For COLPs, COFAs and managing partners of SRA-regulated firms

The SRA AI audit arrives on a Tuesday. You have fourteen days.

Under section 44B of the Solicitors Act 1974, the SRA can already serve notice requiring your firm to produce its AI records — and explain them. Most firms have a policy. Far fewer have the record. See where yours stands.

Book a pilot callTake the 3-minute readiness check

The letter

It is addressed to you, by title.

A specimen production notice. The power behind it is real; the letterhead is not. Type your firm's name below — it never leaves this page.

Illustrative specimen · not regulator correspondence

Solicitors Regulation Authority

Regulatory Supervision

Our reference

SRA/AUD/2026/0000

To: The Compliance Officer for Legal Practice

Time to respond
About 13 days remaining to respond in this illustrative specimen.

We exercise the power under section 44B of the Solicitors Act 1974 to require [your firm] to provide the information and produce the documents specified below. You must respond within the period specified in this notice: fourteen days of the date of this notice.

Re: Notice under section 44B of the Solicitors Act 1974 — production of information and documents relating to the firm's use of artificial intelligence

Under section 44BA, we may require you to attend and explain any document or information you produce. Producing the record is the floor; explaining it is the standard.

You are required to produce:

  1. 1.A register of every AI tool in use at the firm, including any tools staff use without formal approval.[Code for Firms 2.1 · Code for Firms 2.5]
  2. 2.The named human reviewer for every AI-assisted client communication sent this quarter.[Code for Firms 4.4 · Code for Solicitors 3.5]
  3. 3.The verification trail for every authority cited in AI-assisted research relied on in a live matter.[Code for Solicitors 1.4 · Code for Solicitors 3.2]
  4. 4.The rule applied in each AI-influenced client onboarding and AML screening decision.[Code for Firms 2.1 · Code for Firms 2.2]
  5. 5.A record of any client or matter data entered into tools outside the firm's control.[Code for Solicitors 6.3]
  6. 6.The accountable individual, by name, with timestamps, for all of the above.[Code for Firms 2.2 · Code for Firms 9.1 (COLP) & 9.2 (COFA)]

This notice engages your duties to cooperate with, and respond promptly to, the SRA (paragraphs 7.3 and 7.4 of the Code of Conduct for Solicitors; 3.2 and 3.3 of the Code for Firms). A failure to produce the documents required may constitute an offence on summary conviction and may be a ground for intervention under Schedule 1 to the Act.

Yours faithfully,

Regulatory Supervision

Illustrative specimen · not regulator correspondence

The power is real.

The letter is a specimen. The statutory power behind it is not.

  • s.44B Solicitors Act 1974legislation.gov.uk

    The SRA may serve notice requiring your firm to provide information and produce documents. The notice sets the period for response.

  • s.44BA Solicitors Act 1974legislation.gov.uk

    It can then require you to attend and explain what you produced — the reasoning, not just the file.

  • Schedule 1 Solicitors Act 1974legislation.gov.uk

    Failing to produce documents is an offence on summary conviction, and non-compliance is itself a ground for intervention.

  • Cooperation duties 7.3 / 7.4SRA Code for Solicitors

    You must cooperate with the SRA and respond promptly with full and accurate explanations, information and documents.

This is not legal advice. Read the primary sources at the links above.

The readiness check

Could your firm produce these today?

Six records. Answer privately — nothing is recorded or sent. At the end, a printable verdict you can take to a partners' meeting.

  1. 01

    A register of every AI tool in use at your firm — including the ones staff adopt without asking?

    What the SRA expects

    A current, named inventory — which tools, used by whom, for what, and under what approval. A general IT-usage policy is not a register, and shadow tools no one wrote down still count.

    Code for Firms 2.1Code for Firms 2.5

    In LegalAI Spacethe governance dashboard already lists every agent and every run — the register is a by-product of the work.

  2. 02

    The named human who reviewed each AI-assisted client communication your firm sent this quarter?

    What the SRA expects

    A specific person, not 'the fee earner'. The SRA expects supervision you can evidence: who checked the output, and that a qualified person took responsibility before it left the firm.

    Code for Firms 4.4Code for Solicitors 3.5

    In LegalAI SpaceEvery output is send-gated behind a named human sign-off before it can leave the firm.

  3. 03

    The verification trail for every authority cited in AI-assisted research relied on in a live matter?

