The short answer
AI due diligence means answering eight questions from a provider's contract rather than its marketing page before client information goes anywhere near the tool: is there a written processing agreement, will your inputs train the provider's models, how long is data retained and can you delete it, where is it processed, who can access it, what security applies, is a DPIA needed, and does the tool keep information inside a controlled environment. The SRA's warning notice on the misuse of AI, published on 17 August 2026, makes appropriate contractual, technical and organisational safeguards a condition of entering client information into AI systems. Record the answers, the decision and the date, because the record is what shows a decision was actually made rather than assumed.
What the checklist rests on
- SRA warning notice, misuse of AI: published 17 August 2026. Client information only where appropriate contractual, technical and organisational safeguards are in place
- Code of Conduct for Firms, paragraph 2.1: the governance obligation the notice relies on for managing AI risk
- UK GDPR Article 28: processors must offer sufficient guarantees, and the contract must carry eight mandatory terms
- ICO DPIA guidance: AI is innovative technology, which is a screening criterion rather than an automatic trigger
- ICO international transfers guidance: rewritten on 15 January 2026 around a three step test
- Privilege warning: UK and R (Munir) v SSHD [2026] UKUT 00081 (IAC), promulgated 17 November 2025, at paragraph 21
Why is AI due diligence now expected?
Because the SRA has made safeguards a condition of putting client information into AI systems, and because data protection law already required firms to choose providers carefully. The question is no longer whether to check a tool. It is whether the firm can show that it did.
Telling a firm to check the terms is easy. Knowing what to check, what a good answer looks like and what to write down afterwards is the harder part, and it is the part a COLP, managing partner or practice manager has to be able to defend if the SRA asks how a particular tool came to be approved.
The SRA's warning notice on the misuse of AI, published on 17 August 2026, says client information should be entered into AI systems only where appropriate contractual, technical and organisational safeguards are in place to protect confidentiality. It asks firms to confirm that client data remains within a secure environment, is not accessed by unauthorised third parties, is not used to train AI models except where explicitly authorised and appropriate to do so, and is not kept longer than necessary. It warns that free and paid tools alike may lack those safeguards, and that a firm entering confidential information into an AI tool may no longer have full control over how that information is processed or used.
The notice also ties this back to a rule rather than leaving it as advice. It cites paragraph 2.1 of the Code of Conduct for Firms, which requires effective governance structures, systems and controls to manage risk. That is the same obligation that sits under the firm's risk assessment work elsewhere, and it is why an AI approval decision belongs in a document rather than in somebody's memory.
Data protection law points the same way. Where an AI provider processes personal data on the firm's behalf, Article 28(1) of the UK GDPR allows a controller to use only a processor that provides sufficient guarantees to implement appropriate technical and organisational measures, so that the processing meets the requirements of the Regulation. Choosing a provider without checking is itself the breach, separately from anything that later goes wrong.
What should an AI due diligence checklist cover?
Eight areas: the contract, training, retention, location, access, security, whether a DPIA is needed, and privilege. Each one can be answered from the provider's contract, its data processing terms and its account settings, and each answer should be written down.
Two points apply across all eight. First, check the plan the firm is actually buying. Terms routinely differ between the consumer, business and enterprise tiers of the same product, and the public help page usually describes the consumer tier. Second, distinguish a contractual commitment from a toggle. A setting an individual fee earner can change is not a safeguard.
1. Is there a proper processing contract?
Ask whether the provider acts as a processor, and whether a written data processing agreement is in place for the specific plan the firm will use. Article 28(3) of the UK GDPR sets out what that contract has to contain: the processor acts only on documented instructions, keeps the data confidential, applies appropriate security measures, engages sub-processors only with authorisation, assists the firm in responding to requests from individuals, assists with the firm's own security, breach notification and DPIA obligations, deletes or returns the data at the end of the service, and makes information available and submits to audits so the firm can demonstrate compliance.
A good answer
A signed agreement, or terms clearly incorporated into the subscription, covering all eight points. A consumer-facing privacy policy is not a substitute, and neither is a page of marketing assurances about security.
