A busy month for AI guidance
October has brought the clearest statement yet of what is expected of firms using AI. On 21 October the Law Society published its practice note, Using artificial intelligence in legal practice, written for every kind of firm. It follows the SRA's warning notice on the misuse of AI in August and the AI section added to the SRA's supervision guidance in June. Behind both sits a run of judgments, beginning with Ayinde in June 2025, in which solicitors have been referred to the SRA for citing authorities that do not exist.
None of this creates a new rule, and that is rather the point. Each document explains how the duties you already owe apply when AI helps with the work. Together they leave little room for a firm to say it did not know what was expected. In this article we summarise what they say and how firms should respond to their requirements.
What the Law Society is saying
For a long document, the practice note has a short message. Using AI does not diminish or transfer your professional responsibilities. You remain accountable for everything delivered to clients, the court and third parties, however it was prepared, and AI has no legal personality to pass that responsibility on to.
The note draws a helpful line between AI in the business of law, such as billing and marketing, and AI in the practice of law, such as research, drafting and client communication. The second engages your regulatory duties far more directly, so it calls for stronger oversight, disclosure and governance.
It is candid about the AI tools used. No AI tool is safe simply because it carries an enterprise label or describes itself as legal-specific, and the SRA does not approve software. The advice is to read the terms of service, check where data goes and whether inputs are used for training, and keep checking, because providers change their terms and add AI features with little warning.
On clients, the note favours transparency over blanket consent. Using AI within your own secure systems, where data is not used for training, is unlikely by itself to need informed consent. Using client information in a way that could breach confidentiality probably does. The terms of business are the natural place for both, and the note suggests asking clients to say when they have used AI.
On fees, where you charge by time you may bill only for time actually spent, including time operating the tool and checking its output, and not for the time the task would have taken without AI.
The note separates supervision, which is about people, from oversight, which is about the work, and it warns about automation bias, suggesting that AI output be treated with the scepticism you would bring to a trainee's draft. It is concerned too that over-reliance may dilute the skills of junior lawyers. Every firm, it concludes, needs some AI governance, ideally a register and a standalone policy, even where AI has not formally been adopted, because staff will use public tools regardless.
The SRA's warning notice
The SRA's approach has not changed since its November 2023 Risk Outlook report. It regulates outcomes rather than systems, it does not approve or certify AI tools, and a named solicitor stays accountable for the result.
What has changed is the tone. In June 2026 the SRA added AI to its guidance on effective supervision, asking firms to think about what effective supervision of AI-assisted work looks like in practice, to subject outputs to human review and professional judgement, and to keep ultimate responsibility with an authorised individual.
On 17 August 2026 came the warning notice on the misuse of AI. A warning notice signals that the SRA will have regard to it when deciding whether to act, and this one concentrates on two risks. The first is hallucinated law finding its way into advice and court documents. The second is confidential client information entered into tools without proper contractual and technical safeguards, with the warning that privilege may be permanently waived.
The notice ties these risks to Principles 1, 2, 4, 5 and 7 and to the Codes of Conduct, citing the duties not to mislead, to the court, of competence, supervision and confidentiality, and the duty to justify your decisions. Managers are jointly and severally responsible, and the COLP must take all reasonable steps to secure compliance. The SRA received 42 reports of potential AI misuse in the year to July 2026 and has investigations under way. Reliance on AI, it says, is not a defence.
In the courts
The judiciary's own AI guidance, refreshed in October 2025, tells judges to treat anything typed into a public chatbot as published to all the world, and says they may ask a legal representative to confirm that citations have been independently verified. There is no duty to tell the court you used AI, but you need to be able to answer that question truthfully.
The case law has moved from warning to referral. In Ayinde v London Borough of Haringey and Al-Haroun v Qatar National Bank [2025] EWHC 1383 (Admin) the Divisional Court faced five invented authorities in one case and eighteen in the other. It found that the threshold for contempt had been met, chose not to proceed on those facts, and made clear it was not a precedent. Anyone using AI for research, it said, has a professional duty to check it against authoritative sources before relying on it. Sanctions run from admonishment through wasted costs and regulatory referral to contempt and the police.
UK and R (Munir) v Secretary of State for the Home Department [2026] UKUT 81 (IAC) brought supervisors into the frame. A trainee's grounds cited authorities that did not exist, and the supervising solicitor had signed the statement of truth. The Upper Tribunal said a supervisor who fails to check a junior's work is likely to be more culpable than a lawyer who fails to check their own, and referred the solicitor to the SRA. It also observed that uploading confidential documents to a public tool such as ChatGPT places them in the public domain, breaches confidentiality and waives privilege.
Nor is the problem confined to case law. In Cork v Smith [2026] EWHC 1199 (Ch) a letter from a national firm quoted words from the Insolvency Rules 2016 that the judge could not find in the rules at all. Evidence is the newest front. In R v FGD [2026] EWCA Crim 918 the Court of Appeal confirmed that coaching a witness by any means, including AI, is not permitted, and said witnesses should be firmly discouraged from using AI to prepare to give evidence. The Civil Justice Council is now considering a declaration that AI has not been used to generate or alter a witness statement.
The legal framework
There is no AI statute for legal practice, and none is needed to make these duties bite. Data protection law does most of the work. Every prompt containing client information is a processing activity. An enterprise AI supplier is usually a processor, which means an Article 28 contract, safeguards for any transfer outside the UK, and a privacy notice that says AI may be used. New high-risk processing calls for a data protection impact assessment first.
The Data (Use and Access) Act 2025 changed the rules on automated decision-making from 5 February 2026. Decisions with legal or similarly significant effects may now be made solely by automated means in more situations, but only with the safeguards in the new Articles 22A to 22D of the UK GDPR, including the right to human intervention.
Confidentiality and privilege rest on the common law and the Codes rather than statute, but Munir shows how quickly both can be lost. Documents disclosed in litigation may be used only for the proceedings under CPR 31.22. The Equality Act 2010 reaches biased outputs in recruitment, onboarding and service delivery. The Insurance Act 2015 requires a fair presentation of risk to your insurer, which is hard to give without knowing how your own firm uses AI. And if you act for clients in the EU or deploy tools there, the EU AI Act's phased obligations may reach you as well.
What it adds up to
The same handful of expectations runs through all of these documents. Know which tools your people use and approve them on terms you have read. Let nothing produced with AI reach a client or a court until someone has checked it against a primary source. Keep client information out of public chatbots and inside tools with proper safeguards. Make sure supervisors know when AI has been used and look at the work before it leaves the firm. Tell clients, in your terms of business, how you use AI and what you will not do with their information. And keep records that would let you answer a judge, the SRA, a client or your insurer if something went wrong.
None of that calls for a technologist. It calls for a policy, terms of business and a supervision habit.
Looking ahead
The direction of travel is clear. The Law Society has said that professional responsibility is central but not sufficient on its own, and it expects targeted transparency rules where AI touches evidence or the substance of court documents. The Civil Justice Council's final report is due before the end of the year. The SRA has open investigations and a notice it can now point to, and judges have the guidance and the appetite to refer.
A firm that adopts a policy, updates its terms of business and builds AI into its supervision routine will be well placed for all of that. A firm that waits is relying on nobody pasting a client's file into a chatbot, and on nobody ever being asked in court whether a citation was checked. That is not a comfortable position.
Subscribers to the Infolegal Infohub have access to an Artificial Intelligence Use Policy, and AI additions to terms of business. For more information, please contact enquiries@infolegal.co.uk.
