Software used by law firms: a UK buying checklist

UK law firms typically run a practice or case management system, legal accounts, document management, email and diary, e-signature, identity and AML checks, telephony and, increasingly, AI tools. The regret rarely comes from picking the wrong category. It comes from not checking data export, the processor contract, security, integrations and a real pilot before signing.

I spent years before WasilX on the buying side of software, running systems at companies that had bought more tools than they could use. The pattern I saw there shows up in law firms too: every purchase makes sense on its own, and the regret arrives later, when data has to move between tools and at the point of leaving one. This guide is the checklist I wish more firms used. Our pillar for this cluster, nine questions to ask before you buy an AI receptionist, goes deeper on one category; this post is the general version.

What software do UK law firms use?

The core stack, roughly in the order firms tend to buy it:

• Practice or case management. The system of record for matters: clients, files, tasks, time, documents and often billing. Increasingly cloud-based. Our guide to case management software in the UK covers the category.
• Legal accounts. Client and office account ledgers, built around the SRA Accounts Rules. Often part of the practice management system, sometimes separate.
• Time recording and billing. Usually inside practice management; see time recording in law firms for the operational side.
• Document management and precedents. Storage, versioning and templates, sometimes with document assembly.
• Email, diary and office software. Usually a mainstream office suite, integrated with the case management system to file emails to matters.
• E-signature and client portals. For engagement letters, forms and secure document exchange.
• Identity verification and AML. Electronic ID checks and screening at onboarding.
• Sector portals. For example conveyancing searches and Land Registry submissions, or claims portals in personal injury.
• Telephony. The phone system, call recording where used, and any answering service or AI call-handling software on top.
• Client relationship and marketing tools. Contact management and business development, especially in larger firms. We explain the category in what is a legal CRM?
• AI tools. Drafting, research, summarisation, intake and call handling. The fastest-moving category and the one with the most open questions.

Smaller firms often run most of this inside one practice management system. Larger firms run separate best-of-breed tools with integrations between them. Neither is wrong. What matters is that the firm knows where each piece of client data lives.

Why do law firms regret software purchases?

In our experience the reasons are rarely about features. They are:

• The data could not be got out. The firm decides to move, and finds its matter history can only be exported in a format nobody else can read, or only for a fee.
• It did not connect. The tool was bought for one team and never joined the rest, so staff re-type information between systems.
• Nobody used it. It was bought for a problem the partners had, not the one the staff had, and adoption quietly faded.
• The contract was harder than the software. Auto-renewal, per-seat minimums, notice periods and price rises nobody read.
• Compliance questions came late. The COLP or DPO was asked after signing, and found something that should have been a condition.

Every item on that list is visible before you sign, if you ask.

What should a law firm check before buying software?

A checklist in five parts. It applies to any category, from a practice management system to a small AI tool. Adjust the weight to the size of the purchase.

1. Fit to a real problem

• Write down, in one sentence, the problem the software solves and who has it. If you cannot, stop.
• Name how you will measure whether it worked, and the baseline today. "Fewer missed calls" needs a count of missed calls first; see law firm missed calls: how many do you really miss?
• Ask the people who will use it daily, not only the partner who will sign.

2. Data and exit

• Can the firm export all its data, at any time, in a standard format, without a fee? Ask for a sample export.
• What happens to the firm's data at the end of the contract, and when is it deleted?
• Is the firm's data used for anything other than providing the service to the firm, including training AI models?

3. Data protection and confidentiality

• If the vendor processes personal data for the firm, the contract should include the terms the ICO lists under Article 28(3) of the UK GDPR: processing only on documented instructions, a duty of confidence, appropriate security, rules on sub-processors, help with data subjects' rights, end-of-contract provisions, and audits.
• Where is data stored, and where is it processed? Ask for the sub-processor list, dated.
• Does the purchase need a DPIA? Your DPO decides; the ICO's guidance explains when one is required.
• Does it meet the firm's confidentiality obligations under paragraph 6.3 of the SRA Code of Conduct? This is a question for the COLP. For AI tools specifically, see AI compliance for law firms: client confidentiality first.

4. Security

• Does the vendor hold a recognised certification? Cyber Essentials is described by the NCSC as the minimum standard of cyber security recommended by the government for organisations of all sizes, and Cyber Essentials Plus adds independent technical testing. Larger vendors may also hold ISO 27001. Ask for the certificate, and check the scope covers the product you are buying.
• Does it support single sign-on and multi-factor authentication for your staff?
• What is the vendor's process and timescale for telling you about a security incident?

