A managing partner of an eleven-person commercial firm asked me last week whether she could let her trainees keep using ChatGPT for first-draft client letters. She had heard the SRA had authorised an AI-only firm and worried she was falling behind. Her risk partner was worried about the opposite, that the same trainees were already pasting matter documents into a consumer chatbot with no policy in sight. Both partners were right to be uncertain. The question is not whether her firm can use AI, it is which uses sit on the safe side of the line the SRA, ICO and her professional indemnity insurer have drawn.
The honest answer is that quite a lot of useful work sits on the safe side, provided the firm chooses the use cases deliberately and a qualified fee-earner stays accountable for every output. The risk almost never lives in the tool, it lives in the data you feed it and the decisions you let it influence. What follows is a map of where UK law firms can genuinely get value from AI today without creating regulatory or insurance exposure, drawn from SRA, ICO and NCSC guidance, the named operators publicly using these tools, and the points where insurers have started asking sharper questions.
What does “low risk” AI use actually mean for a UK law firm?
Low risk means the use case sits inside the Principles and Codes the SRA already enforces, with no novel exposure created by the technology. The SRA’s 2023 discussion paper is clear, solicitors remain responsible for AI-assisted work and must maintain confidentiality, competence and supervision. A use case is low risk when client data stays controlled, a fee-earner signs off every output, and the firm can explain how the tool was used.
That definition rules out the cases that catch firms in the news. It rules out a partner letting a public chatbot draft an advice letter on a live matter. It rules out predictive coding running unsupervised on a privileged review set. It also rules out marketing claims that imply AI is doing legal work the firm has not actually authorised. The permitted surface is wider than many owner-operators assume.
Where can a small firm start without regulatory exposure?
The lowest-risk starting points are marketing copy, internal know-how, standard-document drafting on templated language, and supervised review on bulk disclosure sets. Clio’s UK guidance recommends this sequence for SME firms, and the SRA treats research, summarisation and drafting as legitimate AI uses provided lawyers verify the outputs. Each task involves no client data, or client data the firm already controls inside its DMS.
Marketing copy is the safest beachhead. Blog posts, newsletters, social posts and BD pitches can be drafted by a consumer tool because there is no client information in the prompt and the only review needed is editorial. Internal know-how is next. Summarising a recent judgment for the team, building a checklist for a procedure, drafting training notes from a transcript, these are all assistant-grade tasks where AI saves a fee-earner an hour and the worst-case error is an internal one a partner catches. Standard drafting moves up the sensitivity ladder, NDAs, engagement letters, routine correspondence on precedented matters, where the template lives in your DMS and AI adapts the language rather than rewriting the protective clauses.
E-disclosure and due diligence sit slightly higher again, but the technology has been in the courts for nearly a decade. Predictive coding was endorsed by Mr Justice Master Matthews in Pyrrho Investments v MWB Property in 2016, and major firms including Slaughter and May and Herbert Smith Freehills have been running it through Relativity, Reveal and Kira ever since. The judicial position is settled, AI ranks and tags documents while humans decide relevance and privilege.
Where do firms actually trip up?
The single most common breach is staff pasting client data into a public chatbot. The ICO treats this as a UK GDPR matter that needs a documented lawful basis, a DPIA where processing is high risk, and a transfer assessment for personal data going to a non-UK LLM. The NCSC’s 2024 guidance on public generative AI is explicit, consumer tools should not receive sensitive data without clear controls and DLP in place.
Samsung’s 2023 internal ChatGPT ban after staff leaked source code is the cautionary example UK regulators reach for when explaining the same point to law firms. The second pattern is letting AI act as decision-maker rather than assistant. The Mata v Avianca sanctions in the US, where a lawyer filed a brief containing fabricated citations from ChatGPT, sits in every SRA and Law Society warning paper. The third pattern is firms marketing AI as a shortcut. SRA publicity rules apply, you cannot imply AI is delivering legal judgment when a fee-earner is still doing the work.
What does the practical baseline look like for an SME practice?
A five to fifty person UK firm needs five things, a written AI use policy, a register naming approved tools and use cases, defined no-go data categories, mandatory sign-off on every output, and short training so the team knows the rules. None of this needs a chief AI officer or a governance platform. A partner owns the policy, the COLP keeps the register current, fee-earners take an hour of training a year.
On the tools side, a typical baseline looks like this. Marketing and internal use runs on Microsoft 365 Copilot configured to your tenant, with no cross-tenant data leakage. Legal research uses a subscription tool with a content licence, Lexis Plus AI or Westlaw with generative features, rather than a general-purpose chatbot. Document review and e-disclosure use a vetted platform such as Relativity, Reveal or Kira, hosted in the UK or EEA, with a UK GDPR-compliant data processing agreement signed. Practice management AI features inside Clio, PracticeEvolve or your DMS are switched on once you have run a DPIA on what they change about your data flows.
Productivity gains are real but specific. Early-adopter firms report twenty to forty percent time savings on contract first-drafting and summarisation tasks, not across the whole practice. A firm that promises clients a thirty percent fee reduction because it has bought a Copilot licence is overclaiming. A firm that uses AI to redirect three or four hours per fee-earner per week to higher-value work is being accurate.
What should a partner ask before approving any new AI tool?
Five questions, in this order. What data does the tool process, where is it hosted, and will the supplier sign a UK GDPR-compliant DPA. What is the use case, who is accountable, and how will sign-off be evidenced. What training does the team need. What does our PI insurer need at renewal. What is the off-ramp if the supplier changes its model or hits regulatory trouble.
If any of those questions does not have a clear answer, the tool is not yet ready for deployment. The discipline is not complicated, it is the same risk management partners already apply to outsourcing, to cloud migration and to lateral hires. AI is not a new category of decision, it is a new instance of an old one.
If you want a peer review of where your firm sits on this map, book a conversation.