2. Will our inputs be used to train the provider's models?
Ask whether prompts, uploaded documents and outputs are used for training, whether training is the default position, and whether it can be switched off at account or tenant level rather than by each user. The SRA's notice permits client data to be used for training only where that is explicitly authorised and appropriate, which is a two part test rather than a box to tick.
A good answer
A contractual commitment that client data is not used to train models, applied at the account level, rather than a default-on setting that a user could reverse.
3. How long is data kept, and can it be deleted?
Ask how long prompts, files and outputs are retained, whether logs are held separately and on a different clock, and whether the firm can delete data on request and at the end of the relationship. Abuse-monitoring logs are the usual gap: a provider may commit to deleting conversations within thirty days while retaining safety logs for longer under a separate policy.
A good answer
A stated retention period for each category of data, including logs, and a deletion route the firm can trigger itself. The SRA notice is specific that client data should not be retained longer than necessary.
4. Where is the data processed, and does it leave the UK?
Ask where data is stored and processed, including by sub-processors, and whether the firm can choose a region. If personal data leaves the UK, the firm has to work out whether this is a restricted transfer and, if it is, which mechanism covers it.
The ICO rewrote its international transfers guidance on 15 January 2026, so internal notes written before then are describing a structure that no longer exists. The guidance is now built around a three step test: does the UK GDPR apply to the processing of the information being transferred, is the firm initiating a transfer to an organisation located outside the UK, and is the receiving organisation a separate legal entity. Yes to all three means a restricted transfer, which must then be covered by UK adequacy regulations, appropriate safeguards, or one of the exceptions the legislation calls derogations. The ICO has said further updates on transfer risk assessments, the international data transfer agreement and cloud services are still to come, so this is an area to recheck rather than file.
5. Who can access the data?
Ask which of the provider's staff can access client data and in what circumstances, and request the current sub-processor list. Ask how the firm will be told about new sub-processors and whether it can object. The SRA notice asks firms to confirm that data is not accessed by unauthorised third parties, and a sub-processor the firm has never seen named is difficult to describe as authorised.
A good answer
Human access limited to defined purposes such as security investigation or legally required support, a published sub-processor list, advance notice of additions, and a right to object.
6. What security measures are in place?
Ask how data is encrypted in transit and at rest, how access is controlled and logged, and whether the provider holds independent certification or will share an audit report. Ask how and how quickly it will notify the firm of a breach, because the firm carries its own reporting obligations and cannot meet them on a timetable it has not agreed. A certification badge on a website is a claim; the certificate's scope statement is the document, and it often covers less of the product than the badge implies.
7. Do we need a DPIA?
Ask this before the tool goes live rather than after. The ICO's guidance on when a DPIA is needed treats innovative technology as a screening criterion and gives artificial intelligence, machine learning and deep learning as examples, including the application of AI to an existing process. A DPIA is required where innovative technology is combined with another of the relevant criteria, and the ICO adds that in some cases the intended use of innovative technology will require one on its own.
The practical consequence is that the answer is rarely automatic in either direction. Where the firm concludes a DPIA is not needed, the ICO says it should document its reasons, which means the no is as much a record as the yes.
8. Could using the tool waive privilege?
Ask whether the tool keeps information inside a controlled environment, because a judicial warning now exists on exactly this point. In UK and R (on the application of Munir) v Secretary of State for the Home Department (AI hallucinations; supervision; Hamid) [2026] UKUT 00081 (IAC), promulgated on 17 November 2025, a panel of Upper Tribunal Judges Lindsley, Keith and Blundell said this at paragraph 21:
The Tribunal went on to say that closed source tools which do not place information in the public domain, naming Microsoft Copilot, are available for tasks such as summarising without those risks.
Read that carefully, because the status of the passage matters. It opens with the words "we also observe". These were observations in a Hamid hearing about the conduct of two representatives, not a contested ruling on waiver between parties arguing the point, and the Tribunal did not set out a test for what makes a system safe. A court asked to decide whether privilege was lost in a particular case would not be bound by it. What a firm can take from it is narrower and still serious: a three judge panel has said in a reported decision that it regards this conduct as a confidentiality breach and a waiver, that it expects the regulator to be told, and that the ICO should be consulted. That is sufficient reason to treat the question as settled for internal purposes, whatever a future court concludes.
