These are the questions to ask a legal AI vendor before your firm signs. The checklist is for partners, COLPs, COFAs and innovation, IT and operations leads at law firms of every size in England and Wales.
A legal AI vendor checklist is a set of written questions a firm puts to a supplier before it signs, covering the task, supervision, data, security, cost, training and exit.
Ask any legal AI vendor eight sets of questions before you sign: what exact task it does, who decides on each output, where your data is stored and processed, what security evidence it holds, what it costs over the whole term, how it trains your people, whether it works with your other tools, and how you leave.
By Margo Legal. Margo Legal is developing its own contract-review product, Margo (in controlled development). This checklist applies to every vendor, including us. Margo Legal is not a law firm and this is not legal advice.
What exactly will the tool do for us?
A demo shows a tool at its best, so pin down one workflow and one output first.
- Which single workflow and output are we buying it for?
- Does it work from our firm's own positions and house style, or from your defaults?
- Which jurisdiction's sources does it use, and can it show England and Wales sources?
- Will you run a test on our own synthetic or redacted material?
A good answer names one workflow, offers a test on your material and shows sources you can open. Our guide on how to evaluate a legal AI tool sets out a six-step test.
Who decides on each output, and is that recorded?
The firm stays responsible for the work, so the tool should make each lawyer's decision easy to make and easy to evidence.
- Does every output link to its source?
- Can the reviewer confirm, correct or reject each item?
- Are the decision, the reviewer and the time recorded, and can we export that record?
- If a second model checks the first, what is the human review step?
The Law Society's practice note of 21 October 2026 says relying on AI to verify AI outputs will not satisfy professional obligations if there are inaccuracies. See what human review means for legal AI.
Where is our data stored and processed?
Data can be stored in one place and processed in another, and a sales deck is not a contract.
- What data enters the service?
- Where is each type of data processed and stored?
- Who else can access it?
- What is used to train or improve models?
- What is retained, and how is it deleted?
- How is access controlled and evidenced?
- What happens when the service changes or fails?
Each of these seven data and security questions is covered in depth in our separate guide.
Ask for the storage region and the model processing region separately, and get both in writing. A vendor can offer different choices for each, so check both against your firm's policy and your clients' terms.
Where a vendor processes personal data for your firm, UK GDPR Article 28 requires the processing to be governed by a written contract.
What security evidence can you show?
A badge says little about what was tested, when and by whom.
- Which certifications do you hold, and what is the scope and date of each?
- Will you share the report or certificate itself?
- When was your last independent penetration test, and can we see the summary?
- Do you hold Cyber Essentials, the UK government-backed scheme, if it is relevant to us?
- Will you complete our security questionnaire in full?
Some legal AI vendors list SOC 2 Type II, ISO 27001 and ISO 42001, so the scope and date of each matter more than the name.
What will it cost over the whole term?
The headline seat or licence figure may not be the whole cost.
- Are your charges published, or quoted per firm?
- Is the charge per seat, by credits, by usage or a mix?
- Is there a seat minimum or a minimum spend?
- How long is the contract, does it renew automatically, and how much notice do we need to give?
- What is charged separately, such as onboarding, migration or connectors?
Connectors between tools can mean paying twice. A Legal Tech Circle round-up of 24 October 2026 noted that almost every connector announced that week still required a subscription to both products.
How will you help our people use it?
A login is not training, and adoption can start with a small group.
- What hands-on training do you give, and to whom?
- Can we start with a pilot team, then champions, then induction for new joiners?
- Will you report usage by team?
- Who supports us after go-live, and how quickly?
Definely's own case study on Brodies describes a pilot group in banking and corporate, professional development lawyers acting as champions, and a Definely module that new starters must complete within their first three months.
Will it work with the tools we already use?
Many firms now run more than one AI tool.
- Does it work inside Word, Outlook and our document management system?
- Which connectors exist today, and which are only planned?
- What would we be paying for twice?
Legal IT Insider's UK Top 200 table of November 2025 found that firms listing a generative AI tool used 1.8 on average. Hogan Lovells Cadwalader has chosen both Harvey and Legora, Legal Cheek reported on 20 October 2026, with the firm saying, "There is no single AI solution that will meet every need of a modern global law firm."
What happens if you change, get bought or close?
Legal AI vendors are bought, merged and wound down, so plan the exit before you sign.
- In what format, and how quickly, can we export our data?
- Will you certify deletion when we leave?
- How much notice will you give of a change of sub-processor or model?
- What happens to our contract and data on a change of control?
- What happens to our data if the product is withdrawn?
In January 2026, Artificial Lawyer reported that Robin AI, a UK contract-review vendor, had moved its managed services group to another company and that Microsoft was to hire its remaining technology team.
What stays with the firm, whatever the vendor says?
A vendor can share the work but not the responsibility. Supervision, confidentiality and client care stay with the firm.
The SRA's warning notice of 17 August 2026 says, "The use of AI does not diminish or transfer your professional responsibilities. You remain accountable for all work and advice delivered to clients, whether or not AI has been used in its preparation." Our summary of the SRA AI warning notice covers what it means in practice.
