Professional indemnity explained

A law firm AI policy: what the SRA and insurers expect to see

Reviewed by the Apex broking team · Last reviewed 2026-11-06

A law firm AI policy is a written set of rules on which AI tools staff may use, for which work, and how outputs are checked, signed off and recorded. It matters because it is the clearest evidence of the governance the SRA requires and the controls insurers want to understand.

Part of: Solicitors PI insurance

In short

The SRA does not prescribe an AI policy document, but it does require effective governance, systems and controls, records showing compliance, competent staff and effective supervision. A written AI policy is the practical way to show all of that. It should list approved tools, set out allowed and banned uses, require citations to be verified in authoritative sources, fix who signs off AI-assisted work, cover training and client communication, keep records, set incident reporting routes and be reviewed regularly. Insurers may ask about these controls at renewal, so keep the policy current and summarised.

The plain answer

No SRA rule says "have an AI policy". The SRA's warning notice on misuse of AI (17 August 2026) does not list required documents. What it does say is that firms must have effective governance structures, systems and controls to manage risks, including those from AI, under paragraph 2.1 of the Code of Conduct for Firms, and that failing to have proper regard to the notice puts firms at risk of disciplinary action.

A written policy is how most firms show they meet those duties. It tells staff what is allowed, gives supervisors something to enforce, and gives your insurer a clear account of how AI risk is controlled. A policy that sits in a drawer does none of this, so the aim is a short document people actually follow.

Where the expectations come from

Source	Expectation	Policy element it supports
Code for Firms, para 2.1 and 2.2	Effective systems and controls; records to demonstrate compliance	Approved tools, records
Code for Firms, paras 4.3 and 4.4	Competent staff; an effective system for supervising clients' matters	Training, sign-off
Code for Firms, para 9.1	The COLP takes all reasonable steps to ensure compliance	Ownership and incident reporting
Code for Solicitors, para 3.5	Supervisors remain accountable for work done through others	Supervision and sign-off
Ayinde [2025] EWHC 1383 (Admin), paras 7 to 9	Check AI research against authoritative sources; leaders must take practical and effective measures	Citation verification
Judicial AI guidance, 8 October 2025	Representatives are responsible for material put before the court	Court document rules
SRA warning notice, 17 August 2026	Safeguards before client data enters AI tools; privilege risk with public tools	Data rules, banned uses

The SRA also added AI sections to its effective supervision guidance in June 2026. It is worth reading alongside the notice when drafting the supervision part of your policy.

The core elements of a policy

Scope and ownership. Who the policy applies to (partners, fee earners, trainees, paralegals, support staff, contractors) and who owns it, usually the COLP or a named partner.
Approved tools list. Each tool, its approved version or licence, who may use it and for which matters. Anything not on the list is not approved.
Allowed and banned uses. For example, allowed: first-draft summaries, document review, research leads. Banned: client data in public tools, filing AI output unchecked, using AI for advice outside the fee earner's competence.
Data rules. What client data may go into which tool, with reference to the vendor's contract terms on training, retention and hosting.
Verification. Every authority must be opened and read in an authoritative source before it is relied on. Tool-level citation checks do not replace this.
Supervision and sign-off. Who reviews AI-assisted work at each level, and a rule that court documents and advice are signed off by a qualified lawyer.
Training. Induction and refresher training on each tool and on the policy, with attendance recorded.
Client communication. When and how clients are told about AI use, and how objections are handled.
Records. Which matters used AI, for what, and who checked the output.
Incident reporting. How staff report errors, near misses and data incidents to the COLP, and when the PI and cyber insurers are told.
Review cycle. A fixed review date, at least yearly and whenever a new tool or guidance arrives.

A model of accountability

The SRA's authorisation of Garfield.Law on 6 May 2025, an AI-based firm offering debt recovery up to the small claims process, shows how the regulator thinks about accountability. The SRA noted that the system is not autonomous, acts only on client approval and will not propose case law, which the SRA described as a high-risk area for large language models. It said named regulated solicitors will still ultimately be accountable, including for all system outputs.

