AI And In-house Legal Practice: Professional Judgement Cannot Be Automated

Generative AI (GenAI) offers genuine opportunities for in-house legal teams, but it also creates distinct professional risks for in-house lawyers. Recent regulatory guidance and case law underline a simple point: AI may assist legal work, but it is not a substitute for professional judgement, and its use in-house across a wider business requires appropriate legal oversight and governance.

A framework for responsible AI use by in-house legal teams

The Law Society's guidance on GenAI maps the wider risk landscape for solicitors and firms. First published in October 2025 and updated in June 2026, its practical message is clear: AI can deliver efficiencies, but it must be managed throughout its lifecycle and remain subject to informed human oversight, professional obligations and proportionate governance. The main recommendations from the guidance can be grouped into four key areas:

• verify outputs for accuracy, authority and bias;
• apply professional duties whether GenAI is used personally or by someone under supervision;
• understand what data is entered into an AI tool and what the AI tool provider may do with it, including how the tool stores, uses and protects information; and
• maintain appropriate governance and proportionate records of how AI tools are used.

The risks extend beyond hallucination, and the guidance highlights concerns including the disclosure of confidential material, uncertainty over intellectual property rights in prompts and outputs, unauthorised access to data, data breaches, corrupted data sources and biases arising from training data that may produce inappropriate outputs.

GenAI due diligence before procurement and use

The Law Society guidance states that an AI system should be subject to thorough due diligence before it is procured or used. In-house legal teams should therefore consider:

• the purpose of the AI tool and the use cases for which it is approved;
• alignment with wider IT, GenAI, confidentiality and data governance policies;
• the vendor’s data management, security and standards, with regular review rather than a one-off assessment;
• ownership and permitted use of prompts, training data and outputs;
• whether the AI tool operates as a closed system within the organisation’s boundaries, or also trains models for third parties; and
• the arrangements for checking outputs for accuracy and factual correctness.

The SRA’s central concerns about GenAI use by lawyers

Against that broader framework, the SRA's warning notice on misuse of AI in the legal profession was published on 17 August 2026 and focuses on two particular concerns:

1. The first is the submission of false or inaccurate information to courts, especially fabricated authorities and quotations produced by AI which are left unchecked.
2. The second is the exposure of confidential, personal or privileged client information through inadequately safeguarded AI tools, including information entered into public AI systems.

The SRA’s central message is clear: GenAI may assist legal work, but it cannot absolve solicitors of their obligations under the SRA Standards and Regulations. Misuse of AI tools by lawyers can result in poor legal advice and harm to clients (including the internal clients of in-house lawyers), disrupt court proceedings and the administration of justice, and damage public trust and confidence in the legal profession. The SRA warns that failure to have proper regard to its notice may lead to disciplinary action.

Unchecked GenAI outputs: lessons from the courts

In relation to the first of the SRA's main concerns, the warning notice refers to some recent cases which illustrate the consequences of relying on AI-generated legal material without adequate verification:

• Ayinde v London Borough of Haringey, and Al-Haroun v Qatar National Bank [2025] EWHC 1383 (Admin), in which fabricated case citations resulted in wasted costs and regulatory referrals for improper and unreasonable conduct; and
• Cork v Smith [2026] EWHC 1199 (Ch), in which the court publicly criticised a law firm and two supervising solicitors after letters submitted to the court contained misleading statements of law and false statutory references.

As part of its warning notice, the SRA highlights that the conduct in these cases demonstrates a failure to comply with a number of duties set out in its rules and principles, including duties to:

• ensure that legal services are competent;
• maintain effective governance structures to manage risk;
• ensure that representations put to the court are genuine and properly arguable;
• maintain professional knowledge, skills and competence;
• supervise client work effectively; and
• avoid conduct that may interfere with the administration of justice, including wasting the court’s time.

GenAI, confidentiality, privilege and data protection

On the second of the SRA's main concerns, the warning notice refers to UK v Secretary of State for the Home Department [2026] UKUT 81 (IAC) to illustrate the issues that can arise where fictitious authorities are cited and client-sensitive information is placed into public AI tools. The SRA highlights the risk to client confidentiality where information entered into a GenAI system may be stored, retained or used to improve the tool, as well as the associated risks to legal professional privilege and compliance with data protection law.

The practical takeaway is that appropriate contractual, technical and organisational safeguards must be in place to protect client information entered into AI systems. Lawyers should be satisfied that client data:

1. remains in a secure environment and is not accessible by unauthorised third parties;
2. is not used for AI model training unless expressly authorised; and
3. is retained only for as long as necessary.

A specific warning for in-house lawyers

The SRA specifically note that in-house solicitors should be particularly careful about the AI tools available within their organisations, on the basis that:

• AI tools developed internally may not have been designed or configured for legal work; and
• an organisation’s interest in expanding its AI usage may create tension with the solicitor’s independent professional duties and responsibilities.

This makes the in-house legal function an important control point. Legal teams should identify which systems are suitable for legal work, define acceptable use cases, restrict the categories of information that may be entered and ensure that any encouragement from the business to adopt GenAI does not displace legal professional judgement.

Practical steps for in-house legal teams

To help address the concerns raised by the SRA and the Law Society, in-house lawyers should:

1. Know and approve the AI tools being used: with visibility over both organisation-wide systems and tools that may be adopted informally by individuals or teams.
2. Classify the information that may and may not be entered into AI tools: apply clear rules to confidential, privileged, personal and commercially sensitive material.
3. Verify AI outputs: check accuracy, authorities, quotations, statutory references, factual assertions and potential bias against reliable sources.
4. Supervise the process as well as the end product: understand how the output was generated and ensure that responsibility remains with an appropriately competent lawyer.
5. Keep a proportionate record of AI use: document approved use cases, key checks and material decisions where appropriate.
6. Create a clear escalation route: ensure employees know how to report inaccurate outputs, data exposure, security concerns or other potential incidents.

The bottom line

The technology may be novel, but solicitors’ professional duties remain the same. Used carefully and appropriately, GenAI can support and create efficiencies in the delivery of legal services. However, used without suitable controls, it can produce inaccurate legal work, expose protected information and create serious regulatory and reputational consequences.

The message is not to avoid GenAI altogether, but to govern it.

In-house legal teams should approve the right tools, control the data entered, verify what comes out and preserve meaningful human oversight. GenAI must always be used with professional judgement, not instead of it.

This publication is a general summary of the law. It should not replace legal advice tailored to your specific circumstances.