SRA Releases Warning Notice on Using AI in Legal Work

Firms are urged to read the recent warning notice from the Solicitors Regulation Authority (SRA) on the misuse of artificial intelligence in legal services, which can be accessed in full here: https://www.sra.org.uk/solicitors/guidance/misuse-ai/

The regulator has been firm in its stance, warning firms and individuals:

“If you fail to have proper regard to this warning notice, you are at risk of disciplinary action. We can and will act where we find evidence that solicitors, firms and/or their employees contravene our rules. Please see our Enforcement Strategy for information about our approach to taking regulatory action.”

Key areas of concern raised in the SRA’s warning notice include AI hallucinations in legal work and the submissions to the court, along with breaches of client confidentiality.

We have written more than once this year about these exact issues, highlighting where AI use goes wrong, in More Firms Referred to the SRA Over AI-Generated Authorities and Open-Source AI and Client Data: What Your Firm Must Do Now.

What is the SRA Warning Against?

The SRA notice makes it clear that the regulator is not against firms and legal professionals using AI. It takes an outcomes-based approach and accepts that many firms use AI safely, competitively, to their clients’ benefit. However, as introduced above, the SRA warns against two specific failures it has already seen in practice.

AI hallucinations in legal work and submissions to the court: The first is false or incorrect information in court and other documents, including fabricated case citations. AI tools have been shown to produce what the notice calls ‘AI hallucinations’: fictitious cases, references, and confident-sounding assertions that have no basis in fact. The SRA states plainly that it has received reports of potential Code breaches from senior members of the judiciary, and that several solicitors have self-reported after relying on AI output that turned out to be inaccurate. You can read about these specific cases here, published by the Law Gazette: ‘Judge refers solicitors to SRA over ‘inexcusable’ submission of AI-generated authorities’ and ‘Pinsents refers itself to SRA over AI failures’, which we covered in our earlier article, More Firms Referred to the SRA Over AI-Generated Authorities.

Client confidentiality: The second key area of concern is over client confidentiality. The SRA is concerned that firms are entering clients’ personal data and other confidential information into AI tools without appropriate safeguards, and that both free and paid tools may lack the contractual and technical protections needed to keep that information confidential. We provided specific guidance on the use of these tools with regard to client confidentiality in an earlier article, ‘Open-Source AI and Client Data: What Your Firm Must Do Now’.

Examples of AI Misuse the SRA Relies On

On AI hallucinations, the SRA points to R (Ayinde) v Haringey LBC [2025] EWHC 1383 (Admin), where false AI-generated citations were put before the court. The solicitor and barrister involved faced a wasted costs application and were referred to their regulators for improper and unreasonable conduct. The court’s message, quoted in the notice, is that reliance on AI output is not a defence, because lawyers must verify all content in their submissions and remain personally responsible for its accuracy regardless of the tools used. The notice reinforces this with BCP v A Mother [2026] EWFC 71 (B) and Cork v Smith [2026] EWHC 1199 (Ch), where the courts again treated unchecked AI hallucinations as a serious matter even without deliberate intent to mislead.

On client confidentiality, the notice draws on UK v Secretary of State for the Home Department [2026] UKUT 81 (IAC), in which the Upper Tribunal observed that putting client letters and Home Office decision letters into an open-source AI tool such as ChatGPT places that information in the public domain. The consequences the SRA draws out in this notice are potential regulatory breaches we have raised before, and it is stressed here further by the regulator:

“Using AI tools in this way will likely breach client confidentiality and as a result, legal professional privilege may be permanently waived and unable to be recovered.

Both free to use and paid for AI systems may pose risks to client confidentiality. Depending on the provider’s terms, settings and technical architecture, information entered into AI systems may be stored, retained or used to improve the tool. This means that confidential or client-sensitive information that is entered into AI tools may create significant risks to confidentiality, legal professional privilege and compliance with data protection law and may mean you no longer have full control over how that information is processed or used.”

The last point on client confidentiality is something firms should be paying particular attention to. A hallucinated citation can be caught and corrected before filing with the court. A confidentiality breach through a public AI tool may not be reversible. Read our previous guidance for more detailed information on the difference between Open-Source and Closed Source AI tools.

Competent Service and Effective Supervision – A Firm’s Key Responsibilities

The SRA’s warning notice refers firms to a set of specific obligations and responsibilities, reminding those it regulates:

“Your existing professional obligations apply regardless of the tools used within legal practice. You remain responsible for the advice and outputs you provide to clients as a legal professional.

