Question 1

Does the SRA actually require an AI register?

Accepted Answer

There is no rule that names one. The SRA regulates outcomes rather than tools, so the obligations that apply are the ones a firm already has: effective governance and systems and controls, records that demonstrate compliance, and identifying and managing material risks. A register is simply the practical way most firms satisfy those when several AI tools are in use. Its updated compliance guidance of 9 February 2026 also states that the SRA would expect, as a minimum, the COLP to be responsible for regulatory compliance when new technology is introduced.

Question 2

We do not know what our staff are using. Is that a problem?

Accepted Answer

It is the normal starting position, and it is the reason the register begins with an attestation round rather than a technical integration. Asking people what they use, under a policy that does not punish the answer, surfaces more than any monitoring tool will. Tools nobody will admit to are the ones that end up in a client deliverable unchecked.

Question 3

Do you monitor what our staff type into ChatGPT?

Accepted Answer

No. We do not put agents on endpoints and we do not intercept network traffic. That is a security product with a different buyer and a different set of trade-offs. We consume the feeds a vendor already exposes, and where none exists the register records the entry as attested rather than pretending to a visibility we do not have.

Question 4

What stops the register from going stale, like the spreadsheet did?

Accepted Answer

A spreadsheet goes stale because keeping it current is somebody's discretionary task. The register stays current because the same events that do the work also update it: a check run, a sign-off recorded, an attestation returned. The maintenance is a by-product rather than a chore.

Question 5

Can we export it for an inspection or a client questionnaire?

Accepted Answer

Yes. The register exports in a form built for the audience asking, and every figure states the basis it rests on, so a reader can see which entries are backed by evidence and which by attestation. A register that overstates its own coverage is worse than no register, because it misleads the person relying on it.

Question 6

How long does it take to stand up?

Accepted Answer

The declaration and policy work is a fortnight for most firms in our range, which is 20 to 200 fee-earners. The readiness check tells you before you start which parts of that fortnight your firm can skip.

Tool	Status	Risk tier	Owner	Evidence depth	Permitted use
LegalAI Space agents	Approved	Governed	COLP	Native evidence	All matter work
Harvey	Approved	High	COLP	Usage API	Research and drafting. Output must pass a check.
Microsoft Copilot	Approved	Medium	IT director	Audit-log ingest	Internal comms and summaries only
ChatGPT, personal accounts	Not permitted	Shadow	Unassigned	Attestation only	Blocked by policy. Staff attested.
A practice-area tool under evaluation	Under review	High	Head of KM	Manual, quarterly	Pending data protection review

Every AI tool in the firm, on the record.

The register states what each entry rests on.

Native evidence

Usage API

Audit-log ingest

Attestation only

What a COLP actually does.

Run the readiness check

Take the policy pack

Declare the estate

Ask staff to attest

Let evidence accumulate

The AI register, answered.

Getting the estate onto paper

Building an AI Risk Register Your Firm Can Hand to the SRA

Law Firm AI Policy Template: What to Include in 2026

Built In, Not Bolted On: Why Most Legal AI Only Solves Half the Problem

Find out what your register would say today.