Operations
Book a call
01Insights

An AI policy template for small law firms (England & Wales, Australia and Singapore)

A free, plain-English AI use policy for law firms of 10–100 people, built from what the SRA, Australian regulators and Singapore's Ministry of Law actually say. Copy it, adapt it, and have it signed off within a few weeks.

Drafted with Claude (AI) · Reviewed and edited by Liliana Saplontai · 15 October 2026 · Updated 19 October 2026 · 9 min read

A lot of small law firms already use AI, whether or not anyone has decided they should. Someone summarises a long email chain in ChatGPT. A paralegal tidies a letter in Copilot. A partner asks it to explain a regulation she hasn't touched in years.

Plenty of them don't have a decision about how. That gap is where the risk lives.

In Clio's 2026 survey of UK and Irish legal professionals, 17% of firms had no formal AI policy at all. In Victoria's 2025 lawyer census, 45% of lawyers said their workplace had no AI guidelines, and another 13% weren't sure. The tools arrived first. The rules are catching up, quickly.

Here's a plain-English AI use policy you can copy, adapt and have signed off within a few weeks. I built it from what regulators and courts in England and Wales, Australia and Singapore actually say, and I've linked every source so you can check my reading of it.

Before you use itThis is a starting point, not legal advice. Rules differ by court and they are changing fast. Check the sources linked below against your own practice and jurisdiction, and have someone responsible for compliance sign it off.

Why this matters now

Two years ago, “be careful with ChatGPT” was the advice. Now there are consequences.

England and Wales. In June 2025 the High Court dealt with two cases where lawyers put fake, AI-generated citations before the court (Ayinde and Al-Haroun). The court said lawyers have a professional duty to check AI research against authoritative sources, that managing partners need “practical and effective measures” in place, and referred solicitors to the regulator. In August 2026 the SRA followed with a formal Warning Notice on the misuse of AI. Its line on fake citations is blunt: “Reliance on an output of AI would not be a suitable defence in this scenario.”

Australia. The NSW, Victorian and WA regulators issued a joint statement in December 2024 saying firms should have risk-based AI policies. NSW Supreme Court Practice Note SC Gen 23 has been in force since February 2025 (the Chief Justice opened a review of it in November 2025), Queensland added a verification rule in September 2025, and the Federal Court issued its own practice note in April 2026.

Singapore. The Ministry of Law published its Guide for Using Generative AI in the Legal Sector in March 2026. It's non-binding, but it's specific: appoint an AI lead (one person is fine for a small firm), approve tools by how sensitive the data is, keep records, and consider telling clients.

The direction is the same everywhere. Using AI is fine. Using it without a system is what regulators and courts are starting to call out.

What every regulator agrees on

Read the guidance from all three countries side by side and six points come up again and again. I'd build all six into your policy.

  1. Client confidentiality comes first. Confidential, privileged or personal client information doesn't go into public chatbots. The Law Society of NSW puts it well: doing so “is akin to putting it in the public domain”.
  2. A person checks every output. Especially citations. And checking with another AI tool doesn't count, which the NSW and Singapore courts both say explicitly.
  3. The lawyer stays accountable. Not the tool, not the vendor, not the IT person.
  4. Someone leads and supervises. A named person owns the policy, and supervisors check AI-assisted work from the people they supervise.
  5. People are trained. You can't verify an output you don't understand.
  6. The firm writes it down. Approved tools, what they're for, what's off limits, and a record of how it's going.

Where the three countries differ

Mostly on two things: what you tell clients, and what you tell the court.

Telling clientsTelling the court
England & WalesSRA Risk Outlook (2023): tell clients when you'll use AI on their case. The 2026 Warning Notice doesn't address client disclosure.No routine disclosure, but be ready to confirm you verified everything. Civil Justice Council recommendations pending.
AustraliaJoint statement and Law Society of NSW: be transparent, get approval, and make costs reflect the work done.Depends on the court. NSW has the strictest rules (affidavits, expert reports, submissions). Federal Court and Queensland have their own.
SingaporeMinLaw guide: “should consider informing clients”, especially where AI use is substantial or affects costs.No declaration unless the court asks. You're fully responsible for the content.

My view: always tell clients. Once, clearly, in your engagement letter, with an easy way to opt out. It costs one paragraph. In the same Clio survey, 79% of the public said lawyers should disclose AI use, and only 7% of clients recalled their lawyer telling them unprompted. One paragraph changes that. There's sample wording in section 7 of the template.

The template

Copy it, swap the bracketed parts for your firm's details, and delete the court rules that don't apply to you. It's deliberately short. A policy people actually read beats a perfect one nobody opens.

