The High Court has ruled that the Solicitors Regulation Authority (SRA) cannot use its section 44B investigatory powers to compel law firms to disclose documents protected by a client’s legal professional privilege without that client waiving privilege.

For COLPs, COFAs, managing partners and compliance teams, the decision has significant implications for handling regulatory production notices, reviewing client files and safeguarding confidential information.

The judgment in Carter-Ruck Solicitors and another v Solicitors Regulation Authority Ltd [2026] EWHC 2416 (KB), handed down on 21 September 2026, challenges a longstanding interpretation of the SRA’s investigatory powers. The SRA is appealing, so the position may yet change.

For law firms, the immediate question is not simply whether the regulator can demand access to privileged material. It is how firms should respond to requests for information while balancing their duty to cooperate with the SRA against their equally strong obligations to protect clients’ legal rights.

The decision makes it necessary for firms to have clear procedures for identifying privileged material, managing regulatory requests and documenting decisions about disclosure.

What happened in Carter-Ruck v SRA?

The case arose from an SRA investigation into Carter-Ruck concerning the firm’s conduct when acting for client Mohamed Amersi in connection with threatened or actual defamation and data protection proceedings.

As part of its investigation, the SRA issued three production notices under section 44B of the Solicitors Act 1974, seeking documents from the client’s files.

The central dispute concerned whether the SRA could require the firm to disclose material protected by Mr Amersi’s legal professional privilege, despite the absence of his consent.

The SRA argued that its statutory investigatory powers permitted access to privileged documents and that this was necessary to investigate potential professional misconduct effectively.

Carter-Ruck and its client brought proceedings seeking a declaration that section 44B gives the SRA no such power. Carter-Ruck’s position was that its professional obligations required it to defend its client’s privilege.

Mr Justice Butcher concluded that section 44B does not authorise the SRA to compel the production of documents or information subject to a client’s legal professional privilege where the client has not waived that privilege.

His reasoning turned on statutory interpretation. Section 44B contains no express override of privilege, and the judge held that the SRA had not met the high threshold for showing that one must be implied by necessary implication. He noted that Parliament could easily have provided for an override had it intended one, and that an amendment expressly overriding privilege was debated in 2007 but abandoned.

The judgment reinforces the principle that legal professional privilege is a fundamental legal right and cannot be displaced unless the legislation makes the override express or unavoidable by necessary implication.

The court was deciding a question of statutory interpretation, not whether the SRA should have wider powers. Commentators have suggested that the Ministry of Justice could legislate to make the position explicit. The ruling also says nothing about whether Carter-Ruck acted improperly.

Why does the ruling matter?

The decision draws a line between the SRA’s legitimate need to investigate potential misconduct and a client’s right to keep privileged communications protected.

Law firms remain subject to regulatory obligations, including duties to cooperate with the SRA and provide information when lawfully required.

However, those obligations must be considered alongside the limits of the regulator’s statutory powers.

COLPs and COFAs already face considerable challenges in managing regulatory expectations, resources and responsibilities, a theme that runs through the SRA’s Compliance Officer Thematic Review.

The Carter-Ruck judgment adds another consideration to those responsibilities: ensuring that requests for regulatory disclosure receive appropriate scrutiny before client information is released.

This is particularly relevant where investigations concern:

• Allegations of professional misconduct involving advice given to clients.
• Complaints about litigation conduct or disputed instructions.
• Questions about the firm’s handling of client matters.
• Regulatory investigations requiring access to historic client files.
• Requests involving communications between clients, solicitors and third parties.

A regulatory request should not automatically result in the wholesale disclosure of client files without an appropriate review.

What the ruling does not change

The judgment is narrower than some of the headlines suggest. It concerns the SRA’s use of section 44B to obtain privileged material. It does not stop the SRA investigating misconduct.

Mr Justice Butcher identified a range of cases where the SRA can still investigate without overriding privilege, including:

• Most client complaints, where the client is likely to have waived privilege.
• Cases that do not involve the client’s privileged communications, such as workplace bullying and harassment.
• Cases within the iniquity exception, which can apply where dishonest conduct is alleged.
• Complaints by an opposing party, where the communications between the parties are likely to be available.

Section 44B also remains a route to non-privileged documents and information, and firms must continue to comply with notices to that extent.

Legal professional privilege and client confidentiality: understanding the difference

One of the clearest lessons from the judgment is the need to distinguish legal professional privilege from the broader duty of client confidentiality.

Although the concepts overlap, they are not interchangeable.