Using AI tools in the course of your work does not reduce, remove or replace the professional, regulatory or legal responsibility you have for the quality and accuracy of service and information delivered to your clients, the court, third parties or your regulators.”

The SRA ties this to specific obligations set out in its Code of Conduct. Competent service and effective supervision are required under paragraphs 3.2 and 3.5 of the Code of Conduct for Solicitors.

Submissions to court must be properly arguable under paragraph 2.4, and misleading the court engages the duties in paragraphs 2.4 to 2.6, with the courts describing misleading the court as one of the most serious offences a litigator can commit. Firms must have effective governance, systems, and controls to manage the risks of AI under paragraph 2.1 of the Code of Conduct for Firms, and confidentiality is protected under paragraph 6.3 of both Codes.

Supervision is further singled out. The notice is explicit that those who supervise junior or non-authorised colleagues can themselves be found in breach if false citations reach the court without adequate review. Delegating a task to a junior who used AI does not delegate the responsibility for checking it. The SRA has recently updated its supervision guidance, which we covered in an earlier blog, ‘SRA Updates Supervision Guidance Following Mazur’, reminding those with supervision responsibility of their obligations. 

The Main Recommendations for Firms

The warning notice on AI use is not just a guidance note; it is a compliance obligation, and firms should treat it as one. Reviewing the notice together with our earlier articles, these are the key priorities for all firms and legal professionals:

• Put an AI policy in place, if you have not already. The SRA expects firms to have governance, systems, and controls covering AI use. A firm with no policy at all is exposed the moment a member of staff uses a tool badly. The policy should state which tools may be used, for what, and what must never be entered into them.
• Verify every citation and authority, without exception. Any case, quotation, or reference produced with AI assistance must be checked against a reliable source before it goes near a client or a court. As Ayinde makes clear, “the AI generated it” is not a defence.
• Keep confidential and privileged information out of public AI tools. Client data should only be entered into an AI system where proper contractual, technical, and organisational safeguards are in place. Free and open tools rarely provide them. This is the single most important protection, because a privilege waiver cannot be undone.
• Do not assume in-house or paid tools are automatically safe. The notice warns that paid tools can still lack adequate safeguards, and that in-house tools built for a business may not be designed for legal work. The question is always what happens to the data, not what the tool costs.
• Supervise on the basis that AI may have been used. Reviewers should check work as though a hallucination could be present, because the supervising solicitor carries the responsibility if one slips through.
• Consider your reporting obligations. If you are aware, or become aware, that client documents have previously been uploaded to ChatGPT or similar tools, consider your reporting obligations under your data protection policies, consider whether a report to your regulator is required, and consult the ICO.
• Update your training. Staff need to understand both failure modes, hallucination and confidentiality, and know the firm’s rules. Competence obligations under both Codes require knowledge to be kept up to date, and AI is now part of that.

Summary Checklist

• Review your AI use policy and remove or revise any permission for open-source AI tools to be used with client data
• If ChatGPT accounts exist, disable the model improvement/learning setting on each account immediately
• Issue an all-staff briefing confirming the prohibition on uploading client data to consumer AI tools
• Confirm data processing agreements are in place for all AI tools currently in use, including Claude, LexisNexis, and LEAP
• If past uploads to open-source tools are known to have occurred, consider reporting obligations to clients, the SRA, and the ICO
• Ensure supervisors understand their personal responsibility for the AI practices of those they oversee

Further Compliance Support

The warning notice does not ask firms to abandon AI, and the SRA recognises that many firms and legal professionals are already taking a considered, risk-based approach to using AI-assisted tools. However, the regulator is warning firms to use it within the professional obligations that have always applied. The practical challenge is turning that expectation into policies, checks, and training that work day-to-day.

Our compliance team at the Regulation and Compliance Office (RACO) helps firms do exactly that. If your firm requires assistance reviewing, drafting, or updating your AI use policy, assessing your current tool landscape, or preparing staff communications and training, please contact your RACO compliance manager.

Where AI misuse has already occurred, whether a false citation has reached a court or confidential information has been exposed, early and careful handling matters. Our SRA Regulatory Defence and Disciplinary Support and Self-Reporting services can help you manage an SRA enquiry and investigation or a self-report and protect the firm’s position.

To ask any questions about the Regulation and Compliance Office and how we can support your Law Firm, please call us on 0203 985 8550, complete the online enquiry form below, or email us at info@regulationandcomplianceoffice.co.uk.