What has the SRA said about AI?
Last update
The Solicitors Regulation Authority (SRA) has said a lot about AI since 2023. Read it all together and one message comes through: the technology can change, but your responsibilities don't.
The short version
The SRA isn't telling firms to avoid AI, and it isn't telling them to adopt it. Its approach, in its own words, "focuses on the outcomes that firms achieve, and not necessarily on the specific systems they use to achieve them". What it does expect is that you understand what you're using, supervise it and stay accountable for the result.
Everything below comes from the SRA's own website, and we've linked every source so you can read it first-hand. We've put anti-money laundering (AML) and client due diligence (CDD) first, because that's where the SRA's most practical advice sits.
Deepfakes and client due diligence
On 22nd April 2026 the SRA published "Be aware of clients using AI to bypass identity checks". It relays an alert from the National Economic Crime Centre: AI "has been detected in various parts of the CDD process, including to manipulate or create identity documents and produce deepfakes to deceive liveness detection tests." Most attempts don't get through, but some have. The SRA's own words are that this is "a current threat not a theoretical one".
The SRA's Sectoral Risk Assessment, updated on 4th September 2026, makes the same point from a risk angle. It says AI-enabled impersonation, including deepfakes, "may increase the risk of identity fraud and misrepresentation during client onboarding", and that these technologies may help people circumvent CDD processes.
So what does the SRA suggest you do?
Be aware of deepfakes, which "can impersonate a real person's appearance convincingly".
Assess the heightened risk of relying on video calls to identify and verify your client.
If you only meet clients remotely, understand whether your electronic due diligence protects you against this.
Explore software that helps detect deepfakes. The SRA notes that many are available.
There's a practical point on digital identity too. The Sectoral Risk Assessment quotes government guidance that services not on the Digital Verification Service register "cannot reliably be deemed suitable for identity verification in compliance with the [Regulations]". It's worth checking where your provider sits.
Reviewing your remote verification
The SRA's advice stops at awareness, so here's one way to turn it into a review. This is our reading of the guidance, not an SRA checklist.
List where your firm relies on video calls or remote-only verification to identify a client.
Check whether your provider is on the Digital Verification Service register.
Ask your provider how its tool deals with deepfakes and manipulated documents. The alert the SRA relays says liveness detection tests are among the things being targeted.
Check that your client and matter risk assessment doesn't lean on the electronic result alone. The SRA's annual report reminds firms that eIDV checks are not a substitute for it.
Write down why you chose your approach. Accountability stays with you, so you'll want to show your reasoning.
Technology in CDD, and where it stops
The SRA's AML annual report for 2024 to 2025, published on 30th October 2025, talks about electronic ID verification (eIDV) rather than AI as such. Still, what it says applies to any tool in your CDD process.
Technology is now the norm: "90% of firms we met with used technology, including electronic identification and verification (eIDVA), to help with their CDD checks."
Know your tools: firms "must develop an in-depth understanding of the tools they choose to incorporate to fulfil their regulatory obligations."
Review matters: "An electronic report is only as good as the understanding of the person reviewing the report."
Testing matters too. Just over a third of firms (35%) said they often test their technology for accuracy.
eIDV is not the whole picture: "eIDVA checks are not a substitute for a client and matter risk assessment."
The report also reminds firms that under regulation 19(4)(c) of the Money Laundering Regulations 2017, adopting new technology means taking "appropriate measures" to address any money laundering or terrorist financing risks it may bring.
The SRA's 2023 AI report lists AML compliance among the uses of AI, and adds a note on bias. An AML algorithm might "take that demographic, rather than the types of business present, as the risk factor." Its advice is to test systems thoroughly before use and to keep monitoring their outputs, because bias can develop after launch.
Taken together, the SRA's guidance focuses less on the label attached to a technology and more on whether firms understand what it does and does not do, supervise its use appropriately and remain accountable for the outcome.
Accountability stays with you
If the SRA's guidance had a headline, this would be it. In its warning notice on the misuse of AI, published on 17th August 2026, it says AI "has no separate legal personality" and that "you remain accountable for all work and advice delivered to clients, whether or not AI has been used."
The same message runs through the rest of its guidance:
The 2023 AI report says "you cannot delegate accountability to an IT team or external provider".
The effective supervision guidance, updated on 12th June 2026, now has a section on AI. Firms should consider what effective supervision of AI-assisted work looks like, including "appropriate human review, scrutiny and professional judgement".
That guidance adds that an authorised individual "retains ultimate responsibility for any legal services delivered with AI assistance".
"Just as a solicitor should always appropriately supervise a more junior employee, they should be overseeing the use of AI."
