The SRA's warning notice on AI: what it requires, and the one-page AI policy a small law firm can adopt this week

"Can solicitors use ChatGPT", "law firm AI policy template", "best AI tool for small law firms": the searches ask permission, and since 17 August 2026 the SRA has answered them in a warning notice. The answer is yes, under conditions, and the conditions are the firm's to meet. This guide sets them out and gives the policy.

What the notice says

The firm is accountable. Work done through an AI tool is work the firm did. Supervisors must effectively supervise it (Code 3.5) and managers must make sure staff are competent to use what they use (3.6). "The tool produced it" is not a defence.

Verify everything. Case law and references put before a court or a client must be genuine and checked (2.4). The notice follows court judgments in which fabricated citations were filed; the SRA's position is that an unverified AI output is an unverified assertion.

Confidentiality and privilege. Information entered into an AI system may be stored, retained or used to improve the tool. Client information may only go into a system with appropriate contractual, technical and organisational safeguards. Entering it into a public tool risks a permanent waiver of privilege, because the information is treated as placed in the public domain.

Governance. Firms must have effective systems and controls for the risks AI brings (Code for Firms 2.1), and staff must understand their obligations. The trade press reported 42 reports of potential misuse to the SRA in the twelve months to July 2026, several of them self-reports.

The six rules for a five-partner firm

1. No client information in any tool the firm has not approved. Approved means a business account with a contract that says the provider does not train on the firm's data and states retention, and the approval is written down.
2. Every output is reviewed by the fee earner, and supervised like any other work. The reviewer's initials go on the file.
3. Every citation, figure and quotation is checked against the source before it leaves the firm. A tool that cannot show its source is not used for anything that will be relied on.
4. The tool drafts; a solicitor advises. Nothing goes to a client, a court or the other side without a named solicitor's review.
5. Clients are told in the client care letter that the firm uses AI tools under these rules, with the confidentiality safeguards named. Seven per cent of clients in the survey recalled being told; the firm that tells them is ahead.
6. Training and a named owner. The COLP owns the policy; everyone who uses a tool has read it and signed it; it is reviewed every six months and when a tool changes.

The one-page policy

"This firm uses AI tools to draft, summarise and check, never to advise. Only tools on the approved list may be used, and only through the firm's accounts; the list and the contracts behind it are held by the COLP. No client information is entered into any tool not on the list. All output is reviewed by the responsible fee earner and supervised in the usual way; every citation and figure is verified against its source before use. Clients are told of this policy in their client care letter. Breaches are reported to the COLP. Reviewed: [date]. Owner: [COLP]."

That is the policy. It is short because the rules are short; the work is in the approved list and the contracts behind it.

Asking a supplier the right questions

Today's Conveyancer published eight questions for any AI supplier on 1 October 2026: an audit log per user, whether the supplier trains on the firm's data, retention, external assurance among them. A supplier who cannot answer the training and retention questions in writing fails rule one. Overlyft sets up AI assistants in the firm's own office on the firm's own Claude plan, which the firm pays Anthropic for directly. Anthropic's privacy centre says content on its business plans is not used to train its models by default, and a person at the firm approves anything that goes to a client. The firm should still put the eight questions to Anthropic's published terms itself and keep the answers on file.

Where this meets the other rules

The AI policy is a governance document the SRA can ask for alongside the AML documents; the COLP and COFA guide covers who owns it when the compliance roles change. This is general information from the published notice, not legal advice; the firm's COLP decides the policy.