AI governance for law firms: a one-page policy to adopt

AI governance for a law firm means knowing which AI tools are in use, deciding what each may be used for, making sure a person checks output before a client or court relies on it, and naming who is accountable. It can fit on one page. Since the High Court's 2025 Ayinde judgment, courts expect managing partners to have taken practical measures.

Most AI policies we see in firms are either a single line ('do not use ChatGPT') that everybody ignores, or a twenty-page document nobody has read. Neither governs anything. This piece gives you a one-page policy you can adapt, a register that makes it real, and a review routine that takes an hour a month. It is not legal advice. Take the draft to your COLP and DPO, who will know things about your firm that we do not. For the wider picture, see our guide to AI for UK law firms.

Why does a law firm need AI governance now?

Two things changed in 2025. First, in May the SRA authorised Garfield.Law, the first purely AI-based firm, and in doing so set out what it looked for: processes to quality-check work, keep client information confidential, safeguard against conflicts and manage the risk of hallucinations, with named solicitors accountable for every output. That is, in effect, a published description of what governing AI looks like to the regulator. We cover it in the first SRA-approved AI law firm.

Second, in June the Divisional Court handed down Ayinde v London Borough of Haringey [2025] EWHC 1383 (Admin), dealing with fictitious authorities put before the court. The judgment said practical and effective measures must now be taken by those with individual leadership responsibilities, naming heads of chambers and managing partners, to make sure everyone providing legal services understands their obligations when using AI. It added that the court can be expected to ask, in future hearings of this kind, whether those responsibilities have been fulfilled.

Put those together and governance is no longer optional good practice. It is something a partner may be asked to show.

What should a law firm AI policy include?

Six things. Anything more can live in an appendix. Here is a one-page template, written to be adapted rather than adopted as it stands.

[Firm name] AI use policy. Owner: [partner]. Reviewed: [date]. 1. Scope: this covers any tool that generates text, audio or decisions, including features inside software we already use. 2. Approved tools: only tools on the AI register may be used for firm work, and only on firm accounts. 3. Client information: never enter client or matter information into a tool that is not on the register for that purpose. 4. Human check: nothing produced by AI goes to a client, a court or another party until a named person has read and checked it, including every citation against an authoritative source. 5. Client-facing AI: any AI that talks to clients or the public says it is AI, never gives legal advice, and hands over to a person when it reaches its limits. 6. Problems: report any error, near-miss or data concern to [owner] the same day, without blame.

That is the whole policy. It is short on purpose. People follow rules they can remember, and each of those six lines maps onto an obligation the firm already has: competence, confidentiality, not misleading clients, and duties to the court.

What is an AI register and why does it matter?

The policy says what is allowed. The register says what is actually in use. Without it, the policy is a statement of intent. A register is a simple table with one row per tool, and these columns:

• Tool and vendor.
• What it is approved for, in one sentence.
• What it must not be used for.
• What data it may touch: none, firm internal, client information, special-category data.
• Where the data is processed and how long the vendor keeps it.
• Whether it is client-facing, and if so how it discloses that it is AI.
• Who checks its output, and how.
• Date approved, approved by, date of next review.

Start the register by asking. A short, blame-free question to every member of staff (what AI tools do you use for work, and for what?) will almost always turn up tools the partners did not know about. The SRA's Risk Outlook on AI makes the same point: staff might use freely available systems occasionally and casually, even without the firm formally adopting AI. Put what you find on the register, approve it, replace it or stop it.

Who should be responsible for AI in a law firm?

A named partner. In smaller firms that is often the COLP; in larger ones it may be a partner working with the COLP, the DPO and whoever runs IT. The important thing is that it is one person, and that they are senior enough to stop something. The Ayinde judgment names managing partners specifically. A policy owned by 'the IT team' or 'everyone' is owned by nobody. Write the owner's name at the top of the policy, not their job title, so that when people change roles somebody notices the gap.

How do you assess an AI tool before approving it?

Use the same questions every time, so approvals are comparable. We suggest a risk tier that decides how much scrutiny a tool gets.

