Introduction
The Solicitors Regulation Authority (SRA) has published a warning notice dealing with the misuse of artificial intelligence. It is the regulator's most significant statement yet on a technology that has moved, in a remarkably short time, from novelty to necessity in legal practice.
Not that the SRA is warning firms off AI. Quite the opposite. In a press release about the warning notice, Executive Director, Aileen Armstrong, is at pains to stress that 'AI is already benefiting consumers and legal professionals, and we are increasingly seeing firms use it in innovative ways to improve services and efficiency.' However, use of AI does come with a significant health warning in that the SRA is still warning that 'the use of AI does not change the professional standards expected of solicitors and law firms.'
The number of reports referred to in the news release explain why the SRA feels that such a warning notice is necessary. Between July 2025 and July 2026, it received 42 reports involving the potential misuse of AI, and several investigations are ongoing relating to inaccurate legal citations put before courts, failures of supervision, and breaches of confidentiality. The notice says expressly that those who fail to have proper regard to it are 'at risk of disciplinary action'. Firms should consider themselves suitably warned.
What the warning notice says
The notice applies to all firms and individuals regulated by the SRA. It defines AI broadly — technology that operates with a degree of autonomy and produces outputs that were not directly programmed — with generative AI, the kind that produces text, code or images in response to a prompt, as the particular variety of AI causing most of the current difficulty.
Two risk areas are most important. The first is hallucination. This is the tendency of generative AI tools to produce confident, plausible and entirely fictitious material, including invented cases and citations. This is something that has already been addressed by the courts. In R (Ayinde) v Haringey LBC [2025] EWHC 1383, false AI-generated citations led to wasted costs applications and referrals to the regulator. Other cases have addressed very similar points including BCP v A Mother [2026] EWFC 71 which addressed the situation where there was no deliberate intent to mislead and Cork v Smith [2026] EWHC 1199 where the court again reiterated the responsibilities on authorised persons, and the view that the courts will take when errors are made which can be attributed to unchecked AI hallucinations. All three cases are referred to in the warning notice.
The second risk area is confidentiality. Client information entered into a public AI tool may be used to train the model, may be accessible to the provider, and — as the Upper Tribunal stated in the 2026 decision in UK v Secretary of State for the Home Department [2026] UKUT 81 (IAC), 'to put client letters and decision letters from the Home Office into an open source AI tool, such as ChatGPT, is to place this information on the internet in the public domain'.
None of this is based on new rules. The warning notice simply maps AI use onto the existing framework. Thus, it engages the Principles (upholding the rule of law, public confidence, honesty, integrity, and clients' best interests); paragraphs 1.4, 2.4, 3.2, 3.5 and 6.3 of the Code of Conduct for Solicitors — not misleading the court, only advancing properly arguable assertions, delivering competent service, supervising effectively, and keeping client affairs confidential; and, for firms, paragraph 2.1 (governance and risk controls), paragraph 4.4 (effective supervision systems) and paragraph 9.1 (the COLP's compliance responsibilities).
The notice's central proposition could hardly be plainer: AI has no separate legal personality, and using it 'does not reduce, remove or replace' the solicitor's own professional responsibility. It should be read alongside the SRA's supervision guidance, updated in June 2026 with new AI-specific sections.
The practical issues
For most firms the difficulty is not the principle but the practicalities. Three points deserve particular attention.
1. You are almost certainly using AI already — the only question is whether you know it
The firm most at risk is not the early adopter but the firm that believes it has no AI exposure. Generative tools are now embedded in ordinary office software, search engines, dictation products and practice management systems, often switched on by default. Therefore, whatever the official position, staff will be using free public tools on their own initiative — to summarise a document, draft a difficult letter, or check a point of law. This 'shadow' use is precisely where the confidentiality and hallucination risks are greatest, because it happens outside any firm oversight. Paragraph 2.1 requires firms to have governance arrangements that manage their risks; a firm cannot manage a risk it has never mapped. An honest audit of what is actually in use, by whom and for what, is the essential first step.
2. Verification of output is vital
The notice is emphatic that human review must come before any reliance on AI output, and that case citations must be independently verified against primary sources before they go anywhere near a court. From a costs point of view this is not going to be a popular view since the time saved in generation is partly lost in checking. However, and a firm whose fee-earners treat AI output as finished work product has misunderstood the tool. The SRA expects a proportionate, risk-based approach to be taken. Thus the checking that is appropriate to a skeleton argument will not be the same level of checking as is appropriate to an internal first draft. However, 'proportionate' does not mean the same as 'optional', and Ayinde case referred to above shows what the disproportionate consequences of skipping that checking can look like.
3. Supervision, and the free tool problem
The keenest users of AI in most firms are the most junior, and paragraph 3.5 makes supervisors accountable for the work they oversee. Senior lawyers cannot sign off work without understanding how it was produced. On confidentiality, the practical dividing line is contractual: client information should only enter systems with appropriate contractual protections, where the firm has confirmed that inputs are not used for model training and remain within a secure environment. Free consumer tools rarely satisfy any of that. If the firm wants its people to have the benefit of the technology, the answer is to provide a properly procured route — because prohibition without an alternative is what drives use underground.
What firms should do now
The sensible response is neither to panic nor to prohibit. Firms should:
- circulate the warning notice and the updated supervision guidance to partners, fee-earners and the COLP, and record that this has been done;
- audit the AI actually in use across the firm, including tools embedded in existing software and informal use of public tools;
- adopt or refresh an AI policy covering approved tools, prohibited uses, client confidentiality and a mandatory verification step for research and citations;
- build AI into supervision and training arrangements, so that junior staff know both what is permitted and why; and
- for firms developing their own AI applications, note the SRA's AI Growth Lab, for which applications close on 27 September, and the strengthened Innovate support promised in the 2026/27 business plan.
The SRA's position is, in truth, a reasonable one. It has resisted the temptation to write an AI rulebook, and instead reminded the profession that the existing one already covers the ground.
Firms that adopt AI deliberately — knowing what they use, checking what it produces, and protecting what goes into it — have little to fear from this notice and much to gain from the technology. The 42 reports suggest that the firms that are in difficulty are not those intentionally using AI, but those using it without noticing, without checking, or without telling anyone.
The warning notice concludes by stating that “Using AI tools in the course of your work does not reduce, remove or replace the professional, regulatory or legal responsibility you have for the quality and accuracy of service and information delivered to your clients, the court, third parties or your regulators. If you fail to have proper regard to this warning notice, you are at risk of disciplinary action.”
