Professional indemnity explained

Legal AI tools and your PII: Harvey, Legora, Westlaw and Lexis

Reviewed by the Apex broking team · Last reviewed 2026-11-06

Legal AI tools are platforms that use generative AI to help lawyers research, review and draft, such as Harvey, Legora, CoCounsel and Lexis+ with Protégé. They matter for PII because the firm, not the vendor, stays responsible for the work that reaches the client or the court.

Part of: Solicitors PI insurance

In short

Using a legal AI tool does not move responsibility away from the firm. The SRA's warning notice of 17 August 2026 says AI has no separate legal personality, so solicitors and supervisors remain accountable. On our reading of the SRA minimum terms, a negligence claim arising from AI-assisted work is civil liability like any other, and none of the permitted exclusions mentions AI, so qualifying cover should usually respond subject to the policy terms. Top-up layers, cyber cover and what you tell insurers at renewal need separate checks.

The short answer: the firm stays responsible

The SRA warning notice on the misuse of AI, published on 17 August 2026, is direct: AI has no separate legal personality, so the solicitor remains accountable for what it produces. Supervisors are accountable for AI-assisted work done by juniors, COLP duties apply, and firms are expected to have governance, systems and controls in place. The notice warns that failing to have proper regard to it puts solicitors at risk of disciplinary action.

The SRA says it received 42 reports of potential AI misuse between July 2025 and July 2026, covering inaccurate citations, supervision and confidentiality. It also added AI sections to its effective supervision guidance in June 2026.

The courts take the same line. In Ayinde v London Borough of Haringey; Al-Haroun v Qatar National Bank [2025] EWHC 1383 (Admin), the Divisional Court said lawyers must check AI-assisted research against authoritative sources before relying on it (para 7), and that managing partners must take practical and effective measures (para 9). So when AI-assisted work goes wrong, the claim is usually against the firm, and the firm's solicitors PI insurance is normally the first policy in the frame.

What the four tools say about themselves

The table summarises each vendor's own published statements. Apex has not tested or verified them, does not recommend any product and has no relationship with any of these vendors.

Tool	What the vendor says it does	Training on customer data	Hosting, per the vendor
Harvey	Drafting, research, analysis, data rooms and e-discovery	Says it does not use customer data for training	In-region options for EU or Switzerland, US or Australia; UK not mentioned (Harvey security)
Legora	Review, research and drafting, including a Word add-in	Says it will not use customer data to train or fine tune models	Tiered storage; no region named (Legora security)
Thomson Reuters CoCounsel and Westlaw	Research, document review and Deep Research on Practical Law and Westlaw Advantage	Says prompts and user content are not used to train	US by default; region-based hosting available in the UK (CoCounsel)
LexisNexis Lexis+ with Protégé	Research with linked citations, drafting and document analysis	Says customer data is not used to train public models	Primary and back-up locations in Europe (LexisNexis UK)

Each tool has its own page: Harvey, Legora, Westlaw and CoCounsel and Lexis+ AI and Protégé.

How SRA minimum terms PII is likely to respond

This is our reading of the SRA minimum terms and conditions, not a statement by the SRA, which has not said expressly how the terms apply to AI. Clause 1.1 requires cover for civil liability in connection with private legal practice. Clause 4.2 says insurers may exclude or limit liability only for the matters listed in clause 6. None of those exclusions mentions artificial intelligence, software or technology.

So a negligence claim from a missed clause in an AI-assisted review, or a wrong point in AI-assisted advice, is civil liability like any other. Qualifying cover should usually respond, subject to the excess, limits, aggregation and the listed exclusions.

Where to look more closely

Cyber and data protection. Clause 6 lets insurers exclude cyber-acts, system failure and breach of data protection law, provided this does not exclude civil liability under clause 1.1 or covered defence costs. See permitted exclusions and the cyber and PI overlap.
Top-up layers. Cover above the SRA minimum is commonly written on the insurer's own wording, which may carry AI or technology language. Check your top-up insurance and our guide to AI exclusions and clauses.
Fines and sanctions. Fines and penalties are a permitted exclusion, so a regulatory fine is unlikely to be covered.

For the wider picture, see does PI cover AI mistakes and the SRA minimum terms explained.

Cyber, confidentiality and privilege

The SRA notice says client data should go into AI tools only with appropriate contractual, technical and organisational safeguards, and that privilege may be lost if confidential material is shared with public AI tools. Enterprise legal tools publish data handling terms for this reason, but the firm still has to check them against its own duties.

