SRA AI Warning Notice: what it means for your firm in 2026

Drafted with Lex, reviewed and validated by Anis Aidoudi

On 17 August 2026 the Solicitors Regulation Authority published a warning notice, "Misuse of AI". It applies to all firms and individuals the SRA regulates. This guide summarises what the notice says, which SRA Code duties it points to, and how to think about client confidentiality when choosing AI tools. It is a summary, not legal advice: read the notice itself and take professional advice where needed.

1. What the SRA published

The notice reminds firms and solicitors that their existing professional obligations apply whenever AI is used in legal services. The SRA takes an outcomes-focused approach: it sets standards but does not prescribe how firms must meet them or which tools they must use. It says it will have regard to the notice when exercising its regulatory functions, and warns that failing to have proper regard to it puts you at risk of disciplinary action.

2. The two concerns

• Inaccurate AI-generated content, including fabricated case citations put before the court.
• Risks to client confidentiality, particularly clients' personal data and other confidential information, when AI systems are used.

On the first point, the SRA refers to R (Ayinde) v Haringey LBC [2025] EWHC 1383 (Admin), where false citations were put before the court and the lawyers involved faced a wasted costs application and referral to their regulators.

3. AI tools and client confidentiality

The SRA says both paid-for and free-to-use AI tools may lack the contractual and technical safeguards needed to maintain client confidentiality, and that firms should understand the safeguards that apply and make sure they are appropriate to the sensitivity of the information.

Depending on the provider's terms, settings and technical architecture, information entered into an AI system may be stored, retained or used to improve the tool. The notice also refers to UK v Secretary of State for the Home Department [2026] UKUT 81 (IAC), where the Upper Tribunal commented that entering client documents into an open-source AI tool such as ChatGPT places that information in the public domain. The SRA adds that this kind of use is likely to breach client confidentiality and may waive legal professional privilege permanently.

4. What firms should be satisfied about

The notice says client information should only be entered into AI systems where appropriate contractual, technical and organisational safeguards are in place. Firms and solicitors should satisfy themselves that client data:

• stays within a secure environment
• is not accessed by unauthorised third parties
• is not used to train AI models, except where explicitly authorised and appropriate
• is not retained longer than necessary

The notice also acknowledges that many firms are exploring in-house AI systems, and says client confidentiality must be maintained at all times in any AI or wider technology used.

5. Supervision and accountability

AI has no separate legal personality. Solicitors who use it remain accountable for their work and outputs, whatever tools were used. Those who supervise or manage others remain accountable for work carried out through them, and firms need effective governance, systems and controls to manage the risks, including those arising from AI.

6. SRA Code provisions the notice points to

• Paragraph 6.3 of both Codes of Conduct: keep clients' affairs confidential.
• Paragraphs 3.2, 3.5 and 3.6 of the Code for Solicitors: competent service, supervision, and competence of those you manage.
• Paragraph 2.4 of the Code for Solicitors: only put forward arguable submissions to the court.
• Paragraphs 2.1, 4.3 and 4.4 of the Code for Firms: governance, systems and controls, competence of managers and employees, and supervision of client matters.

7. Where LegisBox fits

LegisBox is designed to help firms keep client data within their own control. LegisBox Private runs the AI model inside your practice, so your files are not sent to a third-party host. LegisBox Cloud pseudonymises documents before processing. LexPrivacy is a free Windows and Mac program that pseudonymises documents on your computer before you send them to any AI service. No tool can guarantee compliance: each firm remains responsible for checking the safeguards that apply, as the SRA notice asks.