SRA publishes binding guidance on generative AI use by solicitors

What happened

The Solicitors Regulation Authority (SRA) published detailed guidance this week on the use of generative AI by regulated solicitors and law firms in England and Wales. The guidance, which takes effect immediately, does not introduce new rules but clarifies how existing principles — including duties of competence, supervision, confidentiality, and client service — apply when firms deploy AI tools such as large language models for drafting, research, or client communications.

Key requirements include an expectation that firms establish clear internal policies governing which AI tools are approved for use, that supervising solicitors maintain meaningful oversight of AI-generated outputs, and that clients are informed where AI has played a material role in the delivery of legal services. The guidance also addresses data protection, stating that solicitors must satisfy themselves that client data entered into AI systems is handled in compliance with UK GDPR, and that firms should carry out due diligence on the data practices of third-party AI providers.

The SRA noted that it had received a significant increase in reports and queries related to AI use over the past 12 months, including incidents involving AI-generated hallucinated case citations being submitted to courts. The regulator stressed that responsibility for the accuracy and quality of work product remains with the individual solicitor and the firm, regardless of whether AI tools were used in its preparation.

SRA Chief Executive Paul Philip said the guidance was designed to support responsible innovation rather than discourage adoption, but warned that enforcement action would follow where AI use leads to breaches of existing standards. The SRA indicated it would review the guidance within 12 months and consider whether formal rule changes are needed.

What this means for your business

For law firms, this guidance effectively makes AI governance a compliance obligation rather than a best-practice aspiration. Firms that have been experimenting with tools like ChatGPT, Copilot, or specialist legal AI platforms now need documented policies covering tool approval, supervision workflows, and client disclosure protocols. Smaller firms without dedicated compliance or IT functions will need to move quickly — the SRA has made clear it considers existing rules sufficient to take enforcement action today.

The implications extend beyond law. The SRA's approach mirrors the direction of travel across UK professional services regulation. Accountancy firms regulated by the ICAEW, and financial advisers under FCA oversight, should expect similar clarifications from their own regulators in the coming months. The core principle — that professional responsibility cannot be delegated to an AI system — is likely to become a cross-sector regulatory norm.

Practically, firms should audit their current AI usage, formalise approval processes for new tools, and build AI review checkpoints into existing supervision and quality assurance frameworks. Training programmes that ensure all fee-earners understand both the capabilities and limitations of generative AI will be essential, particularly given the SRA's emphasis on the competence duty. Firms that get ahead of these requirements will be better positioned both for compliance and for building client trust in their use of AI.