← AI for law firms

An AI-use policy for law firms you can adopt today

Free to copy and adapt · No email gate · Last reviewed 1 November 2026; the date changes when the text does

Three facts make this page necessary. In Munir [2026] UKUT 81 (IAC), promulgated on 17 November 2025, the Upper Tribunal said at paragraph 60 that uploading confidential documents into an open AI tool such as ChatGPT places them in the public domain, breaches client confidentiality and waives privilege. The Solicitors Regulation Authority published its warning notice on the misuse of AI on 17 August 2026. And a Censuswide survey for Access Legal of 200 UK legal professionals, carried out in April 2026, found that 59% of fee earners had used an AI tool their firm had not approved, rising to 71% of paralegals.

A ban nobody follows protects nobody. What protects privilege is a short policy that people can keep: an approval test, a confidentiality rule, mandatory review, and a clear path when something goes wrong. The policy below is vendor-neutral and complete. Replace the square brackets, adopt it, and put the review date in the diary.

The policy

1. Purpose and scope

This policy sets out how [Firm name] and everyone who works for it may use artificial intelligence tools, so that client confidentiality, legal professional privilege and data protection are protected and the firm's regulatory duties are met. It applies to partners, employees, consultants, contractors and temporary staff, on any device, in and out of the office.

2. Definitions

3. The rule

No confidential information may be entered into a public AI tool, in any form, for any purpose. This includes pasting, uploading, dictating and screenshots. If a tool is not on the register, treat it as public.

4. Approved tools and the register

The [COLP or Head of Risk] keeps a register of approved AI tools. A tool is added only after the firm has recorded, in writing: who the provider is and where it is incorporated; where the data is processed; what the provider retains, for how long, and whether it trains on inputs; which sub-processors see the data; what the contract says about confidentiality, data protection and audit; and the outcome of a data protection impact assessment where personal data is involved. The register records the approval date, the approved uses and the person responsible for each tool, and is reviewed at least annually.

5. Permitted and prohibited uses

With an approved tool, staff may: draft documents and correspondence for review; summarise the firm's own documents; use the tool as a starting point for research that is then verified; produce translation drafts; and transcribe the firm's own meetings where every attendee has consented.

With any tool, approved or not, staff may not: send AI output to a client or a court without review by the lawyer responsible for the matter; rely on a citation, quotation or figure without checking the primary source; use AI to make decisions about a client, an employee or a counterparty; use AI on a matter where the client has opted out in writing; or enter special-category personal data unless the data protection impact assessment expressly allows it.

6. Review and responsibility

Every AI output used in the firm's work is reviewed by the lawyer responsible for the matter before it is relied on or sent. The lawyer, not the tool, is the author. Citations, quotations, figures and references are checked against the primary source every time.

7. Confidentiality and privilege

Entering privileged material into a public AI tool may place it in the public domain and waive privilege (Munir, paragraph 60). Staff treat every AI tool as a third party and apply the same test they would apply before emailing a document outside the firm. Where a document would need the client's consent to leave the firm, it needs the same consent before it enters a tool.

8. Clients

Where an AI tool materially assists work on a matter, the client is told, in the engagement letter or at the time. Clients may opt out; an opt-out is recorded on the matter file and respected by everyone who works on it. AI assistance is not billed as if it were a lawyer's time.

9. Data protection

Before any AI tool processes personal data, the firm completes a data protection impact assessment, records the lawful basis, puts in place a written contract with the provider that meets Article 28 of the UK GDPR, confirms where data is processed and whether it leaves the UK, and sets retention. Special-category data is entered only where the assessment expressly allows it.

10. Records

Where an approved tool provides a usage or audit export, it is kept with the matter file. The firm does not keep copies of prompts or outputs beyond what the matter file needs.

11. Incidents

If confidential information has gone into an unapproved tool, or an approved tool has been used outside this policy, the person who discovers it reports it the same day to the [COLP or DPO]. The firm then assesses, within 72 hours, whether a personal data breach must be reported to the ICO under Article 33 of the UK GDPR, whether the client must be told, and whether the matter is reportable to the SRA under the Code of Conduct. Staff who report their own mistakes promptly are treated fairly; concealment is a disciplinary matter.

12. Training

Every member of staff completes AI-use training on joining and annually, covering this policy, the register, the confidentiality test in section 7 and incident reporting.

13. Breach of this policy

Breaches are dealt with under the firm's disciplinary procedure and reported to the SRA where the Code of Conduct requires it.

14. Review

This policy is reviewed annually, and sooner when the SRA, the ICO or the courts change the position. Owner: [COLP]. Version: [1.0]. Adopted: [date].

Appendix A: the register, one line per tool

Appendix B: the one-page summary for staff

Appendix C: seven questions for any AI supplier

Who owns the provider and where is it incorporated? Where is the data processed? What is retained, and for how long? Are inputs used for training? Which sub-processors see the data? What does the contract say about confidentiality and audit? What happens when the provider receives a legal demand? The AI privacy checker walks through them with the answers that matter.

How to adopt it in an afternoon

  1. Copy the policy and fill in the square brackets.
  2. Appoint the owner: the COLP, the DPO, or both.
  3. Build the register from what people already use. Ask; the survey says they do. Approve or ban each tool in writing.
  4. Add the client sentence to the engagement letter.
  5. Run the twenty-minute training with Appendix B on the screen.
  6. Put the annual review date in the diary.

Where Hush fits

Hush AI is one tool a firm could put on the register: it keeps no prompts, responses or documents on any server, runs on hardware we own in the United Kingdom, and never trains on what it is told. So could any other tool that passes the same tests. The policy stands on its own. How Hush works for law firms.

AI for law firms →

General information, not legal advice. Authorities: Munir [2026] UKUT 81 (IAC), paragraph 60, promulgated 17 November 2025; the SRA warning notice Misuse of AI, 17 August 2026; Censuswide for Access Legal, April 2026, 200 UK legal professionals: 59% of fee earners, and 71% of paralegals, had used an unapproved AI tool. Hush AI (hush-ai.uk) is a private AI assistant for regulated professionals; it drafts under fee-earner review and is not a source of legal advice.