A managing partner at a 12-person conveyancing firm found out, during a routine team meeting, that three fee-earners had been using ChatGPT to draft client letters for the past four months. Nothing had been agreed. Nothing was documented. Nobody had checked whether client details were entering a public system that stored prompts and could use them to train future models. The SRA had already published warnings about exactly this kind of uncontrolled use.
Getting ahead of that risk is achievable in weeks. A workable AI policy for a practice of 5 to 50 people is a focused document, a small governance group, and a short pilot.
What does a workable AI policy for a UK law firm actually include?
A workable AI policy for a 5-50 person practice covers six elements: approved tools, prohibited tools, permitted data categories for each tool, human-review requirements before any output reaches a client, an escalation path when something goes wrong, and a review schedule. The SRA has stated that use of AI does not reduce a solicitor’s professional obligations, and it expects firms to have both policies and training in place before deploying these tools.
The document itself can be three to six pages. Start with a risk appetite statement, something like: AI is used as a drafting and summarisation assistant only; no AI-generated legal advice letters leave the firm without partner review; no client-identifiable data enters any public tool. That short statement does most of the governance work.
Nominate an AI lead before writing a word of the policy. In a practice of this size, that is typically the managing partner, the COLP, or a senior partner with a risk brief. The ICO’s guidance on AI accountability requires that a named person owns the compliance decisions, not just the policy document.
The UK Government’s AI Playbook sets out ten principles for safe and responsible AI use that translate directly to a small professional-services firm, including using the right tool for the job, ensuring meaningful human control, and managing the AI lifecycle with documentation.
Why do law firms need one now rather than waiting for regulations to settle?
The SRA, ICO, NCSC, and professional indemnity insurers have each published AI risk guidance since 2023, without waiting for a single consolidated framework to arrive. In 2024, the English High Court considered a case involving an £89m claim in which 18 of 45 cited authorities were fictitious, apparently generated by an AI tool, and the presiding judge warned that lawyers misusing AI faced sanctions up to contempt proceedings.
The financial exposure carries real penalties. UK GDPR allows the ICO to fine up to £17.5 million, or 4% of worldwide annual turnover, for serious infringements including unlawful processing and security failures. Professional indemnity insurers, including Travelers, have begun issuing risk bulletins warning that unstructured AI use involving client data in public tools could affect coverage where firms have failed to follow basic risk management practice.
The legal tech consultancy 14OhFour has noted that many UK firms currently lack even basic AI policies covering which tools are permitted, how outputs should be verified, or what the documentation requirements are. That gap increases professional liability exposure. With the SRA, ICO, and insurers all publishing AI guidance now, an absence of policy is harder to justify after any incident.
Where do the real governance gaps appear in practice?
A frequently cited gap in legal practices is using public AI tools without controlling what data enters them. Consumer-grade tools may store prompts and use them for model training. A fee-earner who pastes a client matter summary into a public tool to speed up a letter has potentially triggered a data protection issue, without realising it. The NCSC has been explicit about this risk since publishing its guidance on generative AI in 2023.
A second gap is the absence of clearly defined no-go zones. Without an explicit prohibition on AI-generated citations entering court documents without verification, or AI-produced advice letters going out without partner review, individual fee-earners are left to judge for themselves. The High Court incident demonstrates where that leads.
The third gap is running AI as a purely operational or IT project without compliance input. Deploying a tool that handles client data without involving the COLP, COFA, or data protection officer means the firm’s accountability chain is broken before anything has gone wrong. Both the SRA’s supervision standards and the ICO’s accountability guidance require that someone with authority over risk is part of the decision.
UK firms with EU-facing work face an additional consideration. The EU AI Act, agreed in 2024, classifies some AI used in legal services as high-risk and requires risk management, data governance, and human oversight. Firms serving EU clients may need to map their AI uses against those categories regardless of where the firm itself is regulated.
When should you expand AI use and when should you hold back?
Start with low-risk, internal tasks and run a short pilot before extending the policy across the whole practice. The UK Government AI Playbook recommends short, focused sprints with lightweight feedback mechanisms, and legal sector guidance from Gowling WLG describes this as the “assistant zone”: first-draft writing, document summarisation, clause drafting from playbooks, and internal research notes, all with a named lawyer reviewing and signing off the output.
A six-to-eight-week pilot with five to ten users and a 60-90 minute training session works well. Cover three things in the training: approved prompts and workflows, what users must verify before any output leaves the firm, and what they must never enter into the tools. SRA guidance on supervision and competence applies here; the standard for AI-assisted work is the same as for any delegated task.
Track three simple metrics over the pilot period: the average time to produce a first draft, the number of material corrections per AI-assisted document, and any incidents such as hallucinated citations or near-misses on data handling. Use those to decide whether to expand the rollout, change tools, or tighten controls.
Hold back on: any use involving unsupervised legal advice, automated decision-making affecting clients, or client-identifiable data in a public tool without a DPIA completed. These sit outside the assistant zone and carry a risk profile that a policy statement alone cannot manage.
What sits alongside the policy itself?
An AI policy is the governance layer, but three complementary steps make it work in practice. A Data Protection Impact Assessment is required under UK GDPR before deploying AI that processes personal data in high-risk contexts, such as client onboarding screening or AI-assisted HR decisions. Updated confidentiality and IT policies must explicitly prohibit copying client documents into unapproved tools.
Vendor contracts for any managed cloud AI service also need data-processing agreements confirming that client data will not be used for model training.
A small AI working group makes the governance arrangement concrete. Three roles cover the ground: a partner or owner for policy authority, a fee-earner who uses AI tools regularly, and someone from operations, IT, or risk. This mirrors the structure that 14OhFour reports in practices where AI adoption has held. The group does not need to meet weekly; monthly for the first six months, then quarterly once the pilot has settled.
The NCSC recommends strong authentication for AI platforms, restricted admin access, and monitoring logs for unusual access or data export. For many small practices, these requirements are already met by existing IT security arrangements, with AI systems added to the same access-control scope.
Plan for quarterly policy reviews during the first year. Both the SRA and ICO continue to update their guidance as tools and use cases develop. A policy written in 2024 may need revision by 2026, and a scheduled review is easier to defend to regulators than a document that was produced once and never revisited.
