FCA authorised · FRN 724952 0117 325 0027Quote & buy →
Aipedia: Solicitors and law firms
AI can review a data room faster than any team, but the firm remains liable for liabilities it fails to report unless the agreed scope clearly excluded them. Due diligence claims are high-value, so how AI review is scoped, recorded and supervised matters.
Part of: AI in solicitors and law firms
In short
In M&A and financing work, AI tools classify data room documents, extract change of control, assignment and termination clauses, and flag unusual terms. The key risks are an unclear scope (sampling presented as full review), missed liabilities, and client or target data uploaded to vendor platforms without safeguards. Code 3.2 and 3.5 apply, and Code 6.3 covers confidentiality. A buyer who discovers an unreported liability may claim against the firm; under the SRA minimum terms that is usually covered civil liability, though several missed items may be aggregated as one claim depending on the wording.
Corporate teams use AI to sort thousands of documents into categories, pull key terms into a review table, identify contracts with change of control or exclusivity clauses, compare leases or customer contracts against a standard, and draft first versions of the due diligence report. Some teams run AI across every document; others use it to select a sample for human review. Both approaches can be sensible, but the client must understand which one was used.
The SRA's Misuse of AI warning notice says solicitors remain accountable however work is produced. Code 3.2 requires competent service, Code 3.5 makes you accountable for the work of others you supervise, and Code 7.2 requires you to be able to justify your decisions. The SRA's supervision guidance expects an authorised individual to keep ultimate responsibility for AI-assisted work.
Confidentiality is a separate duty. Data rooms contain the target's commercially sensitive material, personal data about employees and customers, and often information covered by NDAs. Code 6.3 and the notice's confidentiality safeguards apply: client information should only go into AI with contractual, technical and organisational protections, should stay secure and should not be used for training unless explicitly authorised.
Most due diligence claims turn on scope. If the engagement letter says the firm will review "material contracts", but the AI tool only flagged contracts above a value threshold and humans read a sample, the client may argue the firm promised more than it delivered. The engagement letter and the report should say:
The Law Society recommends agreeing with clients whether and how AI will be used on their matter. A clear scope does not remove liability for negligent review within that scope, but it narrows the argument.
Illustrative: a buyer's solicitors use AI to review 4,000 commercial contracts in a target's data room and read a sample of those flagged as high risk. The tool misclassifies a group of distribution agreements, missing a termination right triggered by a change of control. After completion, key distributors terminate. The buyer claims the report should have identified the risk and that the engagement letter promised review of all material contracts.
A claim that the firm failed to report a liability is a civil liability claim, which the SRA minimum terms require to be covered, at least £3m any one claim for recognised and licensed bodies and £2m otherwise. The closed list of permitted exclusions does not refer to AI, so the use of a tool does not of itself take the claim outside cover. Defence costs are in addition.
Aggregation is often important. Where one systematic AI error causes several missed items, insurers may argue they form a single claim (one limit, one excess), while the client may present them separately. The outcome depends on the aggregation wording: see aggregation under the SRA minimum terms. Large deals may need top-up cover, which is not bound by the MTC and may contain its own terms. Data breaches from a vendor platform may sit with a cyber policy rather than PI.
Apex arranges PI for solicitors and law firms, including firms with corporate and transactional practices. A broker can check whether your limits and top-up layers fit your deal sizes and how they treat AI-assisted review. See the AI in law firms hub, AI contract review and AI, confidentiality and privilege.
It can be, if the client understands and agrees it. The risk is a mismatch between what the engagement letter promises and what was actually reviewed. Record the method, thresholds and human review steps, and state limitations in the report.
Only with safeguards. The SRA notice expects contractual, technical and organisational protections, secure storage and no training use without authorisation. Check the data room terms and any NDA too, as they may restrict where documents can be processed.
It depends on the aggregation wording. Where one underlying error causes several losses, insurers may treat them as a single claim with one limit and one excess. Ask your broker how your primary and top-up policies aggregate claims.
Tell us about your firm and the work you do. A broker will review how your current PI treats AI-assisted work, or arrange new cover. No fee for a quote. Or call 0117 325 0027.
Start a PI quote Request a callbackApex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information about how AI is used in the profession and how insurance may respond. It is not legal, regulatory or insurance advice on your circumstances, and it does not guarantee that cover will be available or on what terms.
