Law firms and the SRA
Your AI answer has to survive a client questionnaire.
Legal is further ahead on this than most sectors, because live SRA guidance and client due diligence arrived at roughly the same time. Most firms now have an AI policy. Rather fewer can evidence the controls that sit underneath it.
In short
For SRA regulated law firms, EPX Intelligence builds the AI governance framework and the technical controls behind it: an AI policy your COLP can stand behind, permissions and information barrier work in your document management system, and the audit evidence a client questionnaire or a panel review asks for. Where you also want Copilot, the confidentiality work comes before the licences rather than after.
What is driving it
Three things arriving at once.
None of them is a slow burn. Two are commercial rather than regulatory, which is why they move faster than most firms expect.
Live SRA guidance
The SRA has published on the use of AI in legal services, and combined with existing confidentiality and competence duties it is pushing firms from considering a policy to writing one.
Client due diligence
Panel reviews and client questionnaires now ask how AI is governed. This is the one that actually moves budget, because the deadline belongs to the client rather than to you.
Fee earners already using it
Somebody is pasting a clause into a public model this week. In a firm with confidentiality duties that exposure is live today.
In your language
An AI policy nobody can technically enforce is a liability with a cover page on it.
Most law firms we speak to already have a policy document. What they do not have is the permissions work underneath it, and the gap between the two is exactly what an assessor will find.
The specific problem is retrieval across a document management system. An AI tool that searches your DMS has to respect matter level access and any information barriers in place. If it does not, it will surface material from a matter the user is walled off from, and it will do it helpfully and in writing. That needs a technical control behind it, not only a policy paragraph.
The second is what your people paste. Blocking public tools rarely works, it just moves the usage onto personal devices where you cannot see it. The sequence that does work is publishing an approved tool list with a usable alternative on it, then enforcing.
This is general information rather than legal or regulatory advice, and your COLP should form their own view. What we bring is the technical delivery behind whatever position they take.
What you get asked, and what answers it
The question, and the document behind the answer.
Every row is something a client, an insurer or an assessor has put in writing to a firm like yours. The right hand column is what we produce so the answer is a document you can attach.
| What you are asked | What answers it |
|---|---|
| How does your firm govern the use of artificial intelligence? | A written AI policy and acceptable use standard, with an approved tool list, mapped to the control set behind it. |
| What technical controls prevent client confidential information reaching an AI tool? | Sensitivity labelling, data loss prevention policy and the remediation record for your document management permissions. |
| Does your AI tooling respect matter level access and information barriers? | The retrieval configuration and the test evidence showing a walled off matter is not returned. |
| Who is accountable for AI in your firm, and how is it reviewed? | Named ownership in the management system, plus the internal audit and management review cycle covering it. |
| Are you certified to any AI standard? | Your current position stated accurately, plus the ISO/IEC 42001 readiness plan and its target date if you are pursuing one. |
| What happens if an AI tool produces something wrong that reaches a client? | The human review checkpoints in the workflow, and the incident process that treats it as a quality event. |
Straight answers
Questions from firms like yours
Does the SRA require us to have an AI policy?
The SRA has published guidance on AI in legal services, and that guidance alongside your existing confidentiality and competence duties is what is driving firms to write policy. In practice the sharper pressure is commercial: client due diligence now asks the question and expects a documented answer. Treat this as general information rather than regulatory advice, and take your COLP's view on the position itself.
Can we use Copilot without a confidentiality problem?
Yes, a law firm can use Microsoft 365 Copilot without creating a confidentiality problem, provided the work is done in the right order. Copilot shows a user what they already have permission to see, so a decade of quick sharing in your document management system becomes visible on day one. For a law firm that is a confidentiality issue rather than a technology one. The permissions and labelling work has to come before the licences.
We are 60 fee earners. Are we too small?
A 60 fee earner law firm is almost certainly not too small, and legal is the sector where size matters least. A 60 fee earner firm facing a panel review question has a harder deadline than a 200 person firm with a passing interest. Most of our clients are larger, but that is a description of who has found us rather than a rule.
Do you work with our existing legal IT provider?
Yes, EPX Intelligence works alongside a firm's existing legal IT provider and expects there to be one. Legal specific practice and case management systems are usually supported by a specialist, and we would rather work alongside them than argue about ownership. What we bring is the AI governance and the technical control work, which is not usually their strength.
Can you help with the AI section of a tender we are answering now?
Answering the AI section of a live tender is often the first piece of work EPX Intelligence does for a law firm. Bring the actual questionnaire to the discovery call.
The next step is a conversation
Bring us the client questionnaire.
Thirty minutes, no proposal attached. Bring the AI question your last panel review or client due diligence pack actually asked, and we will tell you what it would take to answer it properly.