Welcome to the latest RACO Roundup for March 2026! We’re keeping you ahead and informed with essential updates in the world of law and compliance.
This month, we’re focusing on two critical operational risks facing law firms: the record surge in Legal Ombudsman complaints and urgent data protection requirements around AI tool usage. As complaint volumes reach unprecedented levels and tribunal warnings about client data breaches emerge, firms must act now to strengthen their processes.
Below, you’ll find practical guidance on complaint management infrastructure and immediate steps required for AI policy compliance, followed by our Security Section with the latest scam alerts to help protect you and your clients.
Legal Ombudsman Complaint Numbers Reach Record High: Is Your Firm Set Up to Handle Them?
The Legal Ombudsman received nearly 3,500 complaints in Q4 2025, up 37% on the same period in 2024. Residential conveyancing led with 647 complaints, followed by personal injury with 271 and wills and probate with 254. Most complaints centred on poor service and poor communication, reflecting increasing client willingness to escalate concerns.
The issue is not whether complaints arise, but how efficiently and objectively they are managed. Poor complaint handling carries regulatory and commercial risk: slow responses increase escalation likelihood, and firms juggling heavy workloads often struggle with the time, resource, and complete impartiality needed. Many firms are now turning to outsourced complaint support to restore control, reduce emotion, add capacity, and reduce escalation risk. With complaint numbers at record highs, firms should review response times, investigation impartiality, root cause analysis, and management oversight.
Read full story here.
Open-Source AI and Client Data: What Your Firm Must Do Now
A recent Upper Tribunal judgment has issued explicit warnings about uploading client documents into ChatGPT, confirming that doing so may constitute a breach of client confidentiality, a waiver of legal privilege, and a reportable data breach. The judge stated that uploading confidential documents into open-source AI tools places information in the public domain and requires notification to clients, self-reporting to the SRA, and referral to the ICO.
The purpose of upload is irrelevant to the breach. Firms must immediately review AI use policies, distinguish between prohibited open-source tools and approved closed-source tools with data processing agreements, disable ChatGPT learning functions if accounts exist, issue all-staff briefings, and consider reporting obligations if past uploads have occurred. Supervisors who fail to ensure staff awareness of AI risks are likely to be considered more culpable than staff who make errors. Tools like Claude Enterprise, LexisNexis AI, and LEAP operate within controlled environments, but data processing agreements must be confirmed.
Read full story here.
Security Section
Latest SRA Scam Alerts
Warning: WhatsApp Messages from ‘Tomas Vaslak’ Misusing SRA ID
Date: 3 March 2026
The Scam: WhatsApp messages have been sent misusing the SRA number of a genuine solicitor in relation to the recovery of cryptocurrency funds. The messages were sent from WhatsApp number ‘+44 7715 873184’ and an email address of ‘tomas.vsolicitorscheck.com’ was also given.
Fraudulent Contact Details:
• WhatsApp: +44 7715 873184
• Email: tomas.vsolicitorscheck.com
• Misused SRA ID: 658744 (genuine solicitor Tomas Vlasak)
The genuine solicitor Tomas Vlasak (SRA ID 658744) is currently based in Czech Republic with email tomas.vlasak-advokat@email.cz and has confirmed he has no connection with these fraudulent messages.
Read the full alert here.
Warning: Email Misusing Hill Dickinson LLP and Alexandra Maleedy
Date: 2 March 2026
The Scam: Emails have been sent from an individual purporting to be ‘Alexandra Maleedy’, a Senior Associate at Hill Dickinson LLP in relation to supposed settlement agreement documents. The emails used an altered version of the firm’s email address by inserting an extra ‘s’ within the domain.
Fraudulent Contact Details:
• Email: alexandra.maleedy@hilldickinsson.com (note extra ‘s’)
Genuine Details:
• Firm: Hill Dickinson LLP (SRA ID 424853)
• Head Office: No. 1 St. Paul’s Square, Liverpool, L3 9SJ
• Genuine Email Domain: @hilldickinson.com (no extra ‘s’)
• Genuine Solicitor: Alexandra Maleedy (SRA ID 609743)
Hill Dickinson LLP and Alexandra Maleedy have confirmed they have no connection to the fraudulent emails.
Read the full alert here.
Been Contacted by a Scammer?
If you’ve been contacted by any of these scams or received suspicious correspondence claiming to be from a law firm, always verify directly using established contact details before responding or taking any action.
BEEN CONTACTED?
Here’s What to Do…
When a firm’s or individual’s identity has been copied or cloned, due diligence is necessary. If you receive correspondence you believe to be suspicious, you should conduct your own due diligence by checking the authenticity of the correspondence by contacting the law firm directly by reliable and established means.
You can also contact the SRA directly to find out if individuals or firms are regulated and authorised by the SRA and verify an individual’s or firm’s practising details. Other verification methods, such as checking public records (e.g. telephone directories and company records), may be required in other circumstances.
Reach Out to RACO
We at RACO are always at hand to provide tailored guidance to help you make the most informed and beneficial decisions. We help you understand the recurrent regulatory shifts and work with you to provide solutions.
With our team of professional specialists and our renowned legal expertise, we can work with your firm to always ensure you are never left unprepared in the wake of legal changes or cyber threats.
For more information on how we can help: contact us at:
Tel: 02039858550
