top of page
Search

A one-page AI policy for a small law firm: what the Law Society and the SRA now expect

Writer: Ashley Barwick
Ashley Barwick
Oct 26
4 min read

On 21 October the Law Society published a practice note on using artificial intelligence in legal practice. The Law Gazette described it as 58 pages. It follows an SRA warning notice on the misuse of AI, published on 17 August.


You do not need to read 58 pages to get started. Both documents land on the same point: you stay accountable, whatever tool did the first draft.


Keep AI effectively governed
Keep AI effectively governed

What the two documents say


The SRA's warning notice names two concerns: AI "hallucinations" that put false information or citations into legal work, and confidential client information going into AI tools without the right safeguards. It says solicitors who use AI "remain accountable for their work and outputs, regardless of how that work has been prepared". It also says firms must have effective governance, systems and controls to manage risks, including those from AI, and that a COLP must take all reasonable steps to ensure compliance with supervision requirements.


The Law Society's president, Brett Dixon, said: "Professional responsibility cannot be transferred to any AI system." The practice note warns that paid-for tools should be scrutinised as well as free ones, and says: "Relying on AI to verify AI outputs will not satisfy your professional obligations."


Six decisions for a one-page policy


These are my suggestions for turning that into something a small firm can use. They are not SRA or Law Society requirements, and they do not replace taking advice about your own firm.


1. Which tools are allowed, and who decided? Name them. Everything else is not approved. The Law Society says to look at the terms of service, how data is stored and shared, and where the provider operates. Write down who checked and when.

2. What can never go into a tool? The SRA quotes the Upper Tribunal on putting client letters into an open source AI tool such as ChatGPT: it "is to place this information on the internet in the public domain". The SRA warns this will likely breach confidentiality and may waive privilege. Your policy should say plainly what staff may not paste into which tools.

3. Who checks the output, and how? Every case name, citation and factual assertion needs a human check against a real source. The policy should say that "the AI checked it" is not a check.

4. Who supervises? The SRA notice says supervisors can be in breach if false material is put before the court without adequate review. Say who reviews the work of junior or non-authorised colleagues who use these tools.

5. What do clients hear? The Law Society advises giving clients "appropriate information" about how you use AI. Where identifiable client data could breach confidentiality, including being used to train a tool, it says specific consent is likely to be needed, and that a client care letter or terms of engagement may be the place to deal with it. Internal administrative use may need no specific consent, but the note suggests transparency.

6. How do you bill? Legal Futures reports the Law Society's view that, where fees are time-based, you "should not bill for the time that a task would have taken had AI not been used". Time spent operating the system, checking the output and applying judgement can be charged where consistent with the client care letter.


Make it live, not just written


A policy nobody has read is a document, not a control. Three small steps help.


  • Give the policy an owner. In most small firms that is the COLP.

  • Put it in front of every member of staff, with a date and a signature or an email reply.

  • Review it every six months. This area is moving quickly, and the Law Society says it will provide further guidance for particular segments of the profession.


If you are using no AI at all, write that down too. Staff may be using tools you do not know about, and the policy is where you say what is allowed.


Evidence is the point


If the SRA asks how you manage AI risk, "we told people to be careful" is an explanation. A one-page policy, a dated record that staff have read it, and a note of the last review is evidence.


Start with a conversation


If you would like an independent view of how your firm's policies and controls hold together, I offer a free health check, with no obligation. Get in touch and we can arrange a time to talk it through.


The contact page is an enquiry form, so please put "free health check" in the message subject and I will pick it up straight away.


Ashley Barwick is a Fellow of the Chartered Institute of Legal Executives and a Law Society accredited Lexcel Consultant. This post is general information and does not constitute legal advice. Fraxinus Business Associates is not authorised to provide legal advice.


Sources


 
 
 

Comments

Rated 0 out of 5 stars.
No ratings yet
Add a rating
bottom of page