A letter arrives from the SRA. It asks your firm to produce a specific set of records: your AI policy, the log of which tools are in use, evidence that AI-assisted work was checked before it went to a client, and the risk assessment behind all of it. You have thirty days.
Here is the uncomfortable part. Most firms reading that letter do not fail because they did something reckless with AI. They fail because they cannot find the paperwork proving they did anything careful. The tools were fine. The record was missing.
This is what an "SRA AI audit" actually tests, and it is worth being honest about where it leads. Not to scare anyone, but because the consequences run further than the fine most partners are bracing for. Let me walk the realistic path.
There is no pass or fail certificate, which is the problem
Start by clearing up the phrase. The SRA does not run a standalone "AI audit" with a score at the end. There is no AI rulebook and no AI licence. What happens instead is that AI use gets examined through the rules your firm is already regulated by: the SRA Code of Conduct for Firms, which requires effective governance (2.1), records that demonstrate compliance (2.2), and active management of material risks (2.5).
So "failing an AI audit" is not a grade. It is a moment. It is the moment an inspector, a thematic review, or an investigation asks you to show your work, and you cannot. The rule you breach is not "you used AI wrong." It is 2.2: you could not produce the record.
That distinction matters because it changes what you build. A firm braced for a test buys a policy document. A firm that understands the real exposure builds a record that produces itself. We wrote the fuller version of this in why an AI policy is not AI governance. The short version: the policy is the easy half.
Field note: The blunt question I ask firms is not "do you have an AI policy?" Almost everyone says yes. It is "if the SRA asked today, could you show who checked this AI-drafted advice, and when?" That is the question that goes quiet.
Consequence one: the paperwork gap reads as a governance gap
When you cannot produce records, the SRA does not conclude "they are disorganised." It concludes "they cannot demonstrate compliance," and under Rule 2.2 that absence is itself the finding. There is nothing to weigh in your favour because there is nothing to weigh at all.
The mechanism here is not a polite request. Under section 44B of the Solicitors Act 1974, the SRA can serve a notice requiring you to produce documents, information, and explanations connected to an investigation, and failing to comply is a criminal offence. A related power lets them require you to attend and explain what you produced. You do not get to decline the request and move on.
So the gap compounds. No audit trail means no answer to the production notice. No risk register means no evidence you ever identified AI as a risk under Rule 2.5. Each missing document is not a neutral blank. It is a data point that says the firm was not managing this, and it colours how every other answer you give is read.
Consequence two: it is personal, not just the firm's problem
Firms think about regulatory risk as a corporate risk. The SRA does not see it that way. Accountability sits with named individuals as well as the entity.
Your firm has to designate a Compliance Officer for Legal Practice (COLP) and a Compliance Officer for Finance and Administration (COFA), and those are personal appointments carrying personal duties. The COLP is responsible for taking reasonable steps to ensure the firm complies with its regulatory obligations, and for recording and, where required, reporting failures. When the AI governance record is not there, that is not an abstract corporate shortcoming. It lands on a person, by name, who signed up to that responsibility. We set out what that means day to day in the COLP's responsibilities for AI.
This is the point most partnerships underestimate. You can restructure a firm. You cannot restructure your way out of a personal regulatory finding once it attaches to an individual.
Consequence three: the fine is the smallest number in the room
Now the money, because it is usually the first thing firms ask about and usually the least of it.
The SRA can impose a financial penalty directly, and for traditional firms and the people in them that internal power is capped at £25,000, a limit introduced on 20 July 2022 when it rose from just £2,000. If that were the ceiling, plenty of firms would treat it as a cost of doing business. It is not the ceiling.
Here is the fuller picture, and it is worth having the numbers straight:
| Route | Who imposes it | Financial exposure |
|---|---|---|
| SRA internal penalty, traditional firm or individual | The SRA directly | Up to £25,000 |
| SRA internal penalty, licensed body (ABS) | The SRA directly | Up to £250m for the body, £50m for an individual |
| Referral to the Solicitors Disciplinary Tribunal | Independent tribunal | Unlimited fine, plus suspension or strike-off |
| Economic-crime-related breaches | The SRA directly | Cap removed under the Economic Crime and Corporate Transparency Act 2023 |
When the SRA decides a penalty above its internal limit is warranted, or that someone should be suspended or struck off, it refers the matter to the Solicitors Disciplinary Tribunal, whose powers under section 47 of the Solicitors Act 1974 include an unlimited fine. So the honest range is not "up to £25,000." It is "up to £25,000 if you are lucky enough for it to stay in-house, and open-ended if it does not."
Consequence four: the SRA can close the firm, not just fine it
Fines assume the firm keeps operating. The SRA has a power that assumes the opposite.
It is called intervention, and it comes from section 35 and Schedule 1 of the Solicitors Act 1974. When the SRA intervenes, in its own words, in effect an intervention amounts to the end of the practice. The firm's authorisation is revoked. All client and office money vests in the SRA and is held in trust. Every file and document is taken into the possession of an appointed agent. Practising certificates can be suspended on the spot.
To be clear about proportion: intervention is a high bar and it is rare, and it is usually reserved for suspected dishonesty or missing client money rather than a governance gap on its own. I am not suggesting a thin AI audit trail gets your doors shut. The point is about the shape of the SRA's toolkit. Its most serious power is not a bill you pay and forget. It is the end of the business, and the individuals responsible are personally liable for the costs of the intervention on top of losing the firm.
Consequence five: it goes on the public record
Everything above would sting less if it stayed private. It does not.
The SRA publishes its regulatory and disciplinary decisions, and the Solicitors Disciplinary Tribunal publishes its judgments on its own website. A strike-off judgment stays published for sixty years. Tribunal hearings are generally held in public, precisely so that outcomes are visible and the system is accountable.
