Solicitors Regulation Authority issues a Warning Notice on the misuse of AI

The SRA has published a Warning Notice on 17 August 2026 cautioning against the misuse of AI in legal practice and advising on how AI can be used responsibly. The Warning Notice follows 42 reports of potential AI misuse received by the SRA in the twelve months to July 2026, with a number of investigations, covering inaccurate legal citations, supervision failures and confidentiality breaches, currently ongoing. Whilst the SRA has recognised that many solicitors and law firms use AI safely and responsibly, it has identified a number of cases involving the misuse of AI, particularly relating to inaccurate AI-generated content and potential breaches of client confidentiality and wider data protection requirements.

KEY CONCERNS 

The Warning Notice draws out two particular concerns relating to:

• False or incorrect information being submitted to the court or included in other documents. In particular, the regulator has flagged the risks of AI ‘hallucinations’, such as the generation of fictitious cases, references and factual assertions which have no factual basis.
• Maintaining client confidentiality. The SRA has warned that both paid-for and free-to-use AI tools may lack the contractual and technical safeguards necessary to maintain client confidentiality. In particular, the regulator has raised concerns about confidential client information being entered into public AI tools which, it says:

“will likely breach client confidentiality and as a result, legal professional privilege may be permanently waived.”

The SRA has cited a number of high-profile cases to illustrate these concerns. On the hallucination point, the risks are self-evident: from the client's perspective, reliance on fabricated authorities may lead to fundamentally flawed advice; from the court's perspective, the integrity of proceedings is undermined when fictitious case law is placed before a tribunal. The SRA's decision to draw this to the attention of the profession in such stark terms will, one hopes, amount to no more than a reminder of what solicitors already know — not least given the significant publicity surrounding cases such as R (on the application of Ayinde) v Haringey LBC [2025] EWHC 1383 (Admin) which concerned two cases that were referred to the Divisional Court and listed together under the court's Hamid jurisdiction. We reported on the earlier Administrative Court judgment in Ayinde here. Ultimately in Ayinde, the offending solicitor and barrister faced a wasted costs application and were referred to their respective professional regulators for 'improper' and 'unreasonable' conduct.

Similarly, in the UK v Secretary of State for the Home Department [2026] UKUT 81 (IAC), the Upper Tribunal commented in obiter on the potential for the use of public AI tools to breach confidentiality and waive legal professional privilege. The Tribunal observed that entering client letters and decision letters from the Home Office into an open-source AI tool, such as ChatGPT, may result in breaches of client confidentiality and could lead to legal professional privilege being waived.

RECOMMENDED STEPS 

The regulator has stressed that AI does not have a separate legal personality and that individuals who use AI remain responsible for their work. As such, the SRA recommended the following practical steps that firms and solicitors should take to mitigate the risks of AI misuse:

• Firms must have effective governance structures, systems and controls in place to manage any risks, including those arising from the use of AI.
• Solicitors should ensure that all submissions of case law authorities are genuine, relevant, have a verifiable citation, and advance the arguments being put forward.
• Solicitors should effectively supervise junior and non-authorised colleagues, and they remain accountable for work carried out through others. Solicitors must ensure that all work undertaken for clients is properly overseen.  This is effectively a restatement of the SRA’s more detailed Effective Supervision Guidance, published in June 2026 following the Court of Appeal’s decision in Mazur v CRS [2026] EWCA Civ 369.
• Client information should only be entered into AI systems with appropriate contractual, technical and organisational safeguards in place to protect client confidentiality. Client data must remain in a secure environment, be inaccessible to unauthorised third parties, and not be used to train AI models unless explicitly authorised. This is particularly important for in-house solicitors, as AI tools developed by the business may not necessarily be designed with the safeguards required for legal work.

OVERVIEW 

The Warning Notice is a welcome step, but it addresses only two risks, hallucinations and confidentiality breaches, that will be familiar to much of the profession. As AI is embedded into increasingly sophisticated and bespoke workflows, the range of risks will inevitably widen and become harder to anticipate. The Notice also leaves a number of important practical questions unanswered,¹ and much has been left to the profession to work through. 

It is also notable that neither in the Warning Notice nor elsewhere in its published statements about the use of AI does the SRA foreshadow any amendments to the SRA Handbook (i.e. the Principles or the more detailed Code provisions) to regulate the use of AI: at least for the time being, the SRA seems comfortable that its existing regulatory arrangements provide a workable framework to regulate law firms’ use of AI.   

If one message emerges clearly, it is that the safe adoption of AI cannot rest on the diligence of individual practitioners alone: it requires firm-level commitment to appropriate policies, training and oversight arrangements, informed by a clear-eyed assessment of the risks peculiar to each use case.

NOTES

1. For instance, the tolerable level of risk in the use of AI – and, relatedly, the extent to which a solicitor would ordinarily be expected to “check” or “verify” AI outputs before they are relied upon.