A data incident involving an AI vendor is usually a matter for cyber insurance for solicitors first: breach response, forensic costs and notifying the Information Commission (formerly the ICO), which Article 33 of UK GDPR requires within 72 hours where feasible for a reportable breach. A client's claim for loss caused by the breach may then involve PII. More on this in legal AI, confidentiality and cyber insurance.

Illustrative examples

These scenarios are illustrative only and do not describe any real firm or claim.

Example 1: the citation nobody checked. A trainee uses a research tool to prepare a note, and a cited authority is misdescribed. The supervising solicitor relies on it in a skeleton argument. Under Ayinde, reliance on others' work still needs checking (para 8). A wasted costs application would usually be a matter to notify to PI insurers, and the firm may face regulatory questions on supervision.

Example 2: the missed clause. A tabular review across a data room fails to flag a change of control clause, and the buyer client suffers a loss. That is a classic negligence claim. On our reading of the minimum terms, the cause being AI-assisted does not change how qualifying cover responds.

Example 3: the unapproved tool. A fee earner pastes a client's draft agreement into a free public tool. No claim follows yet, but the firm may need to assess confidentiality, privilege and data protection. Cyber cover terms and the firm's incident process matter here.

Common misunderstandings

"The vendor carries the risk." Vendor contracts vary and the SRA is clear that accountability stays with the solicitor. Read the terms; do not assume an indemnity.
"Citation-checked tools remove the need to check." Vendors describe these features as reducing risk. The judicial guidance says legal representatives are responsible for the material they put before the court.
"Insurers don't need to know." The duty of fair presentation under section 3 of the Insurance Act 2015 applies at every renewal. See telling your PI insurer about legal AI tools.
"AI errors are someone else's problem." See who is liable when legal AI gets it wrong.

A supervision checklist and what to tell your broker

Keep a list of approved tools and the work each may be used for.
Require every authority and quotation to be checked against an authoritative source before use.
Record who supervised and signed off AI-assisted work on the file.
Check each vendor's data handling, training, retention and hosting terms against your confidentiality duties.
Train staff, including non-fee earners, and block unapproved public tools on firm devices where practical.
Set out these controls in a written law firm AI policy and review it regularly.
At renewal, describe the tools, use cases and controls to your broker, and notify circumstances promptly when something goes wrong (notification of circumstances).

For tool-by-tool use cases, see AIpedia for solicitors and PI insurance for firms using AI. Apex arranges solicitors' PI and cyber cover; a broker reads every enquiry.

Sources

Frequently asked

Does solicitors' PI cover mistakes made using legal AI tools?

On our reading of the SRA minimum terms, usually yes for qualifying cover. A negligence claim from AI-assisted work is civil liability under clause 1.1, and none of the permitted exclusions mentions AI. Top-up layers may be written on different wording, and cover always remains subject to the policy terms, limits and excess.

Is the AI vendor liable if its tool gets something wrong?

It depends on the vendor's contract, which varies. The SRA's August 2026 warning notice says AI has no separate legal personality, so the solicitor remains accountable to the client and the court. Firms should read vendor terms carefully rather than assume any recovery from the vendor.

Do we have to tell our PI insurer that we use Harvey, Legora, CoCounsel or Lexis+ with Protégé?

Under the Insurance Act 2015 you must make a fair presentation of the risk at renewal. Insurer practice on AI questions varies, but describing the tools, the work they are used for and your supervision controls is a sensible way to meet that duty and avoid disputes later.

Does a citation-checking feature mean we no longer need to verify authorities?

No. Vendors present these features as reducing risk, not removing it. The Divisional Court in Ayinde said lawyers must check research against authoritative sources, and the judicial guidance says representatives are responsible for what they put before the court. Treat every citation as needing a human check.

Will cyber insurance cover a data breach at an AI vendor?

Cyber policies commonly cover breach response costs and some third party liability, subject to their terms, including how they treat incidents at a supplier. Check the outsourced or third party provider wording in your cyber policy, and how it sits with your PII.

Using legal AI tools? Have your PII reviewed before renewal

Tell us which tools your firm uses and how they are supervised. We will check how your PI, cyber and management liability respond, and what insurers will ask at renewal. No fee and no obligation. Or call 0117 325 0027.

Book a PI programme review Get a solicitors PI quote

Apex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information, not advice on your individual circumstances, and it does not guarantee that cover will be available or on what terms.