What that means in practice is that the finding does not end when the matter closes. It becomes a searchable, citable, permanent entry with the firm's name and, often, an individual's name attached. Anyone doing due diligence on your firm, a prospective client, a lateral hire, a panel, an acquirer, can find it. The regulatory event is a moment. The public record is forever.
Consequence six: the reputational cost outlives all of it
The fine gets paid. The record stays up. And the commercial damage compounds quietly in places you do not control.
Clients on panels increasingly ask how their advisers govern AI, partly because their own insurers and regulators are asking them the same question about their supply chain. A published finding is the worst possible answer to that question. Your professional indemnity renewal gets harder too, because a regulatory finding is a leading indicator of claims risk and insurers price it accordingly. We went deep on that dynamic in your PII insurer is about to ask about AI.
None of this is exotic. It is the ordinary way trust erodes: not a single dramatic event, but a governance failure that becomes public and then follows the firm into every conversation where credibility is the currency.
The through-line: every consequence is an evidence problem
Read back through the six. The production notice you cannot answer. The individual exposure with no record to point to. The fine that escalates because you cannot show mitigation. The public finding. Every one of them traces to the same root. Not that the firm used AI badly, but that the firm could not prove it used AI well.
That reframes the whole thing, and it should be a relief, because an evidence problem is fixable. If the record of what your AI did, who checked it, and when, exists as a by-product of the work rather than a scramble after a letter arrives, most of this path never opens. You answer the production notice on day one. The risk register is already there. The individual accountability is documented rather than exposed.
This is exactly what we built LegalAI Space to produce. Every agent runs inside a governance layer that logs what the AI did, ties each output back to its source, captures that a named person reviewed it, and rolls it up into a compliance dashboard and an audit trail you could hand to the SRA without a scramble. Not a policy that describes good intentions. A record that proves them. If you want the mapping of every relevant SRA obligation to a concrete control, the SRA AI compliance guide lays it out, and the interactive SRA AI audit readiness check lets you test whether your firm could produce the six records today.
LegalAI Space builds AI agents for legal teams with a governance layer that makes every output verifiable, compliant, and audit-ready, generating the evidence your COLP, your insurer, and the SRA need. Sign up for early access or book a pilot call with Founder Daman Kaur.
FAQ
What is an SRA AI audit? It is not a formal, named audit with a certificate. It is the SRA examining how your firm uses AI through the rules you are already regulated by, usually via an inspection, a thematic review, or an investigation. In practice it means being asked to produce records that show your AI use is governed. You "fail" when you cannot produce them.
Does the SRA have specific rules about AI? No. There is no standalone SRA AI rulebook. AI use is governed by the existing SRA Code of Conduct for Firms, including effective governance (2.1), records that demonstrate compliance (2.2), and management of material risks (2.5), plus competence and confidentiality duties. Your AI obligations are already live under the rules you hold a practising certificate under today.
How much can the SRA fine my firm? The SRA can impose up to £25,000 directly on a traditional firm or individual (since 20 July 2022). For licensed bodies (ABS) the internal limits are far higher, up to £250m for the body and £50m for an individual. If a larger penalty or a suspension or strike-off is warranted, the case goes to the Solicitors Disciplinary Tribunal, which can impose an unlimited fine.
Can the SRA shut my firm down over AI? The SRA's most serious power is intervention under the Solicitors Act 1974, which effectively ends the practice: authorisation is revoked, money vests in the SRA, and files are seized. Intervention is rare and is usually reserved for dishonesty or missing client money, not a governance gap alone. The point is that the SRA's toolkit goes well beyond fines.
Are SRA and tribunal decisions made public? Yes. The SRA publishes regulatory and disciplinary decisions, and the Solicitors Disciplinary Tribunal publishes its judgments; strike-off judgments stay published for sixty years and hearings are generally public. A finding becomes a permanent, searchable record attached to the firm and often to named individuals.
What records should we keep to be ready? At a minimum: an AI register of tools in use, evidence that AI-assisted outputs were checked by a named person before use, a risk assessment covering AI, and a log tying it together. The test under Rule 2.2 is whether you can demonstrate compliance, so the records have to exist as evidence, not just intentions.
Sources
-
SRA Code of Conduct for Firms, SRA Standards and Regulations. Rule 2.1 (effective governance, systems and controls), Rule 2.2 (keeping records to demonstrate compliance), Rule 2.5 (identifying, monitoring and managing material risks). These existing obligations govern AI use; there is no separate AI rulebook.
-
SRA, Approach to financial penalties. The maximum financial penalty the SRA can impose directly is £25,000 (introduced on 20 July 2022); for licensed bodies and their staff the limits are up to £250m (entity) and £50m (individual). Higher penalties, suspension, or strike-off are referred to the Solicitors Disciplinary Tribunal.
-
Economic Crime and Corporate Transparency Act 2023. Removed the cap on the SRA's financial penalty powers in relation to certain breaches involving economic crime.
-
Solicitors Act 1974, section 44B (and sections 44BA, 44BB). Gives the SRA power to serve a notice requiring a solicitor or firm to produce documents, information, and explanations for an investigation; failure to comply is a criminal offence.
-
Solicitors Act 1974, section 47, on the powers of the Solicitors Disciplinary Tribunal, including unlimited fines, suspension, and striking off. Solicitors Disciplinary Tribunal judgments are published; strike-off judgments remain published for sixty years.
-
SRA, Intervention into a practice. The SRA's intervention powers derive from section 35 and Schedule 1 of the Solicitors Act 1974; in effect an intervention amounts to the end of the practice, with money vesting in the SRA, files seized, and the responsible individual personally liable for the costs of the intervention.
-
SRA, Publishing regulatory and disciplinary decisions. Sets out how and why the SRA makes its decisions public.