    What the SRA expects

    Evidence that each case, statute and citation was checked against the source — not that the tool 'seemed confident'. After the fabricated-authority judgments, an unverified citation is a live regulatory risk.

    Code for Solicitors 1.4Code for Solicitors 3.2

    In LegalAI SpaceThe Legal Citation Verifier re-fetches each authority from BAILII, legislation.gov.uk and EUR-Lex, and the run is signed.

  4. 04

    The rule you applied in each AI-influenced onboarding and AML screening decision?

    What the SRA expects

    For every decision an AI touched: which rule was applied, what it returned, and who owned the outcome. A model output with no recorded basis is not a decision you can defend to the SRA — or under your AML obligations.

    Code for Firms 2.1Code for Firms 2.2

    In LegalAI SpaceThe Client Intake agent applies and logs the rule on each onboarding decision.

  5. 05

    A record of any client or matter data entered into a tool outside your firm's control?

    What the SRA expects

    Confidence — evidenced, not assumed — that client confidential information was not pasted into a public model. Where it was, you are expected to know, and to be able to say so.

    Code for Solicitors 6.3

    In LegalAI SpacePII Redaction strips personal data before any model sees it — nothing leaves the tenancy unredacted.

  6. 06

    The accountable person — by name, with timestamps — for all of the above?

    What the SRA expects

    One answer to 'who is responsible', tied to records with dates. The COLP and COFA carry this personally; 'the firm' is not a name the regulator accepts.

    Code for Firms 2.2Code for Firms 9.1 (COLP) & 9.2 (COFA)

    In LegalAI SpaceEvery run is signed and attributed by name, and reproducible on demand.

AI Governance Readiness Scale
  1. 1Unaware

    No register, no reviewer trail, no verification record. AI is already in use; the evidence that it was governed is not.

  2. 2Paper

    Policies exist. The evidence behind them would have to be reconstructed after the event. Most of the market sits here — and believes it sits higher.

  3. 3Managed

    Some records are kept, unevenly. Producing them for an audit takes people, time and chasing across systems.

  4. 4Evidenced

    Most records exist and can be produced, but assembling them into an answer is still manual work.

  5. 5Producible

    The record is born with the work — signed, attributed and verified as it happens. Produced in minutes, not fourteen days.

Answer all 6 to see your verdict. 0/6 answered. Nothing you enter is recorded or sent.

The reframe

There are two ways to survive an SRA AI audit.

Reconstruct the record after the event, or govern the work so the record already exists. One is a forensic exercise under deadline. The other is a by-product of doing the work.

Exhibit A

Reconstructed after the event

What after-the-fact monitoring, policy folders and interview-based reconstruction produce.

Drafted with
an assistant — no reviewer recorded
Source
unverified
Tool
unregistered
Completeness
unknown
Exhibit B

Born governed

The same day inside LegalAI Space.

Reviewer
named, signed off
Citations
re-verified at source
Tool
registered, in-tenancy
Events captured
6 of 6 · producible on demand

After-the-fact monitoring watches AI happening in other tools and tries to write a record about it. LegalAI Space is where the work itself happens — governed at the door, verified at the source, signed as it goes. The audit answer is not reconstructed. It already exists.

The cost

What failing to produce actually costs.

The gap between a policy and a record is not abstract. It is measured in penalties, published outcomes, partner hours and client trust.

96%

of UK firms use AI in their operations

Clio Legal Trends 2024 (UK)

10%

have a formal policy governing that use

Thomson Reuters, 2024

59%

of fee earners admit using unapproved AI tools

Access Legal / Censuswide, 2026

Penalties

The SRA can fine a traditional firm up to £25,000 internally — and, for economic-crime matters, without limit since ECCTA 2023. Cases above its cap go to the SDT, whose fine is unlimited. For firms with EU clients, the AI Act adds penalties up to €15M or 3% of turnover for high-risk breaches.

SRA financial penaltiesEU AI Act Art. 99

Reputation

SRA referrals and tribunal outcomes are published. AI-fabricated citations are now named in national judgments — in Ayinde v Haringey [2025] EWHC 1383 (Admin) the Divisional Court set out lawyers' duties on AI-assisted research and referred the individuals involved to their regulators.

