Private AI for law firms: the SRA warning and what to do

What the SRA said

The Solicitors Regulation Authority published its Misuse of AI warning notice on 17 August 2026. The main points:

• Public AI tools may not have the safeguards needed to protect client information
• It cites an Upper Tribunal observation that uploading client letters to a tool such as ChatGPT puts that information in the public domain, which is likely to breach confidentiality and may permanently waive privilege
• Paid tools carry risks too: depending on their terms, settings and design, what you put in may be stored, kept or used to improve the service
• Client information should only go into AI systems with proper contractual, technical and organisational safeguards
• Solicitors stay responsible for anything produced with AI, including inaccurate research or citations

Where running AI yourself helps

When the model runs on a machine in your office:

• Client documents never go to an AI company, so there's no third party storing them or using them for training
• You decide what's kept, for how long, and who can see it
• It works without an internet connection, if you want it to

What it doesn't solve

• Accuracy. Local models can get things wrong just like cloud ones. Every output needs checking by someone qualified, exactly as the SRA says.
• Security. The machine is now part of your systems: it needs the same access controls, updates and backups as the rest.
• Data protection. UK GDPR still applies to personal data you process, wherever the model runs.
• Your own policy. Staff need to know what they can use it for, and what still needs a person.

Where it earns its keep

Typical first jobs are summarising long documents and bundles, producing first drafts of routine letters, and searching the firm's own precedents and notes in plain English. In each case a fee earner reviews the result.

Questions to ask anyone setting this up

• Where exactly does the model run, and does anything leave the building?
• Which model is it, and does its licence allow business use?
• What is logged, where, and who can read it?
• How is it updated, and who is responsible for that?
• What happens if the machine fails?

Next steps

See what it would cost with the local vs cloud AI cost calculator and which machine you'd need in what hardware you need to run AI locally. Private AI explains what we set up.

This guide is general information, not legal advice. Talk to your compliance officer (COLP) about how it applies to your firm.