A managing partner of a fifteen-person high-street firm asked me last month whether her team could keep using ChatGPT for first-draft client letters. She had read about the SRA authorising an AI-only firm and wanted to know if that meant she was suddenly behind. Her COLP, she said, was more worried about the opposite, that the trainees were already pasting client correspondence into a consumer tool with no policy in sight. Both of them were right to be uncertain.
The Solicitors Regulation Authority has been clear about what it expects, but the answer is scattered across compliance tips, an AI risk outlook, two precedent authorisations and a handful of cross-references to other regulators rather than a single rulebook. For an owner-managed firm trying to make a sensible call before the next compliance review, that scatter is a problem. The picture below pulls the load-bearing parts together, what the regulator has said, who carries the accountability inside the firm, what the two approved AI firms actually look like, and what a five to fifty person practice should have in place to meet the standard the SRA has set.
What has the SRA actually said about AI?
The SRA’s position is that solicitors and firms may use any technology they think appropriate, including AI, so long as they comply with the existing Principles and Codes of Conduct. There is no separate AI rulebook and the regulator has said it does not intend to write one. AI has to fit inside the existing duties of competence, confidentiality, integrity and client best interests.
The compliance tips for solicitors and the AI Risk Outlook set out how the regulator reads those duties when AI is involved. That framing matters because it tells you where to look when you are deciding whether a use case is acceptable. The question is never “is this AI allowed”, it is “would a competent solicitor doing this work by hand be acting properly”. If yes, the AI version needs the governance, supervision and confidentiality controls to match. If no, AI does not rescue it.
Who is on the hook inside the firm?
The SRA expects, at minimum, the Compliance Officer for Legal Practice to take responsibility for regulatory compliance when new technology is introduced, with the board taking ownership of purchasing decisions and ongoing use. The COLP needs to know what is being deployed, what data it touches, what policies sit around it, and who signs off on each output that reaches a client. That is a governance role, not a coding role.
In practice this means three things. The board signs off on what tools the firm buys and what it allows. The COLP runs the risk and impact assessment, the written policy, the training and the monitoring. The fee-earner using the tool is accountable for the work in front of them, with a regulated solicitor reviewing and approving every output before it leaves the firm. None of that requires the COLP to write prompts or read model documentation, it requires them to own the framework.
What do the approved AI firms tell us?
Two firms have been authorised so far. Garfield.Law was approved on 6 May 2025 as the first AI-driven law firm in England and Wales, guiding users through small-debt claims up to £10,000. LawFairy was authorised in February 2026 to deliver immigration services entirely through AI, analysing visa eligibility, sponsorship and citizenship routes. Both went through the standard authorisation route, not a special sandbox.
What is striking is how narrow the permitted scope is. The SRA has been explicit that AI-led delivery is acceptable for “narrow, standardised areas of law” and should not be read as endorsing AI as a general replacement for solicitors. Garfield.Law had to put in strong confidentiality protection, conflict checks, user approval at each stage, and a technical bar preventing the model from proposing case law to control hallucination risk. Regulated solicitors remain accountable for every output. LawFairy’s system structures evidence and flags cases needing human input, particularly where Article 8 ECHR proportionality is involved, and users can invite a regulated adviser at any stage with one click. The pattern in both is the same, automate the rule-based parts, escalate the judgement parts, hold a named human accountable.
Where do the ICO, NCSC and EU rules fit?
The SRA is not the only regulator a firm has to satisfy. The ICO has confirmed that UK GDPR applies in full to AI processing of personal data, requiring a lawful basis, a Data Protection Impact Assessment before high-risk deployment, and safeguards when personal data goes to a third-party LLM. Pasting client information into a consumer chatbot without contractual controls is the fastest way to land in trouble.
The NCSC’s guidance frames AI tools as new attack surfaces, prompt injection, data exfiltration through model outputs, weak access controls, and recommends treating AI deployments as additions to the cyber-risk register rather than just another app. The EU AI Act sits behind all of this for firms with EU-facing work. It classifies certain AI used in legal decision-making as high-risk and imposes risk management, data governance and human oversight obligations that reach UK firms serving EU clients or using EU-provided AI tools. A firm that ignores any of these three undermines the SRA’s expectation that the firm understands the legal framework around its AI use.
What does a sensible baseline look like for a small firm?
For a five to fifty person practice the practical baseline is organisational rather than technical. Maintain an AI register that lists every tool the firm uses, what it does, what data it touches and who owns it. Carry out and document a DPIA where client data is involved. Write a short AI use policy that names which tools are approved and the mandatory human review step.
That covers the foundations. On top of those, update engagement letters to describe significant AI use and obtain client consent where appropriate. Allocate CPD hours to AI literacy so fee-earners understand when a model is likely to hallucinate and how to verify outputs. Brief the COLP on the register at the same cadence as conflict checks.
None of this requires a separate AI strategy document or a six-figure consulting engagement. It is the same governance discipline a well-run firm already applies to client money, conflicts and confidentiality, extended to cover AI tools. If the firm cannot answer “what AI are we using, on what data, with what supervision, approved by whom”, it is not yet meeting the standard the SRA has set. If it can answer those questions in writing, it is broadly where the regulator expects it to be. Book a conversation if you want a second pair of eyes on the policy and the register before your next compliance review.
