How To Build An AI Governance Policy
If you are a law firm partner or barrister using AI in practice, you need a written AI governance policy that names who signs off on new tools, sets out how you supervise AI output, and proves you have met your competence and confidentiality duties. This applies in England and Wales, to you as a solicitor under the SRA or as a barrister under the Bar Standards Board. The BSB’s guidance, valid from 18th May 2026, treats the use of AI tools by barristers as a form of outsourcing under rule C86 of the BSB Handbook, which means you remain responsible for your own work and for compliance with BSB obligations when using AI. A policy that exists only in your head will not satisfy either regulator if a client complains or a court asks how an AI-drafted document came to contain an error.
Last reviewed – 31st August 2026
Summary
- You need a policy that names who approves each AI tool before you or your fee-earners start using it.
- Your policy has to set the point at which a partner, silk, or head of chambers checks AI output before it reaches a client or a court.
- You remain personally responsible for every AI-assisted piece of work, whether you are a solicitor or a barrister, so the policy has to make that responsibility visible in your workflow.
- Two 2025 High Court judgments involving fake AI-generated case citations, including one dealt with under the Divisional Court’s Hamid jurisdiction, show the professional consequences of relying on unverified AI research.
- Doing nothing leaves you unable to show a regulator, a judge, or a client that you exercised the competence and supervision your handbook already requires.
In April 2025, the High Court’s wasted costs judgment in R (Ayinde) v London Borough of Haringey [2025] EWHC 1040 (Admin) arose after a barrister’s grounds for judicial review cited five non-existent cases. Ritchie J found the barrister’s conduct improper, unreasonable, and negligent, and ordered both the barrister and the instructing law centre to pay £2,000 each in wasted costs. Ritchie J declined to make a positive finding, on the evidence before him, that AI had produced the fake citations, and referred the matter to the Divisional Court under the Hamid jurisdiction.
That case, together with the subsequent Divisional Court judgment in Ayinde v London Borough of Haringey; Al-Haroun v Qatar National Bank [2025] EWHC 1383 (Admin), handed down on 6th June 2025 by the President of the King’s Bench Division sitting with Johnson J, prompted the Bar Standards Board to move from general encouragement of AI adoption to a formal guidance document, Guidance on the use of Artificial Intelligence and Other Technologies, valid from 18th May 2026. The guidance confirms that any inaccuracies introduced through the use of AI remain your responsibility, and that using AI tools constitutes outsourcing a support service for the purposes of rule C86, whether used for legal or administrative work.
You face the same underlying exposure from a different angle if you are a solicitor. The Solicitors Regulation Authority’s Risk Outlook report on AI in the legal market states that, as with any other technology or system in your firm, you remain responsible and accountable for the outputs from AI you use, giving the example that if you use a third-party chatbot to provide initial legal advice, you remain responsible for any errors in that advice. Neither regulator has banned AI, and neither has created a bespoke AI licensing regime. Both have confirmed that your existing competence, confidentiality, and supervision duties already cover it, whether you have written that down or not.
If your chambers or firm has never drafted an AI policy, you are not currently operating outside the rules, but you have no record that anyone made a decision about what AI is allowed to do, who checks it, and what happens when it gets something wrong. Where does your policy need to start, and who in your practice actually needs to sign it?
Who should approve AI tools before fee-earners use them?
A partner, practice manager, or head of chambers needs to approve every AI tool before anyone in your practice uses it on client work, and you need to record that approval rather than assume it happened. Sign-off by silence, where a junior starts using a tool and nobody objects, gives you no defensible record if a client or the regulator later asks who authorised it.
The BSB’s guidance places procurement decisions squarely within existing chambers management standards, so the same person who would sign off a new case management system or a new outsourced typing service should sign off a new AI tool. The Law Society’s guidance, Generative AI: the essentials, tells you to involve IT, management, and legal teams in that decision, and to check whether the AI tool aligns with your firm’s strategy and existing policies before it goes anywhere near a client file. Skip that step, and your first record of the tool’s use becomes the output itself, with no paper trail showing anyone assessed it first.
If your chambers runs AI across multiple barristers, your approval record should state which tool, who approved it, what it may be used for, and what it may not touch, particularly privileged or sensitive client material. If you run a firm, the same record sits alongside your existing IT and data governance policies rather than replacing them.
How do you supervise AI output before it reaches a client or the court?
You need a fixed point in every matter at which a named senior fee-earner or barrister checks AI-generated content before it is sent to a client, filed with a court, or relied on in submissions. The Divisional Court’s judgment in Ayinde and Al-Haroun [2025] EWHC 1383 (Admin) shows what happens when that point does not exist: fabricated case citations reached the court because nobody checked them against a verified source first.
