AI for law firms is the use of software that drafts, summarises, extracts, or predicts from legal text, inside a firm's actual workflow, under the same professional obligations as any other way of working. That last part is the one vendors skip. The Solicitors Regulation Authority does not regulate "AI use" as a separate activity: it regulates your competence, your supervision, and your clients' confidentiality, whatever tools produced the work.
This is the landscape as it stands for a small firm in England and Wales: what the tools are, what the regulator has actually said, and the order to do things in.
What "AI for law firms" actually covers
The label gets stretched over four different things:
General-purpose assistants. ChatGPT, Copilot, Claude and similar. Cheap, fast, and not built for legal work. Useful for learning how the tools behave; dangerous the moment client-confidential material goes in without contractual and technical safeguards - the SRA's warning notice on misuse of AI names exactly this failure, including confidential client information entered into public AI tools (sra.org.uk/solicitors/guidance/misuse-ai/).
Legal-specific assistants. Tools trained and constrained for legal work, with legal data sources and, usually, data terms written for law firms. Dearer, narrower, and where most serious small-firm usage sits.
Contract and document tools. Review, extraction, comparison and drafting around contracts and bundles - the category our buyer's guide to AI contract review software covers in detail.
Practice-management AI. Features embedded in the systems a firm already runs. The quietest category and often the safest first step, because the data relationship already exists.
None of these categories removes the need for a fee earner's judgement. They change where the hour goes.
What the regulator expects
Three anchors, all public, all current:
The SRA's warning notice on misuse of AI. The SRA reports identifying cases of misuse, particularly inaccurate information and client confidentiality, and reminds firms that both paid and free tools may lack the safeguards confidentiality requires. It cites the Upper Tribunal's comments in UK v Secretary of State for the Home Department [2026] UKUT 81 (IAC) on public AI tools, confidentiality and legal professional privilege. The notice is blunt about accountability: AI has no separate legal personality, and the solicitor remains accountable for the work however it was prepared (paragraphs 3.2 and 3.5 of the Code of Conduct).
The Law Society's generative AI guidance. The essentials guide covers safe adoption: policy, training, verification, and supervision as day-to-day practice rather than a one-off project (lawsociety.org.uk/topics/ai-and-lawtech/generative-ai-the-essentials).
The ICO's AI and data protection guidance. Where a tool processes personal data - and client files are personal data - UK GDPR applies in full, including the Article 28 processor terms a DPA must contain (ico.org.uk, guidance on AI and data protection).
The short version: you may use AI. You may not outsource judgement, confidentiality, or supervision to it.
Where a small firm actually starts
The order that works, from the firms doing this well:
1. Policy before tools. One page: what may be used, for what, with whose data, and what must never go in. Our one-page AI policy template for small firms is built for exactly this and is free.
2. Find out what is already happening. Staff are using these tools whether or not the firm has a policy. A two-hour shadow AI audit tells you what is actually in use before you write rules nobody follows.
3. Fix the client-facing position. Whether and how you tell clients is a client-care decision, not a marketing one - the position and the wording are covered in our client-disclosure article.
4. Check your insurer's questions. AI use is now a renewal topic; the five questions to prepare for are published.
5. Then buy. Trial one workflow, measure total time to a checked output, and only then talk about seats. The evaluation method is in our guide to evaluating a legal AI tool.
What AI will not do
It will not know your client, carry your indemnity, or stand in front of the SRA. Every safe implementation ends the same way: a named human reviews the output, and the firm's supervision arrangements catch the rest. Any vendor pitch that skips this is selling to your fears, not your workflow.
Where Margo fits
Margo is Margo Legal's contextual legal AI assistant, in controlled development with design partners. It is being built around the shape above: confidentiality terms a firm can actually read, human review as the workflow rather than the exception, and outputs a solicitor can stand behind. Details at /margo/ - no capability claims until it ships.
FAQ
What is AI for law firms? Software that drafts, summarises, extracts or predicts from legal text, used inside a firm's workflow under the firm's normal professional obligations. The obligations do not change because a model produced the first draft.
Is it allowed under SRA rules? Yes - with conditions. The SRA's warning notice confirms use is permitted but names the failure modes it has already seen: inaccurate outputs and confidentiality breaches. Competence and supervision duties (Code of Conduct 3.2, 3.5) apply to AI-assisted work exactly as to any other.
Can we put client documents into ChatGPT? Not safely on a free or consumer tier. The SRA flags that free and paid tools alike may lack the contractual and technical safeguards client confidentiality requires. Check the data terms - training use, retention, deletion - before any client material goes in, and get a DPA where personal data is processed.
What should a small firm buy first? Nothing, first. Policy, an audit of current use, and the client-care position come before procurement. When you do buy, trial one workflow and measure total time to a checked output.
Do we have to tell clients we use AI? There is no single blanket rule, but transparency obligations and your own engagement terms make this a decision to take deliberately, not discover at renewal. Our client-care article walks the position.
Sources
- SRA warning notice "Misuse of AI" incl. UK v SSHD [2026] UKUT 81 (IAC) and Code 3.2/3.5 - https://www.sra.org.uk/solicitors/guidance/misuse-ai/
- Law Society "Generative AI - the essentials" - https://www.lawsociety.org.uk/topics/ai-and-lawtech/generative-ai-the-essentials
- ICO "Guidance on AI and data protection" - https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/.