The SRA’s warning notice of 17 August 2026 on the misuse of AI, issued after 42 reports between July 2025 and July 2026 and with investigations open into inaccurate legal citations, supervision and confidentiality, makes three things explicit: using AI does not reduce, remove or transfer a solicitor’s professional responsibility; everything put before a court or a client must be checked; and confidential client information must not be entered into AI tools that lack appropriate safeguards. For a small practice that means business-tier tools under a data processing agreement with training switched off, a written policy naming which tools may be used for what, a citation-and-fact check on every AI-assisted document before it leaves the firm, supervision arrangements that cover AI-assisted work as they cover a trainee’s, and a record of all of it. None of that is new law; it is the SRA saying it will enforce existing duties against AI-assisted failures.
- Warning notice
- 17 August 2026
- Reports to the SRA
- 42 in twelve months
- Two concerns
- False content before courts; client data in unsafe tools
What the warning notice says
The notice is addressed to all regulated firms and individuals. Its two stated areas of concern are documents put before courts or others that contain false or incorrect information because AI was misused, and confidential client information entered into AI tools without appropriate safeguards, risking breaches of confidentiality and data protection. It reminds the profession that AI does not reduce, remove or transfer professional responsibilities; that solicitors must check what they put before the courts; that firms must supervise work done for clients, including AI-assisted work; and that firms must maintain effective governance, systems and controls. The SRA’s accompanying release notes the 42 reports and the open investigations. The Risk Outlook report, updated in April 2026, sets out the wider picture, and the Law Society’s guidance covers the practicalities.
The failure modes it is aimed at
Invented authorities: a model asked for cases on a point produces plausible citations that do not exist, and a fee-earner under time pressure files them. Misquoted law: a real case cited for a proposition it does not support. Confidentiality: a client’s letter, a witness statement or a disclosure bundle pasted into a personal ChatGPT or Claude account whose conversations may be used for training, with no processor agreement and retention nobody controls. And supervision gaps: a junior’s AI-assisted draft reviewed less carefully than a junior’s own draft would have been, because it reads fluently. Every one of them is a known failure of the technology meeting an ordinary lapse of process.
A compliant set-up for a small practice
Adoptable in a month, in this order.
- 01
Tools: business-tier Claude, ChatGPT or Copilot under a data processing agreement, training off, single sign-on, retention set. Personal accounts banned in the policy, with the reason.
- 02
Policy: one page naming approved tools, permitted uses (research starting points, first drafts, summaries, correspondence), prohibited uses (final authorities without verification, anything filed unchecked, special-category or privileged material outside approved tools), and the check that must happen before anything leaves the firm.
- 03
The citation rule: every authority cited in an AI-assisted document is verified against the primary source or a recognised database by the person signing it, and the verification is noted on the file.
- 04
Supervision: AI-assisted work is supervised as a trainee’s work would be, and the supervising solicitor knows when AI was used. The firm’s supervision policy says so.
- 05
Client information: privileged and confidential material goes only into approved tools; where a matter warrants it, the AI use is recorded on the file and disclosed to the client in the engagement terms.
- 06
Records: the policy, the processor agreements, training attendance and the checks are kept where the SRA or an insurer can see them.
RelatedAI acceptable-use policy template Is Claude GDPR compliant? A UK guide Is ChatGPT GDPR compliant? A UK guide
What AI is safely good at in a practice
First drafts of correspondence and standard documents from the firm’s precedents. Summaries of long documents for a fee-earner who then reads the parts that matter. Chronologies and bundle indexes. A knowledge assistant over the firm’s own precedents and know-how, answering with the source shown. Client onboarding and document intake, which is administration rather than advice. In each case the model does the reading and the drafting and a solicitor does the judgement and the checking, which is the division the SRA’s notice assumes.
RelatedA knowledge assistant on your own documents AI for law firms AI document processing for a UK SME
Data residency and the questionnaire
Some clients and insurers now ask where client data is processed. Business tiers of the main assistants process in the United States under a lawful transfer mechanism; where a client or a matter requires UK or EU processing, Claude through AWS Bedrock in London or an EU region is the route, and a built knowledge assistant can be architected that way from the start. Record the position once and the questionnaire is a line.
RelatedAI data residency for a UK business A DPIA for AI, with a template
Common questions
What did the SRA say about AI in August 2026?
Its warning notice on the misuse of AI states that AI does not reduce, remove or transfer professional responsibility, that everything put before a court must be checked, that client information must not go into tools without safeguards, and that firms must supervise AI-assisted work. It followed 42 reports in a year.
Can solicitors use ChatGPT or Claude?
Yes, on business tiers under a data processing agreement with training off, within a written policy, with every authority verified and a solicitor accountable for the output. Personal accounts and unchecked output are what the SRA is warning about.
Do we have to tell clients we use AI?
The notice concerns accountability and confidentiality rather than a blanket disclosure duty, but engagement terms that describe AI use, and a file note where it matters, are good practice and answer the question before a client asks it.
How do we stop AI inventing cases?
By rule: every authority in an AI-assisted document is verified against the primary source by the signing solicitor and the verification is noted. No tool setting replaces that check.
Is a knowledge assistant over our precedents allowed?
Yes, on the API or a business tier under a DPA, with sources shown, access limited to the firm, and the same checking rule for anything that leaves the firm.
What should a small firm do first?
Move everyone to business-tier tools, adopt the one-page policy with the citation rule, and brief supervisors. That closes the two concerns the SRA named within a month.