Yes. The Law Society's practice note "Using artificial intelligence in legal practice", dated 21 October 2026, has a section on AI in existing software. It says that where AI is embedded in software a firm already uses, the firm "may not always have clear visibility" of where AI systems are operating, what data they can access and process, and how the underlying models are changing over time.
The note says this "can make governance, inventory management and risk assessment more challenging". The step it suggests is "requesting regular updates from your existing technology suppliers regarding any AI functionalities".
The Law Society describes the note as its "view of good practice in this area" and says it "is not legal advice".
What does the Law Society say an AI register could record?
An AI register is a record of the AI systems a firm has approved and how they are used. The practice note says a firm "may wish to develop an AI register to support with AI governance, reporting and insurance". It says this may be a register of:
- approved AI systems
- approved use cases
- the owner of each AI system
- dates of approval and future reviews
The note does not say a register is mandatory. It presents it as an option.
Does a law firm need a separate AI policy?
Not according to the practice note. It says a firm "is not required to have a standalone internal AI use policy", but that AI poses unique risks and its adoption and use "may justify a separate policy". It also says an AI policy "should not be limited to generative AI only but capture all use of AI systems within your organisation".
The note lists what an effective AI policy might include: which AI systems are approved, how to access them, limits on their use (including clear provisions on client data), and any prohibited uses. It says it is important to make new starters aware of AI policies as part of any formal induction process.
What does the note suggest a firm reviews over time?
Its section on audit and explainability says a firm should periodically review which AI systems are being used, who is using them, what information is uploaded, how the systems perform, recurring errors, changes to risks, how well controls work, new functionalities, compliance incidents and client complaints.
It adds that a firm doesn't need to understand exactly how an AI system works, but "should understand where and how it is being used, and the associated risks". For firms exploring AI that processes personal data, the note points to a voluntary audit from the audit team of the Information Commission (still known as the ICO).
How does this fit with what the SRA has said?
The practice note is Law Society guidance, not an SRA rule. The note itself records that the SRA published a warning notice on the misuse of AI in August 2026. Separately, the SRA's consultation on updating the Statement of Solicitor Competence, opened on 8 October 2026, closes at 23.59 on 3 December 2026.
Margo Legal is not a law firm and does not give legal advice.
Frequently asked questions
Does the Law Society's AI practice note cover AI built into software a firm already uses?
Yes. The Law Society's practice note "Using artificial intelligence in legal practice", dated 21 October 2026, has a section on AI in existing software. It says that where AI is embedded in software a firm already uses, the firm "may not always have clear visibility" of where AI systems are operating, what data they can access and process, and how the underlying models are changing over time.
What does the Law Society say an AI register could record?
An AI register is a record of the AI systems a firm has approved and how they are used. The practice note says a firm "may wish to develop an AI register to support with AI governance, reporting and insurance". It says this may be a register of:
- approved AI systems
- approved use cases
- the owner of each AI system
- dates of approval and future reviews
Does a law firm need a separate AI policy?
Not according to the practice note. It says a firm "is not required to have a standalone internal AI use policy", but that AI poses unique risks and its adoption and use "may justify a separate policy". It also says an AI policy "should not be limited to generative AI only but capture all use of AI systems within your organisation".
What does the note suggest a firm reviews over time?
Its section on audit and explainability says a firm should periodically review which AI systems are being used, who is using them, what information is uploaded, how the systems perform, recurring errors, changes to risks, how well controls work, new functionalities, compliance incidents and client complaints.
How does this fit with what the SRA has said?
The practice note is Law Society guidance, not an SRA rule. The note itself records that the SRA published a warning notice on the misuse of AI in August 2026. Separately, the SRA's consultation on updating the Statement of Solicitor Competence, opened on 8 October 2026, closes at 23.59 on 3 December 2026.
Sources
- The Law Society, "Using artificial intelligence in legal practice" (practice note), 21 October 2026: https://www.lawsociety.org.uk/topics/ai-and-lawtech/using-artificial-intelligence-in-legal-practice (sections "AI in existing software", "AI registers", "AI policies" and "Audit and explainability"; read 23 Oct 2026)
- SRA, "Review of the Statement of Solicitor Competence and the SQE Functioning Legal Knowledge" (consultation), 8 October 2026: https://www.sra.org.uk/sra/consultations/consultation-listing/review-competence/ (read 23 Oct 2026)