Rule five matters. A firm that punishes self-reporting teaches people to hide mistakes, and the notice notes that some solicitors have self-reported where AI generated inaccurate content.

Step 3: The citation rule, by 20 November

Owner: the senior partner. The notice says solicitors should be assured that every named authority they put forward is genuine, relevant, has a verifiable citation and supports the argument. A workable rule for a small firm:

1. The person who signs the document opens each authority in a recognised legal database or the court's own decision page and reads the relevant passage.
2. They tick a checklist line: "All authorities verified at source, date and initials."
3. A second person spot-checks one authority in every document that goes to court.
4. No authority supplied by an AI tool is cited unless it has been found independently of that tool.

Illustrative failure: a paralegal asks an assistant for cases on a limitation point. The reply lists three cases with citations that look right. Two exist, one does not, and one of the real cases says something different from the summary. Because the rule requires opening each decision, the paralegal finds the problem in ten minutes. Without the rule, the draft reaches the supervising solicitor looking finished.

Step 4: Supervision, by 27 November

Owner: the supervising solicitors. The notice reminds supervisors that they remain accountable for work done through others and that they must effectively supervise. It also notes the firm code's requirements on competent staff and effective supervision systems.

Add three questions to your file review or supervision meeting template:

• Was an AI tool used on this matter? Which one, and for what?
• What was checked, and by whom, before the output was used?
• Was any client information entered, and was the tool approved for that?

Illustrative: in a monthly review of eight files, the supervising solicitor finds two where an assistant was used for a client letter draft. Both letters were checked, but neither file recorded it. The fix is a one-line file note template, not a new policy. A reviewer reading it later can see that the system worked.

Step 5: Training, by 4 December

Owner: the training lead. The notice says managers must ensure that those they manage are competent and keep their knowledge up to date, which now includes how AI tools behave. Run one 45-minute session with three live demonstrations: an assistant inventing a citation, an assistant summarising a document and missing an exception, and the data rule applied to three sample prompts. Use invented facts only. Afterwards each person signs the one-page rule and the date goes on the record.

Repeat the session for new starters, and refresh it when you change a tool or the vendor's terms change.

Step 6: The record, by 4 December

Owner: the COLP. Keep four documents in one folder. The first is the tool register: tool, purpose, owner, approval, data terms reviewed, next review date. The second is the policy and acknowledgements. The third is a short incident log: what happened, what was done, what changed. The fourth is a quarterly note of what the COLP checked.

Why this matters: the Code requires you to be able to justify decisions and actions to show compliance. A dated register and a log are the cheapest justification you can build. An unwritten decision is hard to prove.

Step 7: Tell clients what you need to, by 11 December

Owner: the managing partner. The notice does not spell out a client disclosure rule, so this is a firm decision to make with advice. Consider what your client care information and terms say about technology, and whether clients with particular sensitivity should be told when AI is used on their matter. If a client asks you not to use AI on their matter, record that and flag it on the file. The client care letter tutorial looks at where AI wording fits.

Step 8: Quarterly review

Owner: the COLP. Every quarter, check the register against reality (new tools, new features), sample two or three files for the AI questions, read the vendor notices, and record what changed. Add any new SRA publication on the topic to the agenda. The ten minutes spent reading the SRA's AI page each quarter is cheaper than finding out about an update from a client. For a conduct question the firm cannot settle internally, the notice points to the SRA's Professional Ethics Guidance helpline, and to SRA Innovate for queries about using technology.

Applying the checklist to four everyday tasks

A typo in a marketing draft costs little. A wrong authority or a leaked document does not, which is why the checks sit next to each use and not in a general policy.

If something goes wrong: a same-day response

Every firm needs a response that people will actually use, so keep it short enough to fit on the back of the policy. The notice records that some solicitors have self-reported after relying on AI tools that produced inaccurate content, and that is the behaviour a good system encourages.

1. Stop and tell. The person who notices tells the COLP the same day. No blame conversation first.
2. Contain. If client information went into an unapproved tool, record which tool, what was entered, when, and whether the account can be deleted or the content removed. If a document with a doubtful authority has gone out, identify who received it.
3. Assess. The COLP, with the partner on the matter, decides whether the client must be told, whether the court or the other side must be corrected, and whether anything needs to be reported to the regulator. This is a professional judgement, so take advice where unsure.
4. Correct. Withdraw or amend the document, write to the client as appropriate, and change the control that failed.
5. Record. Add a line to the incident log: date, what happened, what was done, what changed.