• Legal professional privilege protects certain confidential communications and documents from compulsory disclosure. It generally takes two principal forms:
• Legal advice privilege protects qualifying confidential communications between a lawyer and client made for the purpose of giving or obtaining legal advice.
• Litigation privilege can protect confidential communications and documents created for the dominant purpose of conducting or obtaining advice in relation to existing or reasonably contemplated adversarial litigation, subject to the applicable legal tests.  Privilege belongs to the client, not the solicitor. A firm cannot simply waive its client’s privilege because disclosure would make responding to a regulatory investigation easier.

Client confidentiality, meanwhile, is a wider professional obligation.

Under paragraph 6.3 of the SRA Code of Conduct for Firms, firms must keep the affairs of current and former clients confidential unless disclosure is required or permitted by law or the client consents.

Not every confidential document is legally privileged. Equally, information does not become privileged merely because it appears in a solicitor’s file.

For compliance teams, this distinction is critical. The correct response to a production notice depends on the nature of the information requested, the legal basis for disclosure and whether privilege applies.

Six practical steps when responding to an SRA production notice

The Carter-Ruck judgment provides a timely opportunity for firms to review how they handle requests for information during regulatory investigations.

1. Examine the scope and legal basis of the notice

When an SRA production notice arrives, the first step should be to establish precisely what information is being requested and under which statutory power.

COLPs should consider:

• Whether the notice is issued under section 44B of the Solicitors Act 1974 or another power, such as section 93 of the Legal Services Act 2007, which is the equivalent power for licensed bodies.
• Which clients, matters, documents and time periods are covered.
• Whether the request potentially encompasses legally privileged material.
• What deadline has been specified for compliance.
• Whether clarification or an extension is necessary to allow a proper review.

The Carter-Ruck ruling specifically concerns section 44B. Firms should not assume that every regulatory information-gathering power operates in exactly the same way. The SRA’s other powers, including its intervention powers, are separate, and the judgment should not be assumed to apply to them.

Where there is uncertainty, specialist legal advice may be appropriate before documents are disclosed.

2. Conduct a documented privilege review

Firms should have a clear process for identifying material potentially protected by legal professional privilege.

This may involve reviewing client correspondence, attendance notes, advice documents, litigation records and relevant internal communications.

The review should distinguish between documents that are privileged, documents that are confidential but not privileged, and material that may be disclosed.

For larger requests, a privilege schedule can provide a structured record of withheld material without unnecessarily revealing its contents.

Such a schedule might record the document date, general description, applicable category of privilege and the basis on which disclosure is being withheld.

The review should be undertaken or supervised by someone with appropriate legal expertise. Administrative or compliance staff can assist with organising records, but should not be expected to make complex privilege determinations without legal oversight.

3. Establish who owns the privilege

Legal professional privilege belongs to the client.

Before considering whether privileged material can be disclosed, the firm should identify the privilege holder and establish whether a valid waiver has been given.

This can become more complicated where files involve former clients, corporate clients, joint retainers or multiple parties.

A client’s willingness to cooperate with an investigation does not necessarily amount to a general waiver of privilege. By contrast, where the investigation arises from the client’s own complaint about the firm, waiver is likely.

Firms should also be alert to the consequences of partial or selective disclosure, including the possibility that privilege may be lost more widely than intended.

Any proposed waiver should therefore be considered carefully and documented appropriately.

4. Engage constructively with the SRA

The judgment should not be interpreted as an invitation to resist legitimate regulatory scrutiny.

Firms should continue to respond promptly and professionally to SRA enquiries, consistent with their regulatory obligations and the SRA’s guidance on gathering evidence in regulatory and disciplinary investigations.

Where requested material is considered privileged, a sensible approach may be to explain the position, identify the relevant legal basis and seek agreement on how the request should be handled.

Depending on the circumstances, this could include:

• Providing non-privileged documents separately.
• Clarifying or narrowing the categories of material requested.
• Explaining why particular information is being withheld.
• Agreeing a revised timetable for production.
• Seeking specialist advice where the SRA disputes a claim to privilege.

Maintaining a clear written record of communications with the regulator will help demonstrate that the firm has approached the investigation responsibly.

5. Protect confidential client information throughout the process

Even where material is not legally privileged, firms must continue to comply with their confidentiality obligations and applicable data protection requirements.

The SRA’s guidance on confidentiality of client information provides further detail on the professional obligations involved.

Where material is confidential but not privileged, a valid section 44B notice can provide the legal basis for disclosure, because disclosure is then required by law. Firms should not over-correct by withholding material that the notice properly covers and that is not privileged.

Before transferring documents to the regulator, firms should consider whether the information includes unrelated client material, unnecessary personal data or commercially sensitive information outside the scope of the request.

Appropriate safeguards may include secure document transfer, restricted access, controlled redaction where lawful and justified, and maintaining an audit trail of information supplied.

Particular care is required when extracting documents from case management systems or shared electronic folders, where material relating to different clients may be stored together.

