Question 1

Can the SRA audit our firm's AI use?

Accepted Answer

Yes. Under section 44B of the Solicitors Act 1974 the SRA can serve notice requiring your firm to provide information and produce documents, and under section 44BA require an explanation. There are no AI-specific rules: the existing SRA Standards and Regulations govern how you adopt and supervise AI.

Question 2

What is a section 44B production notice?

Accepted Answer

A statutory notice under section 44B of the Solicitors Act 1974 by which the SRA requires a person to provide information or produce documents within a period the notice specifies: commonly 7 or 14 days. Failing to produce documents is a summary criminal offence and can be a ground for intervention under Schedule 1.

Question 3

What records does the SRA expect on AI use?

Accepted Answer

Evidence, not a policy PDF: a register of the AI tools in use, the named human who reviewed each AI-assisted output, the verification trail for cited authorities, the rule applied in AI-influenced decisions, and who is accountable. These map to the Code for Firms (2.1, 2.2, 2.5) and the Code for Solicitors (1.4, 3.5).

Question 4

Is ChatGPT confidential enough for client work?

Accepted Answer

Entering client confidential information into a public model risks breaching your duty of confidentiality (Code for Solicitors 6.3). In a 2026 Access Legal survey, 59% of UK fee earners admitted using unapproved AI tools. Use a tool that redacts personal data before the model sees it and keeps the work inside the firm's control.

Question 5

Do we need an AI register?

Accepted Answer

In practice, yes. Effective governance, systems and controls (Code for Firms 2.1) and records that demonstrate compliance (2.2) are hard to evidence without a current inventory of the AI tools in use, including the ones staff adopt informally.

Question 6

What is an AI audit trail, and what should it capture?

Accepted Answer

An AI audit trail is the contemporaneous record of how an AI-assisted output was produced: the question asked, the tools and model used, the sources retrieved, the verification checks run on any cited authority, the human who reviewed it, and the decision taken. The SRA looks for records that demonstrate compliance (Code for Firms 2.2), not a policy alone. Kept as the work happens, an audit trail is what lets you answer a s.44B production notice in days rather than reconstruct it after the fact.

Question 7

Do we need an AI risk register?

Accepted Answer

In practice, yes. Effective governance, systems and controls (Code for Firms 2.1) are hard to evidence without a live risk register that records each AI tool in use, its risks (confidentiality, accuracy and hallucination, data residency), the controls applied, and who owns it. It sits alongside your AI register and is one of the first documents a supervising partner or the SRA will expect to see.

Question 8

What does an SRA AI audit report look like?

Accepted Answer

There is no prescribed form. In practice it is the summary a COLP or COFA can export on demand: the AI tools in use, the verification pass rate for cited authorities, incidents caught, the rules applied, and the audit trail behind any given answer. When the record is produced as the work happens, the audit report is something you export in minutes rather than assemble under a 14-day deadline.

Question 9

Which firms does this apply to, and who owns it: the COLP or the COFA?

Accepted Answer

It applies to SRA-regulated firms and the solicitors within them: the SRA Standards and Regulations and the Solicitors Code of Conduct govern how you adopt and supervise AI, with no AI-specific carve-out. The COLP carries personal responsibility for the firm's regulatory compliance, including when new technology is introduced (Code for Firms 9.1); the COFA covers the Accounts Rules (9.2). In most firms the COLP owns AI governance, working with whoever runs IT and risk.

Question 10

What should a law firm AI policy contain?

Accepted Answer

Approved tools and who may use them, a verification step for anything cited, confidentiality rules on client data, human review before AI-assisted work is sent, and record-keeping so each of the above can be produced. A policy states intent; the SRA looks for the record that proves it.

Question 11

What happens if a solicitor cites a fake AI-generated case?

Accepted Answer

It can breach the duty not to mislead the court (Code for Solicitors 1.4). In Ayinde v Haringey [2025] EWHC 1383 (Admin), the Divisional Court set out lawyers' obligations on AI-assisted research and referred the individuals involved to their regulators.

Question 12

Who is responsible for AI governance in a firm: the COLP?

Accepted Answer

The COLP carries personal responsibility for the firm's regulatory compliance (Code for Firms 9.1), including when new technology is introduced; the COFA covers the Accounts Rules (9.2). SRA guidance is explicit that the COLP is responsible when new technology is adopted.

Question 13

Does the EU AI Act apply to UK law firms?

Accepted Answer

It can, extraterritorially: if your AI output is used in the EU or affects people in the EU, you may be in scope, as with GDPR. Legal AI is high-risk (Annex III, point 8); those obligations apply from 2 December 2027 under the Digital Omnibus adopted in June 2026.

Question 14

How long do you have to respond to an SRA production notice?

Accepted Answer

The notice specifies the period; section 44B does not fix one, and 7 or 14 days is common in practice. That is short relative to reconstructing records that were never kept, which is why keeping them as the work happens matters.

See where your firm stands on SRA AI governance.

See where your firm stands, in about 10 minutes

If the SRA called tomorrow, could you show them how your firm uses AI?

The courts moved first

Could you show the SRA the record?

AI is on the PII form now

The readiness check, answered.

What the SRA actually asks a firm about AI

What the SRA Can Actually Ask Your Firm About AI (and How to Answer)

The COLP's AI Governance Checklist: Every SRA Rule Mapped to AI

Why an AI Policy Is Not AI Governance

Ten minutes now, or an afternoon reconstructing it later.