AI for law firms: a practical UK guide for small firms

What does "AI for law firms" actually mean?

For a small firm, it means software that can read and write, used on the routine parts of the job. That might be drafting a first reply to an enquiry, pulling the dates out of a document or summarising a long email thread. Automation is the plumbing that moves the result into your case management system, your inbox or your diary.

It is worth keeping two things apart. Legal-specific platforms are sold to firms as research, drafting and review tools. General assistants such as ChatGPT or Claude are built for everyone. I do not sell either kind. I build the connecting work around a firm's own systems, and I am not a solicitor, so nothing here is legal advice.

The rest of this guide covers what the regulators say, where AI helps a small firm, where it does not, and how to keep client information safe. The regulatory points are as of October 2026 and they are changing quickly, so check the linked pages for the current position before you rely on them.

Are law firms allowed to use AI?

Yes. Nothing I found says solicitors may not use AI. The Law Society's guide says professional duties apply whether or not AI was used, and it describes how generative AI can create "technology and data risks" as well as new possibilities (Law Society, "Generative AI: the essentials", updated June 2026). The Solicitors Regulation Authority (SRA) has published a warning notice on misuse and a set of compliance tips. The Law Society's guide also says there is no AI-specific regulation in the UK at present.

The practical result is that you do not need a new rulebook to start. You need to apply the rules you already work under to a new tool. The next three sections go through the ones that come up most.

What does the SRA say about using AI?

The SRA's warning notice on the misuse of AI applies to all the firms and individuals it regulates. It is short and direct. Its main concerns are inaccurate court documents and citations, and client confidentiality. These are the points I would take from it.

• Responsibility stays with you. AI has no legal personality of its own, so solicitors remain "accountable for their work and outputs". Using AI does not move professional responsibility elsewhere.
• Check every citation. The notice says case law should be genuine, relevant and have a verifiable citation, and that relying on AI is not a defence if a false citation reaches the court.
• Supervision still applies. Anyone who supervises junior or non-authorised colleagues remains accountable for the work done through them, with paragraph 3.5 of the Code of Conduct cited.
• Have systems and controls. Firms need "effective governance structures, systems and controls in place to manage any risks" from AI.
• Have proper regard to the notice. The SRA says that if you fail to, you are at risk of disciplinary action.

The SRA's separate compliance tips page adds a few practical lines. If a product uses AI, know your obligations. Tell clients when they are dealing with AI. Keep your governance arrangements fit for purpose, and make sure your COLP (the compliance officer for legal practice) is responsible for regulatory compliance when you bring in new technology. It also says to be clear about what you want a product to do before you buy it.

The notice does not tell firms exactly when to tell clients about AI use, so that is a decision to make with your own advisers or the SRA's guidance in front of you. Being open with clients is the direction the compliance tips point in.

The Code text is quoted from the SRA's published Code of Conduct for Solicitors, RELs, RFLs and RSLs, which the SRA says is in effect from 11 April 2025. The table is my plain-English reading of how those rules meet AI, not an official interpretation.

What does the Law Society say?

The Law Society's guide, "Generative AI: the essentials", is written for solicitors and their staff, and says it is particularly useful for small and medium-sized firms. It states that it does not constitute legal advice. It sets out a checklist for firms thinking about generative AI. I have paraphrased the parts most relevant to a small firm.

• Define the purpose and the use cases for the tool, and the outcome you want.
• Follow your professional obligations under the SRA Code of Conduct, Standards and Regulations and Principles, and any relevant guidance from regulators and the courts.
• Review the vendor's data management and security regularly.
• Find out whether the tool is a closed system within your firm's boundaries or also operates as a training model for third parties.
• Think about what input data you are likely to use and whether it is appropriate to put it into the tool.
• Establish the liability and insurance position, and document inputs, outputs and errors.
• Review outputs for accuracy and factual correctness, including checking for bias.

Most of that is questions to ask a supplier, not anything technical. A firm that can answer them in writing is in a much better place than one that has simply let people try free tools.

Can staff paste client information into ChatGPT?

Not into any AI tool, free or paid, without checking first. The SRA's warning notice says client information should only be entered into AI systems where there are proper safeguards, and that information put into some tools may be stored, retained or used to improve the tool. It warns that putting client information into an open tool risks a breach of confidentiality and, in the worst case, loss of privilege.

The Upper Tribunal (Immigration and Asylum Chamber) said in UK and R (on the application of Munir) v Secretary of State for the Home Department [2026] UKUT 81 (IAC), promulgated on 17 November 2025 and cited in the SRA notice, that putting client letters and Home Office decision letters into an open source AI tool such as ChatGPT places that information on the internet in the public domain, breaching client confidentiality and waiving legal privilege.

This is the "shadow AI" problem. It usually does not start with a firm choosing to take a risk. It starts with a busy fee earner who finds a tool that saves an hour. The fix is a short written rule, a tool the firm has approved, and a reason for people to use it.

How do you keep client data private when using AI?

Start with where the data goes, then what the supplier is allowed to do with it. There are three levels, from simplest to most controlled.

1. Keep client data out of it. Use AI only on information that is not confidential, such as your published fee guide or a blank engagement letter template. This is the lowest risk and still useful.
2. Use a business account with proper terms. Business plans from the main AI providers set out how your data is handled. I only use business API accounts, whose terms say your data is not used to train their models. Read the terms yourself, or have me walk you through them, and keep a record of what you checked.
3. Use a private AI set-up for client files. A private assistant searches your own documents and precedents, with access limited to the people you choose, rather than sending them to a public chatbot. See private AI assistants for how this works.

