Legal Futures Navigating the minefield of legal technology investment

By Legal Futures Associate Miller Insurance ^[1]

The scale of technology investment

Modern law firms are now significant investors in technology. If there was any doubt, Miller’s 2025 benchmarking report ^[2] quashes it, evidencing that IT spend frequently exceeds Professional Indemnity Insurance (PII) ^[3] spend, particularly in larger firms. The adoption of new technologies has transformed legal practice, and this trend is only accelerating with the uptake of Generative AI tools.

This shift has inevitably led to an increasing reliance on technology solutions. Law firms ^[4] using CTS, for example, experienced this first-hand when a cyber breach left many unable to process conveyancing completions due to loss of system access.

Selecting the right technology

Basing your procurement decision on the apparent functionalities of a system is, on its own, insufficient. The reality of most IT procurements is that, once adopted, systems can be difficult to change or exit, even if they do not deliver as expected, given the high financial and practical barriers to transitioning to an alternative system. Selecting the right system, and the right service provider, is therefore a valuable investment of your time.

It is not uncommon for law firms to cite choosing a Law Society accredited provider as their rationale for selection. However, such accreditation is not a guarantee of quality or suitability for your firm’s needs. A more rigorous selection process is essential.

Regulatory requirements

The obligations imposed on firms by the SRA Code of Conduct, Standards & Regulations, data protection regulations and the like have implications for the systems you use. Your IT solutions must handle client information securely and ensure data integrity. To act in your clients’ best interests, you need to take reasonable precautions to ensure your systems are robust and that you have tested contingency plans for unexpected outages.

Data losses, loss of client monies, or service failures due to inadequately selected third-party providers can, in extreme cases, result in regulatory action – as well as management liability and professional indemnity exposures.

Third party due diligence considerations

The Law Society’s Cloud Computing Guidance (March 2025) provides a valuable overview of what law firm managers should consider when selecting software products. A lack of technical expertise is not an excuse to delegate these decisions entirely to your IT staff. You must understand the key aspects of the systems under consideration, even if the technical specifics are left to experts.

For example, choosing a public cloud service without end-to-end encryption for confidential client data could expose you to regulatory risk if there is a data breach. Where possible, select legal profession-specific solutions that are more likely to comply with regulatory standards.

Your due diligence checklist should include:

Public Cloud, Private Cloud, or Hybrid
End-to-end encryption (128-bit minimum; 256-bit preferred)
Multifactor authentication enabled
Role-based access controls (reduces the risk of a breach accessing all areas of data)
SSAE-18 certified data centres
Data centre locations
ISO27001 (information security standard), ISO27017 (security standard specifically for cloud service providers)
Insurance covers (including Cyber and PII)
Business continuity planning
Data control/ownership (should remain with you) and access/recoverability of data
Audit results
Testimonials
Service Level Agreement terms (% up-time; timing of planned maintenance; robustness of contractual protections in the event of service failures)
Financial strength
Use of third parties, due diligence, audits, and controls

This list is not exhaustive but highlights key areas for evaluation.

Service quality and flexibility

A key benefit of cloud services is scalability – they can be expanded or reduced to fit your business needs. A reputable provider will also invest more heavily in IT security than most individual law firms could, ensuring systems are continually updated and improved.

A common challenge with Software as a Service (SaaS) providers is the gap between what is demonstrated and what is delivered. Problems often arise from poor implementation: disorganised data, overlooked required fields, or inadequate user training can all result in subpar outcomes.

Systems rarely work ‘out of the box’ as they do in sales demos. The more complex or tailored the system, the truer this is. While some tools, such as time-management systems, can be simple add-ons, more comprehensive solutions like Practice Management Systems require significant customisation. It is sensible to seek feedback from your network about potential suppliers before making a commitment. Consider their responsiveness, flexibility, support for customisation, ease of report generation, and the accessibility or extractability of your data – whether for business continuity, reporting, or, if necessary, switching providers.

Navigating the minefield

Selecting and managing legal technology can be complex. To support firms, we are running a dedicated workshop event in conjunction with E3 Compliance on Legal Software on 21 April 2026. Contact us to book your place.