Home / AI for law firms / AI policy for law firms
law firm AI policy
AI policy for law firms
An AI policy for law firms is the short, practical document that tells everyone which AI tools they may use, for what, with which data, and how outputs must be checked.
This guide sets out what the policy should cover, drawing on SRA and Law Society guidance. For a general starting document, use our AI policy template and adapt it with the legal-specific sections below.
A policy people can follow on a busy day, aligned to the firm's professional duties and owned by named people.
Solicitors' duties to court and client apply regardless of AI use, including work under their supervision; citations must be verified; misleading the court breaches para 1.4 of the SRA Code. The Law Society: Generative AI, the essentials ↗
Firms remain responsible and accountable for AI outputs, cannot delegate accountability to IT or providers, need supervision that copes with AI speed, and should decide what to tell clients. SRA: Risk Outlook report, the use of artificial intelligence in the legal market ↗
New to the topic? Read the background on artificial intelligence.
law firm AI policy
why does a firm need an AI policy for law firms rather than a generic one?
Because professional duties to the court and client add rules a generic policy will miss.
A general workplace policy covers acceptable use and data protection. An AI policy for law firms also has to address duties to the court, privilege and supervision of fee earners.
The Law Society's generative AI essentials states that solicitors' duties apply regardless of whether AI was used, which the policy must make concrete.
Start from the AI policy template and add the legal sections rather than writing from scratch.
Court duties.
Privilege.
Supervision.
law firm AI policy
which tools and uses should the policy allow?
A named list of approved tools, each with permitted and prohibited uses.
List tools by name and version or licence, not by category. 'Approved: the firm's enterprise Copilot licence' is clearer than 'approved: AI assistants'.
For each tool, state the permitted uses, such as drafting internal notes or summarising documents, and prohibited uses, such as entering client data into public chatbots.
The SRA's Risk Outlook on AI gives examples of confidentiality threats that the prohibited list should cover.
law firm AI policy
how should an AI policy for law firms handle verification?
Make checking mandatory and specific for anything leaving the firm.
Require that every authority, quotation and factual statement in AI-assisted work be checked against a reliable source before it is sent to a client, counterparty or court.
The Divisional Court's judgment in Ayinde v Haringey shows the consequences of unchecked AI-generated citations.
State who checks: the person producing the work, and the supervisor reviewing it. A good AI policy for law firms also says how checks are recorded, so the firm can show its working if a client, court or regulator asks.
For litigation, reference the judicial guidance on AI, which expands on hallucination risk and shows what the courts expect of material put before them.
| Check | What to establish |
|---|---|
| 1 | Check authorities. |
| 2 | Check facts. |
| 3 | Name who checks. |
law firm AI policy
what should the policy say about confidentiality and data protection?
Set clear data rules and link to the firm's data protection approach.
Define which categories of information may be entered into each tool, defaulting to none for client-identifying material unless a tool is specifically approved.
Reflect UK GDPR principles such as data minimisation, set out in the ICO's guide to the data protection principles.
Note that the ICO's AI and data protection guidance is under review following the Data (Use and Access) Act, and set a date to revisit the AI policy for law firms when it changes.
law firm AI policy
should the policy cover telling clients about AI use?
Yes; decide a position and record it.
The SRA says firms need to decide what information to give clients about how AI is used in connection with their cases.
An AI policy for law firms can set a default position, for example a statement in engagement terms, and say when matter-specific disclosure is needed.
The position should be agreed by the COLP and reviewed with client care documentation.
Default disclosure.
Matter-specific cases.
COLP sign-off.
law firm AI policy
how do we make the policy stick?
Train people on it and review it on a fixed cycle.
A policy nobody has read protects no one. Pair it with AI training for lawyers that uses the policy's own rules in the exercises.
Set a review date, a named owner and a route for questions and incident reports. Without an owner, an AI policy for law firms tends to drift out of date as tools and licences change.
The AI risk assessment guide helps the owner decide which new uses need a closer look before they are added to the approved list.
The AI for law firms hub explains the wider governance picture this policy sits within.
Train on the policy.
Name an owner.
Review on a cycle.
Make the decision concrete
What does the current task cost in time?
Choose a task connected to ai policy for law firms and enter its current workload. This gives you a baseline to discuss before buying training or commissioning a build.
A baseline is useful even if you decide to keep the process manual. Measure the work that matters, then compare quality and review effort as well as time.
Assess the workflow before changing it, or plan business AI training if the gap is how people use existing tools.
Your current workload
Estimate how much time the existing task takes before discussing ai policy for law firms.
16 hours per week
People × minutes × weekly tasks ÷ 60. A workload baseline from your inputs, not a prediction of AI time savings. Include review and support time when comparing a proposed workflow.
A useful AI investment leaves your team able to do the work and judge the result.
Continue with the right question
Where should you go next?
Use the overview for context, then follow the pages that match your delivery decision.
See our ai training service or read the ai for law firms overview.
FAQ
Questions, answered
Evidence and further reading
Which sources support the guidance?
Source links support the specific background described here. The practical checklists and illustrative examples are predeploy’s guidance.
Solicitors' duties to court and client apply regardless of AI use, including work under their supervision; citations must be verified; misleading the court breaches para 1.4 of the SRA Code. The Law Society: Generative AI, the essentials ↗
Firms remain responsible and accountable for AI outputs, cannot delegate accountability to IT or providers, need supervision that copes with AI speed, and should decide what to tell clients. SRA: Risk Outlook report, the use of artificial intelligence in the legal market ↗
Divisional Court referrals over lawyers' unchecked use of generative AI putting false citations before the court; raises concerns about training, supervision and regulation. Ayinde v London Borough of Haringey [2025] EWHC 1383 (Admin) ↗
Refreshed guidance replacing April 2025 version; expands on hallucination and bias risks and reminds judicial office holders not to enter private information into public AI tools. Courts and Tribunals Judiciary: AI judicial guidance (October 2025) ↗
ICO guidance covers AI accountability, transparency and fairness; the guidance is currently under review. ICO: AI and data protection guidance ↗
Article 5 UK GDPR sets out seven principles including data minimisation, accuracy and integrity and confidentiality. ICO: A guide to the data protection principles ↗
Background reading on the broader field of artificial intelligence. Wikipedia: artificial intelligence ↗
Choose your next step
Explore ai for law firms
Start with a topic overview, or go directly to the question your team needs to answer.
AI for law firms
Professional duties, firm policy and training for lawyers.
Start with the decision
More questions in this topic
