Do law firms need an AI policy?

If anyone in the firm uses AI, yes, and that includes the AI now built into case management and research tools. The SRA expects firms to supervise how AI is used and protect client confidentiality, and a policy is the clearest way to show you do.

What does the SRA expect?

Its August 2026 warning notice says solicitors remain accountable for their work however it was prepared, supervisors are responsible for how their teams use AI, and client data should stay secure, not be used to train AI models unless explicitly authorised, and not be kept longer than necessary.

Do we need to tell clients we use AI?

It’s good practice, and the simplest way to deal with confidentiality questions before they arise. Your terms of business are the natural place, with a way for clients to opt out.

Does this replace SRA and Law Society guidance?

No. It’s a practical starting point. Check it against the SRA’s guidance, the Law Society’s guidance on generative AI and your insurer’s requirements.

AI policy and terms of business clause for law firms (free)

How to use these

List your tools. Section 3 matters most: include the AI in your case management and research tools, not just ChatGPT and Copilot. Our checklist helps you work out what each one does.
Fill in the brackets and delete what doesn’t apply.
Add the clause to your terms of business, so clients know how you use AI and can opt out.
Brief everyone, including support and agency staff, and make sure supervisors know their part.
Review every six months, and whenever your software adds AI features.

The policy

[Firm name]: AI acceptable use policy

1. Purpose

AI tools can save our firm time, but our clients trust us with confidential and often privileged information, and we owe duties to the court. This policy sets out how everyone at [Firm name] may use AI, so that we protect client confidentiality, meet the SRA Standards and Regulations, and remain accountable for every piece of work we produce.

2. Who this policy applies to

Partners, solicitors, trainees, paralegals, support staff, consultants and agency staff, whenever they use AI for our work, on any device.

3. Approved AI tools

General AI assistants, used only through our business accounts:

[e.g. Microsoft 365 Copilot, with your work account]
[e.g. ChatGPT Business, through the firm’s workspace]

Legal research and document tools, and what each may be used for:

[e.g. Lexis+ with Protégé: research and first drafts, for checking]
[e.g. contract review tool: first review of standard contracts]

AI features in our case management software:

[e.g. time capture, key dates, draft bills]

Only [COLP, or Name or role] may switch on new AI features in any of our software, or connect AI tools to our case management system or document store.

4. Client confidentiality

Client information may go into an approved AI tool only where our terms of business cover it, or the client has otherwise agreed. Clients who opt out are flagged on the matter, and their information never goes into AI tools.

We only approve tools that keep client data in a secure environment, don’t use it to train AI models, and don’t keep it longer than necessary. Client information must never go into a publicly available AI tool, such as a free or personal ChatGPT, Claude or Gemini account.

5. Information that never goes into AI tools

Material covered by a court order, undertaking or confidentiality agreement that restricts how it may be used
Identity documents and the results of anti-money laundering checks
Anything relating to money laundering concerns or suspicious activity reports
Login details, including for court portals and HM Land Registry
[Special category data, unless a tool is approved for it]

6. Legal research and citations

AI can produce convincing cases, quotations and citations that don’t exist. Every authority, quotation and citation must be checked against an authoritative source before anyone relies on it, and AI-generated research never goes into anything for a court, a client or the other side unchecked.

7. Supervision and responsibility

The fee earner is responsible for any work produced with the help of AI, as if they had prepared it themselves. Supervisors are responsible for how the people they supervise use AI, and check that this policy is followed.

8. Recording AI use

When AI helped with a piece of work, note on the matter file which tool was used, what for, and who checked it.

9. AI that talks to clients or the public

AI that answers enquiries or communicates with clients, such as an intake assistant, uses wording approved by [Name or role]. It must say that it is AI, must not give legal advice, and must pass anything that needs judgement to a person.

10. Accounts and security

Use your work account for every approved tool, never a personal one, and protect it with multi-factor authentication. Don’t install AI browser extensions, meeting note-takers or add-ons without approval from [Name or role].

11. Mistakes and incidents

If client information goes into the wrong tool, or AI produces something that worries you, tell [COLP, or Name or role] straight away. The firm will assess whether it’s a personal data breach, which may need reporting to the Information Commissioner’s Office within 72 hours, whether it needs reporting to the SRA, and whether to tell the client or our insurer. Reporting it quickly matters more than the mistake.

12. Training and review

Everyone will be shown how to use the approved tools safely before they start. This policy was last reviewed on [date] and will be reviewed at least every [six] months, and whenever our software adds new AI features.

Signed: ______________________ Name: ______________________ Date: __________

The terms of business clause

Section 4 of the policy relies on clients knowing how you use AI. This clause tells them, and lets them opt out. Adapt it to the tools you actually use.

Use of artificial intelligence

We use artificial intelligence (AI) tools to help us provide our services efficiently, for example in legal research, drafting and reviewing documents, and managing your matter.

We only use AI tools that keep your information confidential and secure, do not use it to train their AI models, and do not keep it longer than necessary. [Your information is processed in the UK or the European Economic Area, or with equivalent safeguards.] We do not put your information into publicly available AI tools. Our duties of confidentiality to you, and legal professional privilege, are not affected.

A qualified member of our team checks any work produced with the help of AI, including every legal authority it relies on, before we rely on it or send it to you, a court or anyone else. We remain responsible for that work.

If you would prefer us not to use AI tools on your matter, please tell us. [This may affect our fees or timescales.] More detail is in our privacy notice.

The policy and clause are a starting point, not legal advice. Check them against the SRA’s and the Law Society’s guidance and with your insurer, and make sure they match what your tools actually do.

Questions about AI policies for law firms.

Do law firms need an AI policy?
If anyone in the firm uses AI, yes, and that includes the AI now built into case management and research tools. The SRA expects firms to supervise how AI is used and protect client confidentiality, and a policy is the clearest way to show you do.
What does the SRA expect?
Its August 2026 warning notice says solicitors remain accountable for their work however it was prepared, supervisors are responsible for how their teams use AI, and client data should stay secure, not be used to train AI models unless explicitly authorised, and not be kept longer than necessary.
Do we need to tell clients we use AI?
It’s good practice, and the simplest way to deal with confidentiality questions before they arise. Your terms of business are the natural place, with a way for clients to opt out.
Does this replace SRA and Law Society guidance?
No. It’s a practical starting point. Check it against the SRA’s guidance, the Law Society’s guidance on generative AI and your insurer’s requirements.

Start with an AI health check.

A fixed-price review of how your firm uses AI today, and what to change.

The AI in your software: case management, research and document tools, what’s switched on and what it does with client data
The tools your fee earners and staff use, including the ones nobody signed off
Confidentiality and supervision: your policies and terms of business against the SRA’s expectations
Clear next steps, in a short written report that’s yours to keep

£750 + VAT, fixed price.

Book a free intro call What the health check covers

AI policy and terms of business clause for law firms.