Nearly every lawyer uses AI. Half worry about what it leaks.
Research, summarisation, drafting and review are now routine — so are hallucinated authorities and client material pasted into public tools.
of UK lawyers use AI; one in three daily (LexisNexis, 2026, vendor survey)
worry about hallucinated content, up 26 points since early 2024 (LexisNexis, 2026, vendor survey)
worry about confidentiality leaks (LexisNexis, 2026, vendor survey)
Accountability stays with a named person.
SRA warning notice, 17 August 2026: “AI has no separate legal personality; solicitors … remain accountable for their work and outputs, regardless of how that work has been prepared.” Putting client material into a public tool “is to place this information on the internet in the public domain”, and privilege may be lost for good. Professional indemnity insurers now ask for an AI policy, risk framework, training and monitoring evidence at renewal.
Regulator statements summarised from the published guidance; see the sources on the Problems page. This supports compliance; it is not legal advice.
- Legal research and case summarisation
- Contract review and clause extraction
- Drafting and first-pass review
- Client intake, AML and risk checks
- Client material in personal or public accounts
- Fabricated citations reaching a client or a court
- Partners buying tools per team with no register
Gateway with redaction and managed accounts for the tools fee-earners already use. Library so precedents and prompts are shared, not rebuilt. Usage Insight by practice group. Ledger as the record for the SRA and for clients.
Four agents, trained for this sector.
The rules, as controls.
- SRA Standards and Regulations
- SRA warning notice on AI (Aug 2026)
- Client confidentiality and privilege
- Money Laundering Regulations 2017
- UK GDPR and DUAA
Issues detected · needs attention first
| Issue | Rule | Severity | Owner | Status |
|---|---|---|---|---|
| Payroll file uploaded to an external AI tool | R-15 | High | HR Director | Blocked · reviewed |
| 31 personal AI accounts found in Sales | R-02 | High | Head of Sales | Migrating · 27 done |
| Customer data in a prompt without redaction | R-01 | High | Ops lead | Redacted · 0 left |
| Premium model used for internal drafts · 412 requests | R-07 | Medium | Engineering lead | Rerouted |
| CRM "AI assist" running without a DPIA | Policy | Medium | Head of Sales | DPIA in progress |
| Agent attempted an external email | R-12 | Low | S. Reid | Held · approved |
| Job | Owner | RAG | Effort | Cost to date | Forecast | Actual | Variance | Return / yr | Status |
|---|---|---|---|---|---|---|---|---|---|
| Migrate personal accounts to managed | IT Director | 12 d | £4,200 | £6,000 · 20 d | £4,200 · 12 d | −£1,800 · −8 d | risk | Done | |
| Route everyday tasks to standard tier | FD | 3 d | £900 | £1,200 · 4 d | £900 · 3 d | −£300 · −1 d | £58,400 | Done | |
| Payroll upload block (R-15) | HR Director | 1 d | £300 | £300 · 1 d | £300 · 1 d | 0 | risk | Done | |
| Collections letters via Comms agent | Head of Collections | 18 d | £11,600 | £14,000 · 25 d | — | on track | £96,000 | In progress | |
| KYC document checks | Head of Onboarding | 9 d | £5,100 | £9,000 · 15 d | — | on track | £61,000 | In progress | |
| Contact-centre adviser assist | Head of CS | 26 d | £19,800 | £16,000 · 20 d | — | +£3,800 · +6 d | £142,000 | At risk · vendor delay |
Effort, cost and return are recorded against each job as it happens. Done means the job is solved in production with its owner’s sign-off, not that a licence was bought.
From this sector.
Our professional indemnity insurer is asking about AI.
Evidence Packs give them the register, the controls and the exception log. Several insurers now ask for exactly that.
Where does our data go?
Nowhere new. Everything runs inside your own cloud account. Nothing routes through GenWA's infrastructure. Sensitive data is removed before a request leaves your environment.
Find out where your AI stands. Then decide.
Under a minute, an upload, or a visit. Something for the board either way.