[2025] EWHC 1383 (Admin)

Cost of the exercise

Even without a fine, a section 44B notice consumes partner time, defence costs and a disclosure exercise across every matter an AI tool touched. When the records were never kept, the cost is the reconstruction — not just the outcome.

s.44B Solicitors Act 1974

Clients

Confidentiality (Solicitors 6.3) is breached the moment client data is pasted into a public model — and 59% of UK fee earners admit using unapproved AI tools. Clients' own due-diligence questionnaires increasingly ask how you govern AI.

Code for Solicitors 6.3Access Legal / Censuswide, 2026

Every one of these is cheaper to prevent than to explain.

The proof

The record is a screenshot, not a promise.

This is the live app. The COLP governance view, the verified memo and the governed run below are captured from app.legalaispace.com — where the record is produced as the work happens.

LIVEapp.legalaispace.com/governance/colp — COLP governance view
The live COLP governance dashboard: severity-ranked flags, SRA Code and EU AI Act checks, and a fabricated-citations-caught counter.
LIVEapp.legalaispace.com — a verified research memo, citations re-fetched
A research memo in the live app with citation chips, each authority re-verified against BAILII, legislation.gov.uk and EUR-Lex.

Six gates between a question and a memo.

part of 19 governance checks
  1. 1Planning Protocol
  2. 2PII Redaction
  3. 3Conflict Check
  4. 4Jurisdiction Gatekeeper
  5. 5Legal Citation Verifier
  6. 6Regulatory Compliance Check

Every run ends in a signed, reproducible record — the evidence a regulator, a COLP and a supervising partner can all stand behind.

For firms with EU clients

UK-only governance is half an answer.

If you act for clients with EU exposure, the EU AI Act reaches you too. Legal AI is classified high-risk, and the record it demands is the record we already produce.

  1. Live now

    Prohibited practices and GPAI obligations apply

    Prohibited AI practices have applied since 2 February 2025; general-purpose AI model obligations since 2 August 2025.

  2. 2 August 2026

    Transparency obligations (Article 50)

    Providers and deployers must disclose AI-generated content and AI interaction. This date is unchanged.

  3. 2 December 2027

    High-risk obligations for legal AI

    AI assisting the administration of justice is high-risk (Annex III, point 8). These obligations were moved from 2 August 2026 to 2 December 2027 by the Digital Omnibus, adopted by the European Parliament and Council in June 2026.

Article 12 · record-keeping

Article 12 requires high-risk systems to keep automatic logs across their lifetime. Our signed, reproducible run record is built to export as exactly that evidence — so a firm with EU clients answers the UK and EU questions from one record.

How LegalAI Space maps to the EU AI Act
Questions

SRA AI audits, answered.

How verification, governance, and the agents work inside an SRA-regulated firm.

Still have questions? Talk to the founder
Yes. Under section 44B of the Solicitors Act 1974 the SRA can serve notice requiring your firm to provide information and produce documents, and under section 44BA require an explanation. There are no AI-specific rules — the existing SRA Standards and Regulations govern how you adopt and supervise AI.

Book the pilot call. Bring your verdict.

A 30-minute call with founder Daman Kaur, who reads every reply. One-week guided onboarding, and your data stays in the UK or EU. The record starts producing itself from day one.

Book a pilot callEmail hello@legalaispace.com
Important notices
  1. 01

    LegalAI Space is a technology platform, not a law firm. Nothing on this page is legal, regulatory or compliance advice, or a guarantee of regulatory compliance. Seek independent professional advice before acting.

  2. 02

    The production notice, exhibits and audit records shown here are illustrative specimens, not regulator correspondence, and do not reproduce any real firm's matter.

  3. 03

    References to the Solicitors Act 1974, the SRA Standards and Regulations and the EU AI Act (Regulation (EU) 2024/1689) are for information only. Consult the primary sources linked on this page.

  4. 04

    EU AI Act dates reflect the Digital Omnibus adopted by the European Parliament and Council in June 2026, which moves high-risk obligations to 2 December 2027 and enters into force on publication in the Official Journal. Dates are time-sensitive.

  5. 05

    Every statistic carries its named source on this page. The 59% shadow-AI figure is an industry survey (Access Legal / Censuswide, 2026).

  6. 06

    The readiness check is a self-assessment, not a compliance audit or a regulatory opinion. Your answers are not recorded — we count only that the check was completed.

  7. 07

    Product features are described as built or in development, and screenshots are captured from the live app. No certification, accreditation or regulatory approval is claimed.