The Divisional Court, sitting under the Hamid jurisdiction, held at paragraph 7 that “those who use artificial intelligence to conduct legal research notwithstanding these risks have a professional duty therefore to check the accuracy of such research by reference to authoritative sources, before using it in the course of their professional work”. Competence in this sense is not abstract. It means you personally verify every case citation an AI tool produces against BAILII, a subscription database, or the judgment itself before it appears in a skeleton argument, because AI systems can generate plausible-sounding but entirely fictitious authorities.
The following table sets out where the checkpoint needs to sit depending on how you will use the AI output.
| Use of AI output | Who checks it | What they check before release |
| Internal drafting or summarising | You or the pupil using the tool | Accuracy against the underlying source document |
| Client correspondence or advice | A supervising partner or senior member of chambers | Legal accuracy, tone, and confidentiality of any data used |
| Submissions, skeleton arguments, or court filings | The instructed barrister or a named partner | Every case citation verified against BAILII or a subscription database, every statute checked against legislation.gov.uk |
A policy that names the checkpoint but not the person responsible for it will not survive contact with a real deadline, so name the individual role, not just the stage of the process.
What must the policy say about client confidentiality?
Your policy needs to state which AI tools may process client data and which may not, because sending confidential material into a public AI system without appropriate contractual safeguards can itself amount to a breach of confidentiality. The Law Society’s guidance is direct on this point: you should establish rights over prompts, training data, and outputs, and confirm whether a given AI tool operates as a closed system within your firm’s boundaries or also operates as a training model for third parties.
Before you approve any AI tool for use on client matters, check whether the provider’s standard terms allow your inputs to train future versions of the model, since that arrangement can expose privileged or confidential material to a wider audience than your engagement letter contemplates. If the tool is a public, consumer-facing system rather than one contracted specifically for your practice, treat it as unsuitable for anything beyond genuinely non-confidential, non-client-specific tasks.
If you are a barrister, the same question arises from the outsourcing angle the BSB guidance sets out: using AI amounts to outsourcing a support service under rule C86, so the same due diligence you would apply to any other outsourced provider, checking their data handling, their security, and their reliability, applies to the AI vendor as well.
How often should the policy be reviewed and by whom?
Review your AI governance policy at least annually, and immediately after any regulatory update, a new tool being added, or an incident involving an existing tool. The BSB issued its current AI guidance on 18th May 2026 after formal court proceedings, not a hypothetical scenario, exposed the gap between general encouragement of AI adoption and a working policy that catches errors before they reach a court.
Name a specific reviewer, whether that is a practice manager, a head of chambers, or a partner with responsibility for compliance, and log the date of every review alongside what changed. A policy you have not touched since you wrote it will not reflect either regulator’s evolving expectations, particularly while both the SRA and the BSB continue to publish updated guidance as AI use across the profession increases.
Talk to Lawtelligence
If your firm or chambers needs an AI governance policy that satisfies the SRA’s or the BSB’s current expectations, we can help you draft one built around how your practice actually uses AI, not a generic template. Get in touch with our team to discuss your situation.
Frequently asked questions
Can I rely on AI-generated legal research without checking it myself?
No, you cannot rely on AI-generated legal research without checking it yourself, because AI tools can produce fabricated case citations that read as entirely genuine. Check every case and statute an AI tool produces against BAILII, legislation.gov.uk, or a subscription database before it appears in any submission.
Does using an AI drafting tool reduce my personal liability for errors?
No, using an AI drafting tool does not reduce your personal liability for errors. The SRA’s Risk Outlook confirms that, as with any other technology in your firm, you remain responsible and accountable for the outputs from AI you use, whether or not AI was involved in producing the work.
Do chambers need a single AI policy or can each barrister set their own rules?
Chambers benefit from a single AI governance policy covering shared systems and client data, particularly where multiple barristers and staff use the same tools, because the BSB’s guidance treats AI procurement as falling within existing chambers management standards. You still carry personal responsibility for how you use AI in your own matters.
Author Corinne McKenna is the co-founder and director of Lawtelligence, a specialist legal marketing agency serving UK solicitors and barristers. With an LLB degree from the University of Canterbury and over 27 years’ experience in legal services sales and marketing, Corinne brings substantive legal knowledge to marketing strategy and brand development. Her background includes roles at LexisNexis in the UK and New Zealand, where she managed key legal accounts and delivered training to law firms. Corinne has authored widely on legal marketing topics for publications including Today’s Conveyancer and Solicitors Journal, with particular expertise in E-E-A-T principles, AI-optimised content, and SEO strategy for legal services.