Guest post by Eleonora Dimitrova, who holds an LLB and LLM in corporate and commercial law from Queen Mary University, London
Dimitrova: Firms will need documented evidence
Debate about AI in legal practice has so far concentrated on whether solicitors can use these systems competently, whether outputs are checked, and whether confidential information is adequately protected. Those questions matter. But they are no longer the decisive ones.
The more consequential question is how those issues will be assessed after the fact by a regulator operating a risk-based supervisory model in an environment where AI-related failures are no longer novel, and no longer rare.
In practice, the regulatory impact of AI will not be driven by new rules or formal prohibitions. It will be driven by how existing duties are examined, evidenced and enforced once something goes wrong. AI does not introduce a new category of obligation.
It intensifies scrutiny of whether firms can demonstrate that they were in control of the systems through which legal services were delivered.
Risk-based supervision: AI as a proxy for governance quality
The Solicitors Regulation Authority (SRA) does not supervise firms by auditing everything they do. It prioritises. It looks for patterns, indicators of unmanaged risk, and signals that governance has failed. AI introduces a new and particularly revealing category of such signals.
Unlike earlier technologies, AI systems sit directly within legal judgement, data handling, and decision-making processes. When failures occur, they rarely appear as isolated technical errors. They expose underlying structural weaknesses: unclear ownership, poor system understanding, and undocumented assumptions about risk.
For a regulator operating a risk-based model, that distinction is critical. AI-related issues will not be treated as discrete technology problems. They will be treated as evidence of broader control failure.
A flawed output is unlikely to be viewed in isolation. It will be used as a proxy for a more fundamental question: whether the firm had any structured basis for relying on the system at all.
How AI issues will enter supervision in practice
AI will not enter supervision through a single, clearly defined gateway. It will surface through multiple, overlapping routes.
Client complaints will remain the most visible trigger. A disclosure error, an incorrect output relied upon too heavily, or an inability to explain how advice was generated can all prompt scrutiny. But complaints are only one entry point.
Other routes are likely to include:
- thematic reviews focused on technology-enabled practice;
- intelligence arising from insurers, litigation or privilege disputes;
- whistleblowing by staff concerned about how AI tools are being deployed; and
- routine supervisory engagement where firms are already categorised as higher risk.
Once AI use becomes relevant, the focus will shift rapidly from what happened to why the firm was exposed in the first place. The incident is the entry point. The supervisory analysis is systemic.
What supervisors will actually examine
A common misconception is that regulatory scrutiny will turn on whether a particular AI output was checked or whether an error could have been caught with greater care. That is not where risk-based supervision operates.
Output checking is not a primary control. It is evidence of reactive, not structured, risk management.
Supervision is evidential. It is concerned with whether the firm can demonstrate that it took reasonable, informed and structured steps before the event.
In an AI context, that means the focus will move decisively upstream.
Supervisors are likely to ask:
- Why was this system selected?
- What risks were identified at procurement stage?
- What was understood about data flows, access, and retention?
- How was privilege risk assessed?
- What governance existed around updates, model changes, or expanded use cases?
- What contemporaneous records exist demonstrating that these issues were considered and reviewed?
A firm that can answer those questions clearly, and with evidence created at the time, is in a fundamentally different position from one that cannot – regardless of the severity of the underlying incident.
Procurement, architecture and evidence
By the time supervision begins, it is already too late to correct procurement decisions. System architecture has been fixed. Data pathways have been established. Vendor relationships are embedded.
This is why procurement records will assume disproportionate importance in any supervisory assessment.
A firm that relies on high-level policies, generic risk statements, or informal vendor assurances will struggle to demonstrate control. Assertions that a tool was widely used, or that no prior issues had arisen, carry little evidential weight.
By contrast, a firm that can produce:
- documented data-flow analysis,
- contractual assessment addressing confidentiality, jurisdiction and third-party access,
- clearly defined permitted and prohibited use cases, and
- identifiable ownership of AI governance,
will be able to demonstrate that AI risk was recognised and managed as a regulatory issue from the outset.
In a risk-based model, that distinction is decisive. Supervision does not reward intentions. It rewards evidence.
Incidents will be assessed as governance failures, not technical anomalies
There is a persistent assumption that regulators will approach AI-related failures with a degree of tolerance, given the pace of technological change. That assumption is misplaced.
The SRA’s supervisory approach has consistently focused on the reasonableness of decisions at the time they were made. Where risks were foreseeable – and many AI-related risks now are – the absence of structured governance will be treated as a failure, not as mitigation.
Remedial steps taken after an incident may influence outcome, but they do not address the underlying question. Training introduced after a breach does not substitute for governance that should have existed before deployment.
This is particularly acute where confidentiality or privilege is engaged. Once disclosure has occurred, the supervisory analysis will focus on whether the firm placed itself in that position through avoidable decisions taken upstream.
Why the next few years are likely to mark a shift in supervisory intensity
The significance of this phase lies not primarily in regulatory change, but in market maturity. As AI becomes increasingly embedded within legal practice, its use can no longer be characterised as experimental.
Firms will be expected to understand the systems they rely upon in the same way they are expected to understand outsourcing arrangements or data processing structures.
At the same time, the SRA is likely to accumulate greater supervisory experience, incident patterns and comparative data across firms.That combination allows a risk-based regulator to move from abstract principles to applied expectations.
What constitutes acceptable governance will not necessarily be codified in new rules. It will emerge through supervisory practice: through the questions asked, the evidence expected and the outcomes reached.
This is not speculative. It reflects how risk-based supervision operates once a technology moves from novelty to normalisation.
The direction of travel
The trajectory is already visible.
AI concentrates operational risk within systems that many firms do not fully understand. Risk-based supervision concentrates accountability on whether those systems were selected, assessed and governed in a structured way.
Firms will not be differentiated by whether they adopted AI early or late. They will be differentiated by whether they treated AI as a regulated activity requiring demonstrable control, or as a tool whose risks could be managed downstream.
Where documentation is absent, understanding is assumed to be absent. Where understanding is absent, control is difficult to assert.
Conclusion: supervision will test what firms knew at the time
The next phase of the AI debate will not concern whether solicitors can use AI. It will concern whether firms can demonstrate – with contemporaneous evidence – that their use of AI was defensible when examined retrospectively.
Risk-based supervision does not reward caution or innovation in the abstract. It rewards structured decision-making, clear ownership of risk, and the ability to evidence those matters at the time they were considered.
Firms that recognise this will treat AI governance as part of their supervisory footprint. Firms that do not will find that regulatory exposure was fixed long before the incident that brought them to attention.
AI does not change the regulator’s question. It sharpens it.
Did the firm know what it was doing – and can it prove this, based on what it recorded at the time?
Leave a Comment