An AI policy for a law firm: what regulators now expect, and what to write down

Most law firms already have AI in the building: a lawyer condensing a bundle, a junior running a first pass at research, an assistant tidying a letter before it goes. Regulators have now said in writing what they expect when that happens, and a firm's AI policy is where it shows it has listened.

Although we write the policy with you and build the controls behind it, none of what follows is legal advice. Your regulator's own text is what binds you, and your compliance officer decides the firm's position.

What regulators and the courts have said

In England and Wales, the Solicitors Regulation Authority issued a warning notice on the misuse of AI on 17 August 2026. It reminds solicitors and firms that their existing obligations apply when they use AI, and it is mainly about two concerns: inaccurate material, including invented case citations, put before courts and clients, and client confidentiality.

Supervisors stay accountable for work done through the people they supervise, and a firm that does not have proper regard to the notice is at risk of disciplinary action. The SRA says it has already identified a number of cases, some reported by senior judges and some by solicitors reporting themselves.

The notice followed a judgment of the Divisional Court in June 2025, Ayinde v Haringey, which dealt with fictitious citations put before the court in two separate cases. The court said that managing partners and heads of chambers have to take practical measures to make sure AI is used properly, and that it would ask whether they had.

In the United States, the American Bar Association's Formal Opinion 512, issued in July 2024, applies the existing rules to generative AI:

• Understand the tool well enough to use it competently.
• Protect client information and consider whether the client needs to agree before it goes in.
• Review the output before relying on it.
• Supervise the people and suppliers involved.
• Do not charge for more time than was spent.

State rules and state bar opinions govern in practice, and several have issued their own. Wherever your firm is regulated, check your own regulator's text, although the themes rarely differ.

The SRA warning notice, Ayinde v Haringey and ABA Formal Opinion 512 compared

The three things they agree on

1. Anything that reaches a court or a client has been checked by a person who is accountable for it. The tool is never the author of record.
2. Client information goes only into tools whose terms and set-up protect it, which rules out personal accounts on consumer terms.
3. Each lawyer's own duties stay, and the firm itself also has measures in place: a written policy, training, and supervision that someone can show.

What a law firm's policy has to say that others do not

The structure is the same as any AI policy, which what an AI policy should contain sets out and the AI policy outline gives you section by section. Six parts of it carry more weight in a law firm.

Matter information

The data list starts with client matter information, and the default for it is no, on any tool and any account, unless a condition is met. The SRA's notice warns that putting client information into an unsuitable tool will likely breach confidentiality and may waive privilege permanently, which is why this line comes first.

Privileged material, documents covered by a court order or undertaking, and material disclosed by the other side under restrictions on its use each need their own line. Because a note-taker on a client call records privileged conversation, the rules on note-takers belong in the same section.

Authorities and citations

Because the notice and the court were most concerned with this rule, write it so that nobody can misread it. A line that works reads something like this:

General chat tools are not a source of authority, and the policy should say which approved research tools are.

Supervision

For AI-assisted work by trainees, paralegals and junior lawyers, name who reviews it and at what point. The court in Ayinde looked for practical measures at the top of the firm, so the policy should say who owns them by role, which in England and Wales is usually the compliance officer for legal practice.

Client terms

Some corporate clients address AI in their terms for outside firms, and a few restrict it. The policy should send people to the client's terms before AI is used on that client's matters, and the register of approved tools should note any client that has said no.

Recording use on the matter

Decide whether a lawyer notes on the file when AI contributed to a piece of work. It costs little at the time, and it answers the question quickly if a court, a client or the regulator asks later.

Billing

Decide how time spent with AI is recorded and charged, and write the answer down, because both the opinion in the United States and clients' own terms make this a question a firm will be asked.

What the policy does not do

It does not replace your regulator's text, your lawyers' own professional decisions or your compliance officer's view of the firm's obligations. Say so in the policy itself, together with what it does not cover, such as AI features built into your practice management or document systems that have not been reviewed yet.

Where this fits

For a firm, the policy is written in a half-day with partners and the compliance officer, as the first output of Govern. Before that, the readiness snapshot shows which tools are already in use, on whose accounts and what they can reach, which is where the confidentiality question starts. How the whole route works for law firms and other advisers is on the professional services page.

If you would rather start on your own, ten questions take about two minutes and send nothing anywhere.