A poorly controlled disclosure exercise can create additional confidentiality and data protection risks, regardless of the underlying regulatory investigation.

6. Review existing policies and train relevant staff

The implications of Carter-Ruck should not be confined to the compliance role holders or teams.

Managing partners, compliance teams, department heads, practice managers and staff responsible for maintaining or retrieving client records should understand the firm’s procedures for handling regulatory information requests.

Policies should explain who is authorised to receive and respond to production notices, when a privilege review is required and how potential disclosure issues should be escalated.

Training should also reinforce the distinction between confidentiality and privilege.

This matters most for staff who may be asked to retrieve documents at short notice but do not have the legal expertise to determine whether those documents can properly be disclosed.

Effective compliance depends on embedding appropriate behaviours and procedures throughout a firm, rather than relying solely on individual compliance officers. Creating a culture of compliance is the foundation for that.

Regular, role-specific training and accessible procedures can help staff recognise when a request for information needs to be referred to the COLP or another suitably qualified person.

What if your firm has already disclosed privileged material to the SRA?

The judgment may also prompt questions about previous or ongoing investigations in which privileged documents were supplied to the regulator.

Firms should avoid assuming that the ruling automatically invalidates previous disclosures or regulatory decisions.

The circumstances of each investigation will matter, including the statutory powers used, the nature of the material, whether privilege was waived and how the documents were obtained or subsequently used.

Where a firm has concerns about historic disclosure, it may be appropriate to obtain independent legal advice on whether further action is justified.

For ongoing investigations, firms should consider whether outstanding production requests require reassessment in light of the judgment.

Where does the SRA’s appeal stand?

The SRA has publicly expressed disagreement with the High Court’s ruling.

In its statement issued on 21 September 2026, the regulator said it was seeking permission to appeal and was reviewing the operational implications of the decision, including guidance for staff handling ongoing investigations.

The High Court has since granted permission to appeal and issued a leapfrog certificate, which allows the appeal to bypass the Court of Appeal. The SRA will now ask the Supreme Court for permission. If that is refused, it can go to the Court of Appeal. At the time of writing, no date has been listed for the permission hearing.

Until the appeal is resolved, the High Court’s interpretation of section 44B stands. The position could still change through the appeal or through legislation, so COLPs should monitor developments and update internal procedures where necessary.

What should firms do now?

Although relatively few firms will face circumstances identical to those in Carter-Ruck, the judgment is a useful test of existing compliance arrangements. Three priorities stand out: review how the firm receives, assesses and escalates SRA production notices; make sure privileged and confidential information can be identified and protected before documents leave the firm; and make sure anyone involved in document retrieval understands that an SRA request does not automatically override a client’s privilege.

For more on oversight, risk management and accountability, see COLP and COFA responsibilities under the SRA’s requirements.

Protecting privilege while demonstrating effective compliance

The Carter-Ruck judgment shows that effective regulatory compliance involves more than providing information promptly.

It also requires firms to exercise sound legal judgment, protect client interests and maintain reliable procedures for responding to regulatory scrutiny.

For COLPs, the challenge is to ensure that the firm remains cooperative and transparent without disclosing material that the regulator is not legally entitled to compel.

The decision should encourage firms to revisit their existing policies, strengthen their privilege review arrangements and ensure that responsibility for regulatory disclosures is clearly allocated.

Ultimately, protecting client privilege and meeting regulatory obligations are not competing objectives. Both are fundamental to maintaining public confidence in the legal profession.

How Enderley Consulting can help

At Enderley Consulting, we work with law firms to strengthen their regulatory compliance arrangements, develop practical policies and procedures, and support those responsible for managing compliance risks.

Our COLP and COFA support services include assistance with compliance reviews, regulatory inspections, reporting obligations and the development of practical compliance frameworks tailored to individual firms.

We also offer the Enderley InfoHub, providing accessible compliance policies, guidance, practical resources and role-specific training to help firms manage their regulatory responsibilities.

If your firm would benefit from reviewing its regulatory investigation procedures, client confidentiality arrangements or compliance training, our team can help you identify areas for improvement and establish processes appropriate to your firm’s size and risk profile.

Contact Enderley Consulting to discuss how we can support your firm’s compliance arrangements.

About the author

Anne Austin is the founder of Enderley Consulting, a specialist legal compliance consultancy supporting law firms with regulatory compliance, risk management, policies, procedures and training. Anne works with those responsible for compliance and management within law firms, helping them translate regulatory requirements and developments into practical arrangements.

This article provides general regulatory information as at 10 October 2026 and does not constitute legal advice. Firms should obtain advice on the specific circumstances of any regulatory investigation or privilege dispute.