SRA's Chief Executive in 2023, Paul Philip
Evidence matters too. The same 2023 report tells firms to document each stage of the design and running of any AI system "so that you can fully explain how it works", and to understand "what the technology does, and does not do" before they deploy it.
Olivier Roth, a policy manager at the SRA, sets out how to put this into practice in Lawtech Insight (30th July 2026). Start by identifying which AI systems your firm uses and how staff use them, then map where data goes. Add human verification steps where a tool needs them, give each tool a clear owner and review it regularly. He adds that governance should cover AI already built into everyday software.
Client data and confidentiality
The August 2026 warning notice is direct about free and paid AI tools. They "may not provide the contractual, and technical safeguards needed to maintain client confidentiality." It quotes an Upper Tribunal comment that putting client letters into an open-source tool such as ChatGPT "is to place this information on the internet in the public domain."
The stakes are high because legal professional privilege can be lost. The notice says using such tools "will likely breach client confidentiality and as a result, legal professional privilege may be permanently waived".
It sets out what good looks like. Client information should only go into AI systems where appropriate contractual, technical and organisational safeguards are in place. Firms should satisfy themselves that client data:
Stays within a secure environment.
Isn't accessed by unauthorised third parties.
Isn't used to train AI models unless that is explicitly authorised and appropriate.
Isn't kept for longer than necessary.
The 2023 AI report adds a practical step. Set clear rules for staff, including on tools you haven't formally adopted, and train people on the difference between casual use of an online tool and a system your firm has chosen.
Accuracy and court work
The warning notice is clear that solicitors must make sure submissions of case law are "genuine, relevant, have a verifiable citation". It adds that "[r]eliance on an output of AI would not be a suitable defence" if that goes wrong.
Supervisors have a part to play as well. The notice says they can be found in breach if false citations reach the court without adequate review.
The SRA's press release puts the picture in proportion. AI is "increasingly being used across the legal sector to support tasks such as research, drafting, document review and administrative processes", and many firms use it responsibly.
The SRA wants firms to innovate
It's easy to read the warnings and miss the other half of the story. The SRA says that, used appropriately, AI "has the potential to improve efficiency and enhance services for consumers", and it has backed that up.
On 6th May 2025 it authorised Garfield.Law Ltd, the first purely AI-based firm it has authorised. Paul Philip, then Chief Executive, said the regulator "cannot afford to pull up the drawbridge on innovations that could have big public benefits", while noting that "the risks around an AI-driven law firm are novel". Named solicitors remain accountable for everything the system does.
It joined the government's Advisory AI Growth Lab in June 2026. Legal services is the first sector, and applications closed on 27th September 2026. The SRA is clear that taking part isn't regulatory approval, and the rules stay the same.
On 8th June 2026 it published an on-demand event, Innovation, lawtech and AI in your firm, covering agentic AI, choosing tools and its generative AI guidance on data protection and client information.
Its Innovate pages collect AI resources, including a video from the SRA's Lead Data Scientist on what AI is.
Its 2023 AI report notes that AI can help with tasks like document review and client intake, and could widen access to legal services for people on lower incomes and small businesses.
One more thing worth knowing for client-facing tools. The SRA's compliance tips say "[i]t should always be made clear to clients where they are interfacing with AI", and that it expects, as a minimum, the Compliance Officer for Legal Practice (COLP) to be responsible for regulatory compliance when new technology is introduced.
Six questions for your next review
Reading across the guidance, several practical controls stand out: defining what a system does and does not do, testing it before use and monitoring it afterwards, protecting client data, applying appropriate human review, and keeping enough documentation to explain how it works and how it has been used. The precise controls will depend on the system and the work it supports.
None of this is a checklist the SRA has published, but these questions follow directly from what it has said.
Does your firm-wide risk assessment cover AI-enabled impersonation and deepfakes during onboarding and throughout a matter?
Do you know how much weight remote and video verification carries in your CDD, and whether your electronic checks hold up against deepfakes?
Is your identity verification provider on the Digital Verification Service register?
Do the people reviewing electronic reports understand how the tool works, and do you test its accuracy?
Do your staff know which AI tools are approved, what client information can go into them, and which of your existing software already has AI built in?
Is human review of AI-assisted work built into your supervision arrangements, and can you show it?
Ready when you are
The SRA's position comes down to this. Use AI where it helps, understand it, supervise it and own the outcome. For compliance teams, the sharpest advice is about identity: know how your verification holds up when the person on the screen might not be who they seem.
Subscribe to our newsletter
Subscribe to our monthly newsletter for recaps and recordings of our webinars, invitations for upcoming events and curated industry news. We’ll also send our guide to Digital ID Verification as a welcome gift.
Our Privacy Policy sets out how the personal data collected from you will be processed by us.