5. Commercials and fit

• Total cost over three years: licences, implementation, training, integrations, data migration in and out, and likely price rises.
• Contract length, notice period, auto-renewal and minimum seats.
• Integrations that actually exist today, with your specific practice management system and email, not "on the roadmap".
• Support hours, and whether they cover the hours your staff work.

How should a law firm run a software pilot?

Narrowly, with a start date, an end date and a decision rule written before it begins. A pilot with no exit condition is a rollout with optimistic branding.

• One team or office, one use case. Not the whole firm.
• A baseline. Measure the thing you want to change for a fortnight before the pilot starts.
• Real work, not demo data. With the compliance checks done first, so real work can be used.
• A named owner. Someone whose job includes making the pilot succeed or fail clearly.
• A decision rule. "We continue if X improves by Y and the team wants to keep it." Write it down.
• A review with the users. Ask the people who used it what they would lose if it went away. If the answer is nothing, that is the answer.

A worked example

The example below is invented to show the method. It describes no real firm or product.

A ten-fee-earner firm plans to buy a document automation tool. Before the demo, the practice manager writes the problem: engagement letters take too long to prepare and vary between fee-earners. The baseline, from a fortnight's timing, is around 25 minutes per letter.

The checklist turns up three things. The vendor's export is limited to PDFs of generated documents, not the templates, so leaving would mean rebuilding every template. The processor contract is missing an end-of-contract deletion clause. And the integration with the firm's practice management system is listed as coming soon. The firm negotiates a template export and the missing clause, and runs a six-week pilot in one team, using manual copy-and-paste for client details with a decision rule that time per letter must halve. It falls to about ten minutes, and the team wants to keep it. The firm buys, with the integration made a condition of renewal.

None of those three findings would have come up in a demo.

What about AI tools specifically?

Everything above applies, plus a few questions that matter more for AI than for other software: what the tool does when it does not know, whether a person reviews output before it reaches a client, whether the tool is honest with clients that it is AI where it talks to them, and whether inputs are used for training. The SRA's compliance tips on AI and technology say firms should make clear when clients are interacting with an AI system and involve the COLP when new technology is introduced. For AI that picks up the phone, nine questions to ask before you buy an AI receptionist is our full list, and a client record vs an answering service explains how the categories differ. For the wider landscape, see AI for UK law firms.

Who should be involved in buying law firm software?

• The people who will use it daily. Their view on adoption matters more than anyone's.
• The COLP for regulatory questions, and the DPO or data protection lead for personal data.
• Whoever runs IT, in-house or outsourced, for security and integration.
• The partner who owns the budget, for the three-year cost and the decision rule.

In a small firm these may be two people. The point is that each question has an owner before signing, not after.

Where WasilX fits

We sell two things, and we would expect to be put through this checklist like any vendor. Cam, our AI Engagement Coordinator, takes calls on the firm's line at any hour, says it is AI, asks the firm's own qualifying questions, books the call back and sends the firm a summary. The personal assistant covers a fee-earner's calls while they are in court and drafts matter updates for the fee-earner to approve. How we handle data is on our confidentiality page. If you would like to run the checklist against us, we are glad to go through it.

Frequently asked questions

What software do most UK law firms use? Most run a practice or case management system with legal accounts and time recording, alongside email and diary, document management, e-signature, identity and AML checks, telephony and, increasingly, AI tools.

What should a law firm check before buying software? Whether it solves a named problem, whether all data can be exported and deleted, whether the processor contract has the Article 28(3) terms, security certification, real integrations, the three-year cost and the contract terms.

Is Cyber Essentials enough for a legal software vendor? The NCSC describes Cyber Essentials as the minimum government-recommended standard, with Cyber Essentials Plus adding independent testing. It is a sensible floor. Whether it is enough for a given purchase is for the firm to judge with its IT and data protection leads.

How long should a software pilot last? Long enough to measure the change against a baseline, often four to eight weeks, with a written decision rule agreed before it starts.

Who should sign off new software in a law firm? The budget-holding partner, with the COLP on regulatory questions, the DPO on personal data, IT on security, and the daily users on whether it will actually be used.