On 17 August 2026 the SRA published a warning notice on the misuse of AI. The press release that went with it said the regulator had received 42 reports about potential misuse between July 2025 and July 2026, including referrals from senior judges and solicitors reporting themselves. The notice names the failures: fictitious cases and references, citations in court documents "not checked or verified before submission", confidential client information entered into public AI tools, and inadequate supervision of junior and non-authorised staff. Its position on responsibility is blunt: "Reliance on an output of AI would not be a suitable defence", and "The use of AI does not diminish or transfer your professional responsibilities."
It also says firms must have "effective governance structures, systems and controls in place to manage any risks, including those arising from use of AI". The Law Society's Generative AI: the essentials, updated in June 2026, tells solicitors to adhere to their organisation's AI policy and to make sure "appropriate staff protocols and guidance are provided". Neither body publishes a template. This is one, written for a firm of 5 to 25 fee earners, and structured so the sections a regulator, an insurer or a client would ask about are easy to find.
Take the editable template
The full policy below as a Google Doc, with the tool register, the supervision section and the fee-earner quick reference, ready for your firm's name and your COLP's. First name and email, and it opens straight away.
Open the editable template → It opens as a Google Doc. Use File, Make a copy, to edit it as your own.
What the policy covers, and the SRA wording behind each part
Responsibility that does not move
Principle 2.1 of the template restates the notice: the use of AI does not diminish or transfer professional responsibility, and reliance on an output is not a defence. A named person signs off before anything is relied on, sent, filed or recorded. Everything else in the policy exists to make that principle workable day to day.
Verification of every legal submission
The notice says "they must verify all content in legal submissions". Section 5.2 of the template makes that a file step: every citation, quotation and factual assertion in a court document is checked against the primary source and the check is recorded before filing. It applies whether or not AI was used, which is the point: the discipline is the same, the risk is higher.
Confidentiality, privilege and the register
Client information "should only be entered into AI systems where appropriate" safeguards exist. The Law Society adds that free online tools should never receive confidential data, and that real client data should never be used for testing or templating: "Always create and use fictional data." The template puts both into rules, and adds a register (Schedule A) that records, for every approved tool, the plan, whether the provider can train on your data, where the data lives, and whether the tool may be used on privileged material. A tool off the register is a tool off limits.
Supervision of AI-assisted work
The SRA's effective supervision guidance gained an AI section in June 2026: firms should consider "what effective supervision of AI assisted or AI generated work looks like in practice", with outputs "subject to appropriate human review, scrutiny and professional judgement" and "an authorised individual retains ultimate responsibility". Section 6 of the template asks the firm to say, in its supervision arrangements, how that happens, and restricts the drafting tools to staff whose work is supervised by an authorised individual.
Transparency with clients and the court
The Law Society notes that the SRA has no specific guidance on disclosing generative AI to clients, and advises firms to decide with their clients whether and how the tools are used, and to "clearly communicate to clients when and how AI tools are used in their matters, where appropriate to do so". The template adds a line to the client care letter, a decision recorded on the file where AI materially contributes, a rule that automated enquiry handling identifies itself as automated, and compliance with any court requirement to disclose AI use.
Automations, specifically
If your firm has had anything built (an enquiry responder, an intake sequence, a chasing routine), section 5.4 is the paragraph that matters. Every action the automation proposes is approved by a person before it is sent, filed or recorded, with one carve-out for acknowledging and routing new enquiries under wording the firm approved. The automation holds no write access that bypasses that step. That is how we build them, and it is what keeps a build inside the notice.
Incidents, training, review
A route for reporting a fabricated authority or an unapproved use, an assessment of whether the SRA, the court or the other party needs to be told, and an incident log reviewed annually. Training that separates how to use a tool from how to use it ethically, which the Law Society says are "equally important". A quarterly look at the register and an annual look at the policy, or sooner when guidance changes, which in 2026 it has twice.
How to adopt it in a week
- Monday: list every AI tool anyone in the firm uses, including the features inside your case management system and the ones on personal phones. That is Schedule A.
- Tuesday: for each, check the plan and whether its terms prohibit training on your data. Move anything on a free tier to a business plan or off the register. Decide which tools, if any, may touch privileged material.
- Wednesday: name the policy owner (usually the COLP), the sign-off levels, and write the AI paragraph into your supervision arrangements.
- Thursday: add the client care letter line. Brief the fee earners with Schedule B. Set the verification step for court documents as a file requirement.
- Friday: adopt it, date it, diarise the review.
What it does not do
It is not legal advice and it is not a DPIA, a supervision policy or a procurement record. It gives you the structure to produce those properly, and it points to the Law Society's Buying new technology guide for the procurement half. If the firm is about to build automation on client matters, the DPIA and the supervision wording should be written alongside the build; the law firms page describes how we handle that.
Founder, Anco AI. Builds the systems this site talks about, and runs his own business on them.