The answers to questions one to five are what tell a firm which side of that line a tool sits on. The same decision also dealt with the more familiar AI risk, fabricated authorities, and confirmed that a supervising solicitor remains responsible for a junior's work and must ensure the junior understands the risks of using non-specialist AI. Judicial review claim forms now carry a statement of truth confirming that cited authorities exist and support the proposition advanced. Our guide to fake AI citations in court covers that side of the problem and the verification controls firms have put in place since.
What should the firm record?
A short, dated assessment for each approved tool, showing what was checked, what the answers were and who decided. That record is what turns good intentions into evidence. One page is usually enough.
- The tool, the provider, and the plan or licence level actually assessed
- The answers to the eight questions, with links to the contract and terms relied on
- Whether a DPIA was carried out, or the documented reasons it was not
- The decision: approved for client information, approved for non-client work only, or refused
- Any conditions attached, such as settings that must stay switched off
- Who decided, the date, and when the assessment will be reviewed
Two refinements make the record more useful than a filing exercise. Date-stamp the terms you relied on, or keep a copy, because provider terms change without notice and an assessment that cites a page rather than a version cannot be reconstructed later. And record the refusals as well as the approvals, since a file showing that the firm declined a tool is stronger evidence of a functioning process than a file in which everything was approved.
Who owns this is worth settling explicitly. The compliance duty sits with the firm through its systems and controls, with the COLP carrying the obligation to take reasonable steps to ensure compliance, which is covered in our explainer on what a COLP is and who can hold the role. In practice the assessment is often prepared by an IT or operations lead and signed off by the COLP, and the sign-off is the part that is missing most often.
The SRA's notice reminds firms that they need effective governance structures, systems and controls to manage AI risks. A set of these records, kept together and revisited when a tool or its terms change, is a practical way to show those controls exist rather than assert it.
Frequently asked questions
Does the SRA prohibit putting client information into AI tools?
No. The warning notice of 17 August 2026 permits it where appropriate contractual, technical and organisational safeguards are in place to protect confidentiality. The restriction is on doing it without those safeguards, not on the practice itself.
Do we need a DPIA before using an AI tool?
Often, but not automatically. The ICO treats AI as innovative technology, which requires a DPIA when combined with another of its criteria, and may require one on its own depending on the use. Where a firm decides a DPIA is not needed, the ICO says it should document its reasons.
Does using ChatGPT waive legal privilege?
The Upper Tribunal has said that putting client documents into an open source tool such as ChatGPT places the information in the public domain, breaches confidentiality and waives privilege. That was an observation in a Hamid hearing rather than a ruling on waiver between parties, so it does not bind a court deciding the point, but it is a clear signal from a three judge panel and firms should treat it as one.
Is an enterprise plan enough on its own?
No. An enterprise plan usually improves the contractual position, but the eight questions still have to be answered against that plan's terms, including the sub-processor list, the retention position for logs and the processing location.
What should we do if client data has already gone into a public AI tool?
Treat it as a potential data breach and a confidentiality issue at the same time. The Upper Tribunal said a regulated professional or firm that does this would need to bring it to the attention of their regulator and would be advised to consult the Information Commissioner's Office. Deal with the reporting assessment before deciding what to tell the client.
How often should an AI tool assessment be reviewed?
Whenever the tool, the plan or the provider's terms change, and otherwise on a fixed cycle the firm sets and records. Provider terms are amended frequently, so an assessment that cites a live web page rather than a dated copy becomes unverifiable quite quickly.
What to do before the next tool is approved
Approving an AI tool for client work is a decision about confidentiality, privilege and data protection at the same time, and it is usually made by whoever asked for the licence. Pull the list of AI tools already in use across the firm, including the ones nobody approved, and work out which of them have ever had client information put into them. Then run the eight questions against the plan each one is actually on, not the product in general, and write the answers down with the date and the terms you relied on.
Eight questions, answered from the contract rather than the marketing page and recorded on a single page, give a firm a decision it can explain to a client, an insurer or the regulator. The firms that struggle are not the ones that chose the wrong tool. They are the ones that cannot show how the choice was made.
To see where the firm sits across its wider obligations, our SRA Compliance Readiness Score covers governance and systems alongside seven other dimensions, and sits with our other free tools for solicitors and law firms.