An illustrative case: an associate pastes a client's tenancy dispute email chain into a free chatbot to produce a timeline. They realise at once and tell the COLP. The COLP records the tool and time, checks whether the account allows deletion of the chat history, asks the associate to delete it, notes the vendor's retention terms, and decides with the partner whether the client should be told. The log entry also records the change: the approved tool now has a "timeline from chronology" template so nobody needs the free one. The incident cost two hours and produced a better system.

A filled-in vendor decision record

A decision record turns the confidentiality step into evidence. This is an invented illustration of one entry, which you can copy as a template.

The retention and sub-processor entries above are invented. Fill yours from the vendor's actual documents on the day you review them, and do not copy figures from this table.

Where small firms trip

• The shadow account. A fee earner uses a personal chatbot account because the approved tool is slower. Fix the tool, not only the rule.
• The tidy summary. A neat AI summary is mistaken for a checked one. Require the tick line.
• The supervisor assumption. A partner signs a document with citations a junior drafted, assuming someone checked. The signing person owns the check.
• The feature update. AI switches on inside software you already use. The quarterly review looks for it.
• The policy nobody read. The acknowledgement is signed but nobody remembers the rules. Test with a short quiz at training.

What this plan costs

Illustratively, for a ten-person firm: about six hours for the practice manager to run the inventory and chase answers, three to four hours for the COLP on vendor terms and the register, an hour for the senior partner on the citation rule, 45 minutes of training for ten people (about seven and a half person-hours), and an hour a quarter for review. Roughly two working days in the first month and an hour a quarter after that. Compare that with the cost of a wasted costs application or a privilege problem and the budget is small.

If you would like help mapping the AI jobs in your firm and writing a proportionate set of controls, that is what my AI implementation consultation is for. For the wider rollout, the 90-day plan for a small law firm sits alongside this checklist. Check the SRA's current pages before you finalise anything, because its guidance on AI is still developing.

SRA and AI: questions from small firms

Has the SRA banned solicitors from using AI?

No. Its warning notice says the SRA takes an outcomes-focused approach and that firms are free to use AI tools and new ways of working provided they meet its standards. The notice is about misuse, chiefly false citations and client confidentiality breaches, and about accountability staying with the firm.

Are paid AI tools safe for client confidentiality?

Not automatically. The notice says both paid-for and free tools may lack the contractual and technical safeguards needed, and that firms should understand the safeguards that apply. Read the retention, training-use and sub-processor terms, and record your decision before client information goes in.

Who in the firm is responsible?

The notice stresses that solicitors remain accountable for their work whatever tools were used, and that supervisors and managers carry responsibility for supervision. At firm level it points to governance, systems and controls, and to managers' joint responsibility for the firm's compliance with the Code. The SRA's compliance tips add that, as a minimum, the COLP should be responsible for regulatory compliance when new technology is introduced.

Do we need a written AI policy?

The SRA does not prescribe a form, since its approach is outcomes-focused, but its compliance tips list policies and procedures, risk and impact assessments and training as part of appropriate governance, and the Code requires you to justify your decisions. A short written policy, a tool list and a record of checks is the simplest way to do that. Ask your COLP and professional adviser about specifics.

Further reads

• Law Firms AI UK: What Solicitors Should Check Before Using AI — Pre-use checks for any AI tool at a law firm.
• ChatGPT or a Legal AI Tool: Which Should a Small Firm Use? — Choose between a general assistant and a legal tool.
• Per-Seat or Pay-As-You-Go? Legal AI Pricing for Small Firms — What legal AI costs per seat or per use.
• How Conveyancers Use AI to Cut Admin on Each Transaction — A transaction-level use case to test against the checklist.
• SRA Transparency Rules: Use AI to Draft Price and Service Pages — Use AI on price and service pages within the transparency rules.
• How Small Law Firms Use AI to Draft Letters and Routine Documents — Routine letters with AI and the checks that go with them.
• Best AI for Solicitors in the UK: Matched to Each Task — Match AI tools to research, drafting, client emails and contracts in a small UK firm, with list prices, data-location answers and a supervision record.
• AI Software for Solicitors: Data, Supervision and Supplier Checks — A buying checklist for small law firms: where client data goes, what the contract must say, who checks AI output and which supplier answers to chase.
• AI Tools and AI Development: The Complete 2026 Guide — the AI hub, including every tutorial in the AI-for-business series.

Sources: SRA warning notice, Misuse of AI (published 17 August 2026); SRA compliance tips for solicitors regarding the use of AI and technology (updated 9 February 2026); SRA Principles and Codes of Conduct as quoted in the notice.