The brief landed in the new year. Roll out the AI drafting tool across the practice by the end of Q1, track adoption, report back. It seemed straightforward enough until someone on the team asked a question nobody had anticipated. What happens if one of these outputs gets to a client without a qualified person reviewing it first?
That question has a specific answer. Both the SRA and the firm’s professional indemnity insurer have given it.
What is the professional indemnity line AI cannot cross?
In law and accountancy, the qualified professional retains full responsibility for every output leaving the firm, regardless of who or what produced the first draft. An insurer can argue that no professional service was rendered if a practitioner relied on AI output without reviewing it. The line is drawn at accountability. A named, qualified person must own every piece of advice before it reaches a client.
The SRA’s 2026 compliance guidance is explicit on this. Solicitors must maintain overall responsibility for all technology outputs and keep client best interests at the centre of every technology decision. The guidance also requires that the Compliance Officer for Legal Practice (COLP) holds regulatory accountability when new technology is introduced. The SRA permits AI use. The condition it places around that permission is that the solicitor’s accountability does not transfer to the tool.
ICAEW’s 2026 guidance takes the same position for accountants. Even when an agentic AI system handles analysis and drafting, the accountant remains responsible for the output. The question the firm must answer before any tool goes live is not whether the AI can do the work, but who in the firm is signing off that it is accurate and that the professional judgement behind it is theirs.
Why does this matter if you’re rolling out AI across the firm?
A single unsupervised output carries three overlapping stakes. A regulator referral, a professional indemnity dispute, and reputational damage in a sector built on client trust. The duty of care runs alongside the AI mandate, not beneath it. Getting governance right from the start is more urgent than the brief made it sound.
The Utah Bar’s analysis of professional liability in the generative AI era makes the exposure mechanism clear. Professional liability policies typically do not exclude AI-related claims outright, but coverage depends on whether the lawyer exercised reasonable care and due diligence. A practitioner who accepted AI output without checking it gave the insurer a credible argument that no professional service was performed. That is not cover reduced. That is a claim that may not be paid.
The risk does not rest with the tool vendor. US federal courts have sanctioned attorneys for submitting AI-generated case citations that did not exist. In those cases, liability sat with the lawyers and their firms. The AI provider was not in the frame. Professional liability guidance from state bar associations and the SRA’s 2026 guidance reach the same conclusion. Where AI-generated content reaches a client and turns out to be wrong, the exposure rests with the professional. A delegate rolling out AI firm-wide needs governance in place before the first output goes anywhere.
Where in your workflows does the line actually sit?
The line sits differently depending on what the AI is doing. Extraction and summarising carry lower risk, because the professional can check accuracy against the source document before anything goes anywhere. Drafting, analysis, and any output forming the basis of advice to a client carry higher risk. These need a named reviewer before they leave the building.
A useful test is whether the output could reach a client without anyone reading it first. If that can happen by accident, the process is wrong. If the workflow requires a sign-off step to prevent it, the process is defensible.
Conflict-of-interest screening, routine document classification, and internal research summaries sit at the lower end. A qualified professional should still spot-check, but a missed error is recoverable before it has client impact. Contract review output, legal advice memos, accountancy opinions, and any client-facing draft sit at the higher end. These need a named reviewer, a completed check, and a record that the review happened.
The Clio 2025 Legal Trends Report found that smaller law firms are adopting generic AI tools at a higher rate than sector-specific platforms, often because of cost and ease of access. Generic tools do not prompt for sign-off. The compliance gap that creates sits precisely at this difference, and it is the gap a delegate rolling out AI firm-wide is responsible for closing.
What does a review protocol look like in practice?
A review protocol that satisfies both the SRA and a professional indemnity insurer needs four things logged against every AI-assisted output with client impact. The tool used, the name of the qualified reviewer, the checklist completed before sign-off, and any corrections made between the AI draft and the version sent. The audit trail is what the regulator and the insurer are both looking for.
The CPA.com 2025 AI in Accounting framework describes this as a human-in-the-loop model where every AI-driven decision is logged, timestamped, and attributed to a named reviewer. The value extends beyond compliance. When a client challenges advice or an insurer reviews a claim, the firm can reconstruct what the AI produced, who reviewed it, and what changed before it went.
A practical starting point is a single-page checklist attached to every client-facing AI output as a required step in the matter management workflow. The questions are narrow. Did a qualified person read the output and check it against the source material? Were corrections logged before it went? Those records are what the regulator and the insurer both look for when a complaint arrives. The AICPA’s guidelines for responsible AI use in professional services reach the same conclusion. The professional must validate findings and attest to the quality of work. The AI produces the draft; the professional owns the output.
The SRA is also explicit on a separate but connected point. Solicitors must not feed confidential client information into public cloud-based AI tools without safeguards in place. A confidentiality breach arising from a deliberate upload of client data to an unsecured platform may fall outside professional liability cover entirely, which makes the tool choice part of the governance question, not separate from it.
What else connects to the PI question?
Three related governance areas come up regularly when professional services firms formalise their AI use. Data confidentiality, senior accountability assignment, and the distinction between regulated and unregulated tasks all connect directly to the professional indemnity question. Getting the sign-off protocol right is the most urgent step, but these three areas determine whether the protocol holds under pressure.
Data confidentiality and public AI tools
The SRA is clear that client confidential information must not go into public AI tools without proper safeguards confirmed. A firm that has its sign-off protocol in place but is still allowing fee earners to paste client matter details into an unprotected model has a different problem, and one that PI cover may not address. The ACCA’s AI governance framework flags this as a distinct risk layer. Data handling controls and model vendor agreements sit upstream of the sign-off question and need to be in place first.
COLP and senior accountability
The SRA places regulatory accountability for technology use with the COLP, not with whoever chose the tool or drafted the rollout plan. If the delegate is building the governance framework, the COLP needs to be part of the design conversation from the start. A framework handed to the COLP for sign-off at the end is not the same as one built with them. The distinction matters when a complaint arrives.
Regulated versus unregulated tasks
Not every AI task in a professional services firm sits inside the regulated service. Marketing copy, internal reports, administrative drafts, and general research sit outside the chain that creates professional liability. Knowing which tasks need the sign-off requirement and which do not keeps the protocol proportionate and keeps adoption moving. Applying the full checklist to a staff newsletter is waste. Missing it on a client advice memo is exposure. The difference between the two is the governance framework the delegate builds.
