AI governance for small law firms.
On 17 August 2026 the SRA warned the profession about AI misuse. It had received 42
reports of possible misuse between July 2025 and July 2026. Its notice doesn't ban AI.
It expects firms to have appropriate oversight and controls in place. Your COLP, the
compliance officer for legal practice, is the person who has to answer for them.
I review how your firm uses AI, for a fixed price. I record the tools your people use,
rate each gap and rank the fixes. You get a report your COLP can show insurers and
clients.
About three minutes. No payment needed.
What the notice says.
-
The main risks were AI-generated inaccuracies in research, advice and court submissions,
and client confidential information entered into AI tools without appropriate
safeguards.
- Firms and solicitors must have "appropriate oversight and controls in place".
- Individuals remain responsible for the work they produce.
- The SRA added AI sections to its effective supervision guidance in June 2026.
Source:
SRA warning notice, 17 August 2026.
What a COLP gets asked.
| The question |
What the review covers |
| Who supervises AI output? |
Whether someone checks AI output before a client sees it, and who owns AI use
across the firm.
|
| Is client confidential information kept out of unsafe tools? |
Which AI tools staff use, including ones nobody approved, whether any can see
client data, and the controls on what goes into them.
|
| Is client personal data handled under UK GDPR? |
The lawful basis and privacy notice, impact assessments for AI processing, how
long prompts and outputs are kept, and access and erasure requests across AI
tools.
|
| Does AI make decisions about people? |
Whether AI decides something significant about a client or candidate, whether a
person reviews it, and what the individual is told and can challenge. This covers
UK GDPR Articles 22A to 22D, in force since 5 February 2026.
|
| What do your suppliers do with your data? |
Supplier due diligence, where the data is stored, whether tools train on what you
enter, and the processor terms you have agreed.
|
The review works from your answers and any documents you share. It doesn't test your
systems, and it doesn't tell you whether the firm complies with the law.
Where UK businesses stand.
Most firms start from nothing. Only 17% of UK businesses that use AI have any AI policy or
guidelines, and 46% weren't aware of any AI regulatory guidance (DSIT, UK Business Data Survey 2026). That's every sector, not just law.
Fixed price, 10 working days
AI Governance
review
A written record of the AI your firm uses, and what to fix first.
What you get
- A record of the AI tools your people use, built from your answers
- Each gap rated against UK GDPR, ICO guidance and ISO/IEC 42001
- A ranked list of fixes, with the effort each one takes
- A report your COLP can show insurers and clients
The review is advisory. It isn't legal advice or a certificate of compliance, and it
doesn't include security testing.
What the review doesn't cover.
Report within 10 working days after submission.
Who's behind it.
I'm Dave Butler. I build AI agents for enterprise clients, so I've seen how AI goes
wrong inside a business. I'll do your review myself.
Find out where your firm stands.