I want to be precise about where data sits in my builds. Client data is stored in the UK. The AI models themselves run through APIs hosted in Europe, which is the best available option for the models I use. That is not the same as saying the AI is hosted in the UK, and a firm with strict requirements should ask any supplier, me included, exactly where each step happens.

If you ask, I will sign a data processing agreement before any work starts. I hold professional indemnity insurance. Your own firm's insurance is a separate question, so check that your policy covers the way you use AI.

For data protection law, the ICO's guidance on AI and data protection is the official starting point. It was last updated on 15 March 2023 and the ICO says it is under review because of the Data (Use and Access) Act, so check its current status before relying on it.

What should a small law firm automate first?

Start with the admin that surrounds the legal work, not the legal work itself. These jobs repeat in the same shape, carry the least risk if an error slips through, and take time from fee earners every week.

• Out-of-hours enquiries. A new enquiry gets a prompt acknowledgement with your published fee guide and a link to arrange a call, rather than waiting until Monday.
• Intake. Questionnaires and document requests are sent, chased and filed against the right matter, and the details are copied once into your practice system.
• A weekly summary. Enquiries received, how many were answered and work waiting to be billed, in one short email.
• Finding your own know-how. A private assistant that searches your firm's precedents and guides, limited to people you choose.
• Reminders and chasing. Overdue documents, unsigned forms and appointment reminders go out on a schedule.

For each of these, the AI does a narrow job from rules and information you give it, and a person approves anything that goes to a client until you are happy to relax that. The AI never gives legal advice. It shares your fee guide and practical next steps, and passes anything unusual to a person.

To see how this could look, there is a worked example for a fictional high-street firm on the page for AI for small law firms. It is illustrative and not a real firm. Because every firm's systems differ, I look at yours before I quote anything.

What should you not hand to AI?

Anything that needs a solicitor's judgement, and anything where being wrong has serious consequences. That includes legal advice, conflict decisions, and what goes into a pleading or a witness statement. The SRA and the Law Society are both clear that accountability stays with the solicitor.

• Giving advice or opinions to clients.
• Deciding whether there is a conflict of interest. AI can flag a possible match for a person to check, and no more.
• Legal research that goes into court documents, unless every authority is checked against a reliable source.
• Anything involving client money.
• Replying to a client who is upset, vulnerable or in a hurry.

The Law Society guide warns about output integrity, meaning the chance of misleading, inaccurate or false answers, and about bias in training data. Those are good reasons to keep a person between the tool and the client.

What is the risk of AI inventing case law?

It is the best documented risk, and it has already reached the courts. A generative AI tool can produce a confident answer that cites a case which does not exist. In R (Ayinde) v London Borough of Haringey [2025] EWHC 1383 (Admin), decided on 6 June 2025, the Divisional Court dealt with fictitious citations in two separate matters.

The court said freely available generative AI tools "are not capable of conducting reliable legal research" and that lawyers must check AI-generated research against authoritative sources before relying on it. In one case, five cited cases did not exist. In the other, 18 of 45 cited authorities did not exist, and many others did not support the points they were cited for.

The court also said that people with leadership responsibilities, such as managing partners, must take practical and effective measures to make sure lawyers understand and follow their duties, and that issuing guidance alone is not enough. It said a regulator referral is likely to be appropriate where false citations are put before a court. The court referred the matter to the SRA in relation to two solicitors, one in each matter.

How do you adopt AI safely in a small firm?

Treat it like any other change to how the firm handles client information. These steps reflect the Law Society checklist and the SRA's compliance tips, in an order that works for a small team.

1. Pick one job. Choose a low-risk, repeat task, such as acknowledging enquiries, and write down what a good result looks like.
2. Decide who is responsible. Your COLP or a named partner owns the decision, as the SRA says compliance should be owned when new technology comes in.
3. Check the supplier. Ask where data is stored, where the AI processing happens, whether your data is used to train models, and what you get in writing.
4. Keep a person in the loop. Start with every client-facing message approved by a person. Relax this only for fixed items such as your fee guide.
5. Brief the team. A one-page rule on approved tools and what never goes in, plus a short session on checking AI output.
6. Review after a month. Look at the log of what the tool did, correct anything that was wrong, and decide whether to extend it.

If you want help working out where to start, my AI audit is a short written review of your jobs, tools and data, from £495. You will find what it covers on what is an AI audit. It can also say that nothing is worth automating yet.

What does it cost?

An AI audit is from £495, builds are from £1,500, and support is from £95 a month. These are starting prices, not fixed ones. What you pay depends on how many systems and document types are involved, and everything beyond the starting prices is quoted after the call. If you go ahead with a build within 60 days of the audit, the audit fee comes off the price. A build is paid half at the start and half at go-live.

Support covers monitoring, fixes and up to an hour of changes a month, with one month's notice to cancel. See pricing for the detail.

A build can be set up in your own n8n, Make or Zapier account, so you own it, or I can manage it for you on a care plan. Ask on the call how each works, including what happens if you want to leave.

Should a small firm wait to see what happens?

There is a fair case for starting small rather than waiting. The Law Society points out that many solicitors and firms are already using tools to improve service, reduce costs and meet new client demands. And staff may already be using AI tools on their own, which is the riskiest option because the firm has no say in what goes in. A short approved list and a rule is safer than silence.

There is also a fair case for waiting on anything that touches advice or court documents. The sensible middle is to automate the surrounding admin now, keep a person in charge of the legal work, and revisit as the regulators update their guidance. If you are not sure, my guide to AI for small businesses covers where any small business should start, and the AI for accountants guide covers similar ground for another regulated profession.