The SRA's AI Expectations: What the Guidance Actually Requires

The SRA has issued AI guidance and most firms have read it. The problem is that reading guidance and actioning it are two different things. This briefing cuts through the language and maps exactly what the SRA expects from law firms using AI — with specific Code of Conduct paragraph references and a 10-point compliance checklist.

The Four SRA Obligations That Apply to AI Use

1. Competence — Code for Solicitors Paras 3.2 and 3.3 / Code for Firms Rule 4.2

Para 3.2 requires that the service you provide is competent and delivered in a timely manner. Para 3.3 is the one most AI commentary misses: you must maintain your competence and keep your professional knowledge and skills up to date. That is the paragraph that reaches your understanding of the tools you use. The SRA has made clear this extends to AI tools. A solicitor who uses an AI tool without understanding its capabilities, limitations, hallucination rates, and data handling practices is not meeting the competence standard. Ignorance of AI limitations is not a defence to a conduct complaint arising from AI-generated errors.

2. Client Confidentiality — Code for Solicitors Para 6.3

You must keep the affairs of current and former clients confidential unless disclosure is required or permitted by law. Using AI tools that process client information without adequate data protection agreements, without understanding where client data goes, or without client knowledge where consent may be required — all potentially breach this obligation. The fact that a fee earner used an AI tool without the firm's knowledge does not insulate the firm or the supervising partner from responsibility.

3. Supervision and Personal Accountability — Code for Solicitors Para 3.5 / Code for Firms Rule 4.4

Para 3.5 provides that where you supervise or manage others providing legal services, you remain accountable for the work carried out through them and you must effectively supervise work being done for clients. Read it precisely: it governs the supervision of people, not tools. Its application to AI is therefore indirect but unavoidable — where a person you supervise produced work using AI, that work is work carried out through them, and you answer for it. A partner using AI with nobody beneath them is caught by competence and confidentiality instead, not by 3.5. Code for Firms Rule 4.4 requires firms to have an effective system for supervising client matters. A firm that deploys AI tools without supervision protocols, verification requirements, or audit trails is not meeting this standard — and both the supervising solicitor and the firm face concurrent regulatory exposure.

4. Transparency with Clients — Code for Solicitors Para 8.6 · Law Society AI practice notes

Be precise about what does and does not exist here. The SRA Transparency Rules govern publication of price, service and complaints information — they say nothing about AI, and citing them for AI disclosure is a category error. The obligation that does bite is Code Para 8.6: you must give clients information in a way they can understand, so they can make informed decisions about the services they need and the options available. Where AI materially affects the cost, quality, or nature of the service delivered, that duty is engaged. The SRA has not yet mandated specific AI disclosure; the Law Society practice notes point the same way without creating a rule.

What the SRA Expects Firms to Have in Place

• A documented AI Acceptable Use Policy that governs which tools can be used, on what types of work, and with what oversight requirements
• An AI tool register identifying approved, conditionally approved, and prohibited tools — updated as the tool landscape evolves
• Data Processing Agreements with all AI tool vendors before those tools are used on client work
• Mandatory training for all fee earners on AI capabilities, limitations, and the firm's governance requirements — with completion records maintained
• An AI output verification protocol requiring qualified solicitor review before AI-generated work is used or sent to clients
• An AI incident reporting mechanism — so that AI-related failures, errors, or data incidents are captured, assessed, and escalated appropriately
• Named accountability for AI governance at firm level — the SRA expects someone to be responsible

What the SRA Will Look for in an Investigation

If the SRA investigates an AI-related conduct complaint, it will ask the following questions. Your answers determine whether you have a defence:

• Did the firm have a written AI governance policy in place at the time of the incident?
• Was the fee earner trained on AI use and the firm's governance requirements?
• Was the AI tool in use approved by the firm and subject to an appropriate DPA?
• Was the AI output reviewed and verified by a qualified solicitor before use?
• Was the client informed of AI use in a manner consistent with the firm's transparency obligations?
• When the incident occurred, did the firm have an incident reporting mechanism and did it use it?

If the answer to any of these is no, the firm's position in an investigation is significantly weakened. If the answer to most of them is no, the firm has no meaningful defence.

The 10-Point SRA AI Compliance Checklist

• Written AI Acceptable Use Policy — live, communicated to all fee earners, reviewed in the last 12 months
• AI tool register — approved / conditional / prohibited list, published and accessible
• Data Processing Agreements executed with every AI tool vendor before use on client work
• DPIAs completed for AI tools processing personal data
• Mandatory AI training delivered to all fee earners — completion records maintained
• AI output verification protocol — mandatory solicitor review before any AI output is used on a matter
• Client disclosure approach defined — when and how clients are told about AI use
• Matter-level AI use log — maintained for all active matters involving AI
• AI incident reporting mechanism — with defined SRA notification thresholds
• Named AI Governance Lead at firm level — with management committee accountability