Those three ideas transfer well into any firm's policy: a human approves key steps, high-risk tasks are fenced off or given extra checks, and a named lawyer is accountable for each piece of AI-assisted work.

Illustrative policy extract (hypothetical)

"No document containing a citation of authority may be filed with a court or tribunal unless the fee earner has read each authority in an approved primary source and the supervising solicitor has initialled the citation check on the file."

Illustrative rollout (hypothetical)

A 25-partner firm wants to introduce a contract review tool. Before approval, the COLP reads the vendor's data processing terms and checks where data is hosted. The tool goes on the approved list for the corporate team only, with a rule that a solicitor reviews every extracted clause against the source document. Fee earners complete a short training session, matters using the tool are flagged in the case management system, and the first review of how it is working is booked for three months later. At renewal, the broker presents a one-paragraph summary of the rollout and its controls.

Common mistakes

Banning all AI. A blanket ban can push staff to public tools on personal devices, which is where confidentiality and privilege risk is highest.
Approving a tool without reading its terms. Data, training and retention terms belong in the approval decision.
Forgetting junior and support staff. In a reported Birmingham case, an unreviewed draft filed by administrative staff contained false citations; the policy must reach everyone who touches documents.
Treating vendor citation checks as verification. The courts expect a lawyer to check.
No records. Without records, the firm cannot show the SRA or an insurer that its controls work.
No review date. Tools and guidance change quickly.

Supervision questions go wider than AI. Our page on Mazur and supervised litigation looks at supervision and PI more widely.

Showing the policy to your insurer

Insurers may ask how AI is controlled, and practice varies between them. Rather than sending the full policy unannounced, give your broker a short summary: tools, uses, verification, sign-off, training, records and any incidents. That keeps the presentation clear and accessible, which matters for the duty of fair presentation. Our page on telling your PI insurer about legal AI tools explains what to disclose and when.

For the wider picture, see our legal AI tools and PII hub, the SRA AI warning notice explained, AI research and fake citations and the solicitors PI insurance guide. Apex arranges solicitors' PI and cyber cover; a broker reads every enquiry.

Sources

Frequently asked

Does the SRA require law firms to have an AI policy?

Not in those words. The SRA requires effective governance, systems and controls, records demonstrating compliance, competent staff and effective supervision, and its August 2026 warning notice applies those duties to AI. A written AI policy is the most practical way to meet and evidence them, and failing to have proper regard to the notice risks disciplinary action.

What should a law firm AI policy include?

At minimum: scope and ownership, an approved tools list, allowed and banned uses, data rules, citation verification, supervision and sign-off, training, client communication, records, incident reporting and a review date. Keep it short enough that fee earners and support staff will actually read and follow it.

Who should own the AI policy in a law firm?

Usually the COLP or a named partner, because the COLP must take all reasonable steps to ensure the firm complies with SRA requirements. Ownership should include keeping the approved tools list current, receiving incident reports and arranging the review. Day-to-day sign-off of AI-assisted work stays with supervising lawyers.

Do we need to tell clients we use AI?

The SRA warning notice does not set an express rule on telling clients. Many firms address it in engagement terms or the policy, especially where client data goes into a tool. Decide your approach, apply it consistently, and handle any client objection. The judicial guidance says there is no general duty to disclose responsible AI use to the court, depending on context.

Will insurers ask to see our AI policy?

Some may ask about AI controls at renewal and practice varies. A short summary of your policy and how it works in practice is usually more useful than the full document. Present it through your broker so the information is clear and matches what you tell your cyber insurer.

Using legal AI tools? Have your PII reviewed before renewal

Tell us which tools your firm uses and how they are supervised. We will check how your PI, cyber and management liability respond, and what insurers will ask at renewal. No fee and no obligation. Or call 0117 325 0027.

Book a PI programme review Get a solicitors PI quote

Apex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information, not advice on your individual circumstances, and it does not guarantee that cover will be available or on what terms.