AI and the regulatory blind spot – understanding AI risk perception in law firms

On 2 July 2025, the Solicitors Regulation Authority (SRA) published new research exploring how small firms and sole practitioners (defined as firms with four or fewer partners and a turnover under £400,000) are adopting technology. The report pays attention to artificial intelligence (AI) and emerging tools like generative AI (genAI).

The key findings include:

• AI automation is currently used by just 14% of respondents, while only 12% reported using generative AI or legal chatbots.
• Despite low adoption rates, 90% of those surveyed acknowledged the importance of staying up to date with technology and innovation.
• According to data from the Legal Services Board (LSB), 60% of legal professionals believe that clients now expect them to use technology in the delivery of legal services.
• 64% of respondents agreed that increasing the use of technology could improve access to justice.

By contrast, the SRA’s 2023 findings revealed that around 75% of the largest law firms were already using AI, highlighting a growing divide between large and small firms in terms of technological adoption.

What’s behind the hesitation?

The research points to several reasons for the slower uptake among smaller firms:

• There is a clear demand for more specific and practical guidance on data protection and AI compliance, tailored to the unique needs of small practices.
• While the Information Commissioner’s Office (ICO) offers general guidance, respondents felt that it didn’t adequately address the real-world challenges faced by smaller legal businesses.
• Many firms expressed a desire for concrete, day-to-day examples of how AI could be applied in legal practice, as well as practical advice on identifying and managing potential risks.

With one in five firms open to adopting AI in the future, the right support and resources could play a vital role in enabling them to do so responsibly.

The need for trusted guidance

A consistent theme among survey participants was uncertainty around what constitutes compliant or good value technology. Without clear, impartial advice, many felt at risk of unknowingly breaching regulations.

Respondents called for:

• Independent guidance on choosing and using legal tech.
• Case studies showcasing successful adoption by similar firms.
• Opportunities to connect and learn from peers through networking and knowledge-sharing initiatives.

The compliance question: what does the SRA say?

Although the SRA published compliance ‘tips’ on the ethical use of technology and AI more than three years ago, it remains the most comprehensive resource currently available. Despite the lack of updated material, this framework continues to offer a useful starting point for firms considering AI adoption.

The SRA encourages firms to:

• Ensure any technology used aligns with its Principles and Standards and Regulations
• Understand the broader legal frameworks around AI, including data protection
• Establish clear governance structures to mitigate risk and safeguard client interests

Until more current guidance is issued, firms are advised to treat the existing guidance as a foundation for decision-making, ensuring that AI adoption is ethical, compliant, and in line with client care obligations.

Similarly, the Council for Licensed Conveyancers (CLC) take the view that:

• The regulatory framework must evolve alongside technology
• Firms should prepare for the increasing use of automation and smart systems in property law
• Regulators and firms must work together to balance efficiency and ethics.

Understanding the legal and ethical landscape

The SRA’s guidance encourages firms to ensure that any use of AI or other technology is consistent with its Principles and the Standards and Regulations. Importantly, firms are urged to understand the legal frameworks surrounding technology – particularly AI – and to consider associated data protection and ethical issues when implementing new tools or platforms.

Accountability and oversight

Firms should ensure that senior leaders are engaged in oversight from the outset. The Compliance Officer for Legal Practice (COLP) is expected to take responsibility for regulatory compliance when new technologies are introduced. Additionally, board-level oversight, both at the procurement stage and throughout the life of the technology, is critical to effectively managing associated risks, including technology failure, poor outcomes for clients, or compliance breaches.

Embedding AI within a governance framework

Despite the age of the guidance, the SRA’s emphasis on robust governance remains relevant. Firms should ensure they have systems and controls in place to support the ethical use of AI. This includes:

• Strong leadership and accountability
• Risk and impact assessments
• Clear internal policies and protocols
• Staff training and awareness
• Ongoing monitoring and evaluation to identify any unintended consequences

The core message is that client interests must remain central to any decision around technology use.

Using digital platforms and external technologies

The SRA also cautions firms using external digital platforms, i.e. those that connect consumers with legal services to carry out proper due diligence into them. Firms must be confident that such platforms don’t place them in breach of their regulatory obligations, particularly around confidentiality, conflicts, referral fees, and fee sharing.

Solicitors are reminded that referrals must not come via methods that would breach the SRA’s own rules, such as unsolicited approaches to potential clients  (see the SRA’s latest warning notice on this subject). For personal injury cases, firms must ensure any payments made for platform access do not breach Sections 56–60 of the Legal Aid, Sentencing and Punishment of Offenders Act 2012 (LASPO), which prohibits certain types of referral fees.

While the legal and technological landscape continues to evolve, firms should treat this guidance as a baseline and review it against current best practice in AI ethics and risk management. In the absence of more recent SRA updates, it provides a sensible framework to inform strategic decisions and governance procedures relating to AI.

What’s next?

Acknowledging that the legal community are hungry for further guidance, the SRA have stated their intention to develop further resources on the use of AI in law firms.   If you’re considering adopting AI, then our advice would be to lean into the SRA’s compliance tips, but also trust your instincts and approach with caution.  If something feels wrong or non-compliant, then you’re likely to be right.  

At Enderley, we’re listening to our clients (the most common view is that AI represents the greatest risk and the greatest opportunity) and busy developing policies to support the use of new technologies.  If you’re interested in discussing this with us please do get in touch.