Thinking About Using AI in Your Legal Practice?

Successful AI adoption starts with a clearly defined purpose. Before introducing generative AI into legal practice, it is important to establish exactly what the technology is intended to do, where it will be used and the limits of its role.

We help turn a legal process, problem or opportunity into a defined AI use case, identifying the tasks involved, the information required, who will use it and where human professional judgement remains essential.

What we can help with: use-case definition, workflow mapping, scope and boundaries, information requirements, user requirements, AI task definition and human oversight.

A successful AI use case needs a clearly defined outcome. Before selecting or deploying a generative AI tool, the practice should establish what improvement it expects the technology to deliver and how success will be measured.

We help define practical and measurable outcomes for the use case, whether that is reducing time spent on a process, improving access to information, supporting research, increasing consistency or enabling professionals to focus on higher-value work.

What we can help with: outcome definition, success criteria, performance measures, efficiency objectives, quality requirements, expected benefits and pilot evaluation.

The use of generative AI does not remove or reduce a solicitor’s professional obligations. Any AI use case should be designed and operated within the requirements of the SRA Code of Conduct, SRA Standards and Regulations and SRA Principles.

Your practice determines the professional obligations that apply. We help translate those requirements into practical AI system, workflow and control requirements, ensuring that professional judgement, responsibility and appropriate human oversight remain part of the use case.

What we can help with: requirements mapping, workflow controls, human oversight, approval points, responsibility boundaries, audit requirements and governance design.

Guidance on the use of AI in legal practice will continue to develop as the technology, regulation and its use within the courts evolve. AI use cases therefore need to take account of relevant guidance from the SRA, the courts and other applicable regulatory bodies.

We help translate relevant guidance identified by your practice into practical requirements for the AI use case, ensuring that workflows and controls can be reviewed and adapted as guidance develops.

What we can help with: guidance requirements mapping, workflow design, control requirements, change management, periodic review, governance updates and audit trails.

Generative AI should operate within the wider policies and controls already established by the practice. This includes requirements relating to IT, AI use, confidentiality, information security and data governance.

We help translate these policies into practical requirements for the AI use case, defining how information can be accessed, processed and protected, and where additional controls may be required before AI is introduced into the workflow.

What we can help with: policy requirements mapping, data governance, confidentiality controls, access permissions, information security requirements, AI usage controls and governance design.

Choosing an AI vendor is not a one-time decision. Data management practices, security arrangements, model capabilities and technical standards can change, making regular review an important part of responsible AI use.

We help establish a structured approach to vendor assessment and ongoing review, identifying the data, security and technical requirements relevant to the AI use case and monitoring whether the chosen solution continues to meet them.

What we can help with: vendor assessment, data management review, security requirements, technical standards, data retention and processing requirements, periodic review and change monitoring.

The use of generative AI can raise important questions about ownership and rights over prompts, source and training data, and the outputs produced by the system. These rights should be understood before AI-generated material becomes part of legal workflows.

We help identify where ownership, usage and intellectual property requirements need to be established within the AI use case, so they can be considered when selecting vendors, designing workflows and determining how AI-generated outputs may be used.

What we can help with: rights requirements mapping, prompt and data controls, output usage requirements, intellectual property considerations, vendor requirements, data provenance and governance controls.

Understanding where your data goes is fundamental when using generative AI. A practice should know whether information remains within a controlled environment or whether prompts, documents or other data may be retained or used by third parties for model training.

We help define the appropriate system and data boundaries for the AI use case, including how information is processed, stored and shared, and whether the proposed technology provides the level of isolation and control the practice requires.

What we can help with: closed-system requirements, data boundaries, third-party training controls, data processing and retention, access controls, vendor assessment, information security and deployment requirements.

The use of generative AI in delivering legal services can affect the relationship between a practice and its clients. Clear communication helps ensure clients understand where AI may be used, the role it performs and where professional judgement and responsibility remain with the legal practitioner.

We help define where AI sits within the proposed legal workflow, enabling the practice to identify the appropriate points for client communication and establish clear boundaries around how AI contributes to the delivery of legal services.

What we can help with: AI workflow mapping, client communication requirements, transparency points, AI role definition, human oversight, responsibility boundaries and governance controls.

The information entered into a generative AI tool can include confidential, privileged, personal or commercially sensitive material. Before using AI, a practice should understand what information the use case requires and whether that information is appropriate for the proposed AI environment.

We help identify and classify the data required by the AI use case, establish appropriate information boundaries and determine what data should be permitted, restricted or excluded from the system.

What we can help with: input data mapping, data classification, confidentiality requirements, information boundaries, access controls, permitted and restricted data, data minimisation and governance controls.

Generative AI can introduce risks that extend beyond the technology itself, particularly where its use involves confidential information, intellectual property, personal data, cyber security, equality or ethical considerations. These risks should be identified and assessed in the context of each specific AI use case.

We help build a structured risk assessment around the proposed use case, identifying where risks may arise and translating the practice’s requirements into appropriate technical, operational and governance controls.

What we can help with: AI risk assessment, confidentiality controls, intellectual property considerations, data protection requirements, cyber security, equality and bias considerations, ethical risks, risk mitigation and control design.

The use of generative AI can create new questions around professional liability and insurance, particularly where AI-generated outputs contribute to legal advice, documents, decisions or services delivered to clients. These implications should be understood before an AI use case moves into practice.

We help define how AI will be used, where responsibility and human oversight sit within the workflow, and what risks need to be considered. Where appropriate, we will also engage with our insurance underwriters to help establish the insurance requirements and appropriate cover for the proposed AI use case.

What we can help with: liability requirements, AI risk assessment, professional responsibility boundaries, human oversight, insurance requirements, underwriter engagement, appropriate cover and risk controls.

The use of generative AI should leave an appropriate record of how the technology has been used. Where this is not automatically captured, inputs, outputs and identified errors should be recorded so that activity can be reviewed and decisions can be traced.

We help design auditability into the AI use case, defining what information should be captured, how records should be stored and how errors, corrections and human interventions can be documented throughout the workflow.

What we can help with: input and output logging, audit trails, error recording, correction history, human intervention records, data retention requirements, traceability and governance controls.

Generative AI can produce convincing outputs that are incomplete, biased or factually incorrect. Legal AI therefore requires clearly defined processes for checking accuracy, verifying facts and identifying potential bias before outputs are relied upon in professional work.

We help design appropriate review and verification into the AI use case, defining where human oversight is required, how outputs should be fact-checked and what evidence should support the information produced.

What we can help with: human-in-the-loop design, output verification, fact-checking requirements, bias identification and mitigation, source verification, evidence trails, accuracy controls and auditability.