• Tier 1, internal and no client data: for example, drafting marketing copy or summarising public material. Owner approval, entry on the register.
• Tier 2, client information but a person checks every output before it leaves the firm: for example, drafting routine letters or summarising correspondence. Owner and COLP approval, vendor data terms reviewed, DPO consulted.
• Tier 3, client-facing or acting on the firm's behalf: for example, an assistant that answers calls or a system that sends messages. Owner, COLP and DPO approval, a data protection impact assessment, a tested script of refusals and handoffs, and a named reviewer for the first weeks of live use.

The ICO's guidance on AI and data protection is the reference point for the data side, including lawful basis, transparency and when an impact assessment is needed. For client-facing tools, our governance checklist for AI client intake covers the specific questions to put to a supplier, and what AI chatbots can safely say gives a test script.

How do you manage the risk of AI hallucinations?

Through the human check in line 4 of the policy, made specific. Anything factual (a case, a statute, a date, a figure, a quotation) is checked against its source by the person who signs it off. The Ayinde judgment is explicit that this duty applies whether a lawyer used AI personally or relied on the work of someone who did. The practical detail is in AI hallucinations and law firms, including a routine short enough to follow on a busy afternoon.

What about agentic AI that takes actions?

Tools that act rather than just write (send an email, book an appointment, file something) need one extra line on the register: exactly which actions the tool may take without a person approving them. Keep that list short and explicit. The SRA noted that Garfield's system only takes a step where the client has approved it. AI agents for law firms sets out a way to classify these actions.

How often should a law firm review its AI governance?

Monthly for an hour, and properly once a year. The monthly review is simple:

• Read the incident and near-miss log. Anything that happened twice needs a rule.
• Check the register against reality: any new tools, any tools no longer used, any vendor terms that changed.
• Sample the output of each tier 3 tool: a handful of call summaries or messages, read by the owner.
• Note any new guidance from the SRA, the Law Society, the ICO or the courts, and decide whether it changes anything.

Keep the notes. If a court, the SRA or a client ever asks what the firm did, the answer is a dated record of reviews, not a policy that was written once and filed. A dated line saying 'reviewed, nothing changed' is still evidence that somebody looked.

A worked example

A hypothetical twelve-person firm, invented for illustration. The managing partner sends the blame-free question and gets eleven replies naming seven tools, three of them on personal accounts. She adopts the one-page policy, approves two general assistants on firm accounts for tier 1 and tier 2 use, stops the personal accounts, and puts a client-facing call assistant through tier 3 with the COLP and an external DPO. The register fits on one screen. The first monthly review finds one near-miss: a draft letter with a wrong date, caught by the fee-earner before sending. The rule that follows is simple: dates in AI drafts are always checked against the file. Total time spent in the first month: about a day, spread across three people.

What governance should you expect from an AI vendor?

Your policy covers your side. The vendor should be able to answer, in writing: where data is processed, whether it is used for training, how long it is kept and whether you can change that, how the system behaves at the edge of its instructions, what record it keeps of every interaction, and how you get your data back if you leave. For the front door, we answer those questions in our confidentiality page. Cam, our AI Engagement Coordinator, says it is AI on every call and hands over rather than advising. If you would like to walk through where it would sit on your register, we are happy to talk.

Frequently asked questions

Does the SRA require law firms to have an AI policy? The SRA regulates outcomes rather than prescribing documents, so we are not aware of a rule requiring a document called an AI policy. The obligations it would give effect to (competence, confidentiality, supervision, not misleading clients) already apply. Ask your COLP how your firm evidences them.

Who should own AI governance in a law firm? A named partner, usually working with the COLP and DPO. The Divisional Court in Ayinde referred specifically to managing partners and others with leadership responsibilities.

Do we need a DPIA for AI tools? For higher-risk processing, which often includes client-facing AI handling special-category data, the ICO's guidance points towards a data protection impact assessment. Your DPO should decide tool by tool.

Should staff be allowed to use ChatGPT at work? That is the firm's decision. A common approach is to allow general assistants on firm accounts for approved uses and to forbid entering client information into anything not on the register.

How long should an AI policy be? Short enough that people remember it. One page for the rules, with the register and assessment notes kept separately, works for most firms.