For SRA-regulated firms
Your fee-earners are using AI. Your proposal form assumes you’ve looked.
Your PII proposal form requires a fair presentation of risk following a reasonable search. If AI is in your firm and nobody has mapped where it is and what risks it carries, no reasonable search has been made. A Principal still signs. We fix that by mapping your AI usage and providing you with a risk register within 30 days (max), before your renewal.
The duty you already have
You don’t need an AI question on the form for AI to be a disclosure problem.
Some insurers have begun adding AI questions to proposal forms. Some haven’t yet. It makes less difference than firms assume, because the obligation that bites doesn’t depend on being asked.
A reasonable search is required
You must be able to demonstrate that appropriate enquiries were made to establish what senior management knew or ought to have known. Not asking is not a defence because a lack of enquiry is itself a breach of the duty.
As per proposal form declarationAI is the thing nobody enquired about
Fee-earners adopt tools individually. AI arrives inside software the firm already licenses. Nobody registered it, nobody approved it, and in the worst case nobody has ever asked. That is precisely the circumstance you ought to know.
Shadow AIAnd the SRA now expects evidence
AI outputs must receive appropriate human review, with an authorised individual retaining responsibility. Firms must be able to evidence the supervision arrangements they've chosen. Solicitors are already being referred over AI-generated citations.
SRA supervision guidance, June 2026What you’re already signing
The questions are on the form today. AI is what makes them hard to answer.
These aren’t new questions. They’re the standard risk-management section of a solicitors’ proposal form — and every one of them gets more uncomfortable once you accept that AI is being used in the firm and nobody has mapped where.
Risk management
Do you maintain a risk register covering strategic, financial, regulatory and operational risks, and the arrangements to mitigate them?
You tick yes. Does that register mention AI anywhere? If not, is the yes still true?
Risk management
Do you have a named supervisor for each area of work — and can you provide evidence that each supervisor is competent to hold supervisory responsibility?
Competent to supervise AI-assisted work? Evidenced how? This is now the SRA's explicit expectation.
Risk management
How do you conduct independent file audits — how often, how many, and by whom?
Do those audits catch a fabricated citation or an AI-drafted clause nobody checked?
Risk management · remote working
What enhanced supervision is in place to monitor work, particularly of solicitors new to the practice?
Unsupervised, remote, and under time pressure is exactly where the AI shortcut gets taken.
Information security
What controls do you have in place to protect client information?
Including the confidential document pasted into a public AI tool at seven in the evening?
Phase one
AI Exposure Review
The reasonable search, done properly. Know exactly where AI lives in your firm, what’s yours to govern, where the gaps are, and what closing them will involve. Two to four weeks. Fixed price. You keep the artefacts whether or not you go further.
AI footprint map
The enquiry, evidenced
One map per practice area or team, consolidated into a single firm-wide view: where AI is used, in which processes, by whom, on what matters, and against which client data. Including the tools nobody flagged.
AI systems register
Your single source of truth
The operational inventory of every AI system in the firm, with an owner against each. The document your COLP points to — and the authorised-tools list your AI policy refers back to.
Gap list against SRA and insurer expectations
What's missing, and what it exposes
Where the firm currently falls short on documented supervision, confidentiality handling, and the risk-management answers you're already giving on the form — prioritised, with the exposure named plainly.
Costed plan for closing the gaps
Makes the next decision concrete
A fixed-price, evidence-based scope for the governance build — so the bigger decision is a known quantity rather than open-ended professional fees.
- Duration
- Two to four weeks
- Price
- Fixed, scaled to firm size
- Guarantee
- Artefacts delivered before your renewal, or you don’t pay
- If you proceed
- Fee credited against the build
Phase two · optional
Then: the build, and the training.
Phase one tells you what’s actually there. Phase two puts the governance in place — aligned with ISO/IEC 42001, without the weight or cost of a certification programme.
AI Governance Build
The policies, controls, records and evidence that let your COLP answer the SRA — and let you stand behind the answers you’re already giving your insurer.
- SRA-aligned AI policy and authorised-tools list
- Integrated risk register (AI × confidentiality × data protection)
- Documented supervision and human-review controls
- Evidence pack for renewal and for the SRA
Fee-earner training
Practical and matter-level, not a compliance lecture — because the risk is a busy associate pasting a client document into a public tool at seven in the evening.
- Verification and the duty not to mislead the court
- Confidentiality, privilege and what never leaves the firm
- What the approved tools are, and how to use them
- Attendance records you can evidence
Honest fit
Who this is for — and who it isn’t.
A good fit if
- You’re SRA-regulated, roughly up to 50 fee-earners
- You have no in-house risk or compliance function
- Your fee-earners are using AI — with or without a policy
- Nobody has formally asked where, or written it down
- A Principal is about to sign a declaration about it
Not a good fit if
- You have a mature risk function already doing this
- You’ve already mapped and registered your AI use
- You want ISO 42001 certification now — different engagement
- You want a policy document with nothing behind it
Who you’d be working with
We don’t sell paperwork.
A policy that claims a control you don’t run is worse than none. On a proposal form, that isn’t a documentation problem — it’s a disclosure one. Everything we build is real, evidenced, and defensible.
Standards
Committee member, BSI & ISO technical committees
Delivery
Regulated, sensitive-data environments
Questions
What partners ask us.
There's no AI question on our proposal form.
There may not be — some insurers have started adding them, many haven't. But the declaration on your form already requires a fair presentation of the risk following a reasonable search, and it already asks whether your risk register covers regulatory and operational risk and whether your supervisors are competent and evidenced. AI doesn't need its own question to make those answers harder to stand behind.
The market is soft and our premium is fine. Why now?
Premium isn't the exposure. Non-disclosure is — the declaration warns that errors or inaccuracies may invalidate the contract, and that a lack of enquiry breaches the duty. Add the SRA's supervision expectations, where the consequence lands on your COLP and on individual practising certificates rather than on the premium line, and a soft market changes very little.
We already have an AI policy.
Then you're ahead of most firms. The harder question is whether the policy matches what fee-earners are actually doing. A policy that doesn't reflect real usage is a written statement you can be measured against — and it doesn't constitute the reasonable search either, because it describes what should happen rather than what does.
We handle this in-house.
Plenty of firms can, and if you have a risk function actively doing it, you don't need us. Where we earn our place is doing the initial search and build quickly and in the form your insurer and the SRA expect, so your people stay on fee-earning work.
Does this make us ISO 42001 certified?
No. This is a lightweight, ISO/IEC 42001-aligned governance baseline without the weight or cost of a certification programme. It's the right foundation if you pursue certification later — but the point of it is to let you answer your insurer and your regulator now.
Will this slow our fee-earners down?
The opposite is the intention. Most firms are stuck between a blanket ban nobody follows and a free-for-all nobody can evidence. Approved tools, clear rules and a supervision trail are what let people use AI properly rather than quietly.
Before a Principal signs
Has anyone actually asked where AI is being used?
A 20-minute call. We’ll go through what your form already requires you to have searched for — and you’ll leave knowing whether you could evidence it. Whether or not you work with us.
Book a 20-minute call