Which questions go on the checklist?
The questions above, grouped by section, with a column headed "Answer received in writing? Y/N".
| Question | Answer received in writing? Y/N |
|---|---|
| Which single workflow and output are we buying it for? | |
| Does it work from our firm's own positions and house style, or from your defaults? | |
| Which jurisdiction's sources does it use, and can it show England and Wales sources? | |
| Will you run a test on our own synthetic or redacted material? | |
| Does every output link to its source? | |
| Can the reviewer confirm, correct or reject each item? | |
| Are the decision, the reviewer and the time recorded, and can we export that record? | |
| If a second model checks the first, what is the human review step? | |
| What data enters the service? | |
| Where is each type of data processed and stored? | |
| Who else can access it? | |
| What is used to train or improve models? | |
| What is retained, and how is it deleted? | |
| How is access controlled and evidenced? | |
| What happens when the service changes or fails? | |
| Which certifications do you hold, and what is the scope and date of each? | |
| Will you share the report or certificate itself? | |
| When was your last independent penetration test, and can we see the summary? | |
| Do you hold Cyber Essentials, the UK government-backed scheme, if it is relevant to us? | |
| Will you complete our security questionnaire in full? | |
| Are your charges published, or quoted per firm? | |
| Is the charge per seat, by credits, by usage or a mix? | |
| Is there a seat minimum or a minimum spend? | |
| How long is the contract, does it renew automatically, and how much notice do we need to give? | |
| What is charged separately, such as onboarding, migration or connectors? | |
| What hands-on training do you give, and to whom? | |
| Can we start with a pilot team, then champions, then induction for new joiners? | |
| Will you report usage by team? | |
| Who supports us after go-live, and how quickly? | |
| Does it work inside Word, Outlook and our document management system? | |
| Which connectors exist today, and which are only planned? | |
| What would we be paying for twice? | |
| In what format, and how quickly, can we export our data? | |
| Will you certify deletion when we leave? | |
| How much notice will you give of a change of sub-processor or model? | |
| What happens to our contract and data on a change of control? | |
| What happens to our data if the product is withdrawn? |
Frequently asked questions
What should a law firm ask a legal AI vendor?
Ask about eight areas: the exact task, who decides on each output, where data is stored and processed, security evidence, cost over the whole term, training and support, fit with existing tools, and exit. Get the answers that matter most in the contract or data processing agreement, not only in a sales deck.
What certifications should a legal AI vendor have?
It depends on your firm's policy and your clients' terms. Some legal AI vendors list SOC 2 Type II, ISO 27001 and ISO 42001, an AI management standard. Ask for each certificate's scope and date and for the report itself, not just the badge, and ask for the latest independent penetration test summary.
Should a legal AI tool keep data in the UK?
It depends on your firm's policy and your clients' terms. Ask where data is stored and where the model processes it, because the two can differ and a vendor may offer different regions for each. Get both in writing before any client data goes in.
Is a legal AI tool just ChatGPT with a different screen?
Some legal AI tools use the same underlying models as general chat tools. Ask what the vendor adds, such as sources, your firm's positions, review records, data terms and training. Then test on your own material whether that is worth paying for.
Who is responsible if a legal AI tool gets something wrong?
The firm and its lawyers remain responsible. The SRA's warning notice of 17 August 2026 says, "The use of AI does not diminish or transfer your professional responsibilities. You remain accountable for all work and advice delivered to clients, whether or not AI has been used in its preparation."
How do we check a legal AI vendor will still be around?
Ask, in general terms, how the vendor is funded, how you would export and delete your data on exit, how much notice you would get of a change of control, and what happens to your data if the product is withdrawn.
Sources
- SRA, Misuse of AI warning notice, 17 August 2026: https://www.sra.org.uk/solicitors/guidance/misuse-ai/
- Law Society, Using artificial intelligence in legal practice, 21 October 2026: https://www.lawsociety.org.uk/topics/ai-and-lawtech/using-artificial-intelligence-in-legal-practice
- UK GDPR Article 28: https://www.legislation.gov.uk/eur/2016/679/article/28
- Information Commission (still known as the ICO), Guidance on AI and data protection: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/
- Definely, How Brodies embedded Definely into risk and compliance: https://www.definely.com/blogs/how-brodies-embedded-definely-into-risk-and-compliance
- Legal Cheek, Hogan Lovells Cadwalader bets on Harvey and Legora, 20 October 2026: https://www.legalcheek.com/2026/10/hogan-lovells-cadwalader-bets-on-harvey-and-legora-in-new-ai-strategy/
- Artificial Lawyer, Microsoft to acqui-hire Robin AI tech team, 9 January 2026: https://www.artificiallawyer.com/2026/01/09/microsoft-to-acqui-hire-robin-ai-tech-team/
- Legal IT Insider, UK Top 200 2025, 19 November 2025: https://legaltechnology.com/legal-it-insiders-uk-top-200-2025-the-gen-ai-battleground/
- Legal Tech Circle, 24 October 2026: https://legaltechcircle.com/insights/legal-ai-mcp-connectors-harvey-legora/
Margo Legal is not a law firm and does not give legal advice.