AI use policy · v1.0 · free to adapt
[FIRM NAME]: AI USE POLICY Version 1.0 · Approved by [NAME, ROLE] on [DATE] · Next review: [DATE + 6 MONTHS] 1. WHY WE HAVE THIS POLICY AI tools can save us time on drafting, summarising and admin. They can also leak client information, invent cases and make mistakes that look convincing. This policy sets out how everyone at [FIRM NAME] uses AI so we get the benefit without putting clients, the firm or our practising certificates at risk. It applies to everyone: partners, solicitors, paralegals, support staff, contractors and consultants, on firm devices and personal ones, whenever the work relates to the firm or its clients. 2. WHO IS RESPONSIBLE AI lead: [NAME]. They keep the approved tools list, answer questions, log incidents and run the six-monthly review. Every lawyer stays personally responsible for any work they sign, send or file, however it was prepared. "The AI wrote it" is never a defence. Supervisors are responsible for checking AI-assisted work from the people they supervise. 3. APPROVED TOOLS Only use AI tools on this list for firm work. Ask the AI lead before trying anything new. Tool | Version / plan | Allowed for | Not allowed for | Training on our data switched off? [e.g. Microsoft 365 Copilot] | [Business plan] | [Public and Internal] | [Confidential] | [Yes / confirmed DATE] [e.g. ChatGPT Team] | [Team plan] | [Public only] | [Internal and Confidential] | [Yes / confirmed DATE] Free or personal accounts of public chatbots are not approved for any client work. 4. WHAT INFORMATION CAN GO IN (THREE LEVELS) PUBLIC: use freely, in any approved tool Public information, published law, our own templates and know-how with no client details, general research questions, marketing drafts. INTERNAL: use with care, only in tools approved for Internal (a business or enterprise plan, with training on our data switched off), and only what the task needs Everyday client correspondence and matter facts, with names and identifying details removed wherever the task still works without them. If in doubt, treat it as Confidential. CONFIDENTIAL: stop and ask the AI lead first. It only goes into an AI tool if the AI lead has approved that specific tool and use in writing - Privileged or confidential client information - Sensitive personal data: health, financial, criminal or children's information - Material covered by a suppression order, the implied undertaking (Harman) or a subpoena - Anything a client has asked us not to share with third parties - Passwords, bank details and access credentials 5. CHECKING THE OUTPUT Treat every AI output as a first draft from a confident junior who has never practised law. - Every case, statute and quote is checked by a person against an authoritative source (the official report or legislation database) before it is used. Asking another AI tool to check is not a check. - Facts, dates, figures and names are checked against the file. - The reasoning and conclusion are your own professional judgment. - If you would not be comfortable explaining to the client or the court how a document was produced, do not send it. 6. COURT AND TRIBUNAL DOCUMENTS Follow the rules of the court you are in. They differ and they change. [England & Wales] No routine disclosure of AI use is required, but you must be able to confirm you independently verified all research and citations. Check the Civil Justice Council's final recommendations once published. [NSW] Supreme Court Practice Note SC Gen 23 (under review since November 2025, check the current version): no generative AI to create the content of affidavits, witness statements or character references, which must say so; leave is needed before using it for expert reports; written submissions prepared with AI must confirm every citation was verified. [Federal Court of Australia] Practice Note GPN-AI: confirm every authority and piece of evidence you cite exists and supports the point. Disclose AI use if the Court asks, and always where AI was used to summarise or analyse material a witness relies on, or to create images, audio or video. [Queensland Supreme Court] Practice Direction 5 of 2025: submissions must name the practitioner responsible for verifying every reference. [Singapore Supreme Court] Registrar's Circular No. 1 of 2024: no pre-emptive declaration needed unless the court asks, but you are fully responsible for the content, and AI must not be used to generate evidence. Never use AI to create or alter evidence. 7. CLIENTS - Our engagement letter tells clients we may use approved AI tools, what for, and how we protect their information. Sample wording to adapt (have it checked for your jurisdiction): "We may use approved AI tools to help with drafting, summarising and administration on your matter. A lawyer reviews all AI-assisted work and remains responsible for it. Your confidential information only goes into tools under business contracts that keep it secure and do not use it to train their systems. If you would prefer we don't use AI on your matter, tell us and we will note it on your file." - If a client asks us not to use AI on their matter, we record that on the file and follow it. - Bills reflect the work actually done. Where we bill by time, we do not charge for time AI saved us. 8. TRAINING AND SUPERVISION - Everyone completes the firm's AI training before using an approved tool for client work, and a refresher each year. - New starters are shown this policy in their first week. - Supervisors review AI-assisted work from trainees and support staff with the same care as any other work, and more where the output is unfamiliar. 9. RECORDS For each matter where AI was used for anything beyond Public information, note on the file: the tool, what it was used for, and who checked the output. The AI lead keeps a log of approved tools, incidents and review dates. 10. WHEN SOMETHING GOES WRONG If client information went into the wrong tool, or an AI error reached a client, the court or another party: 1. Tell the AI lead and your supervisor the same day. 2. Do not try to quietly fix it. 3. The firm decides whether the client, insurer, regulator or data protection authority needs to be told, and logs what happened and what changed as a result. Raising a mistake early is expected and supported. Hiding one is a disciplinary matter. 11. REVIEW The AI lead reviews this policy every six months, and sooner if a regulator or court issues new rules, a new tool is approved, or an incident shows a gap. I have read and understood this policy. Name: ____________ Signature: ____________ Date: ____________

How to put it in place

The document is the easy part. Adoption is where most firms stall, and it's the part I care most about in my work with service firms. Four steps:

  1. Find out what people already use. Ask everyone, without blame, which AI tools they've tried for work in the last month. You'll be surprised. That list is your starting point for section 3.
  2. Pick one AI lead and two approved tools. Check each tool's settings so your data isn't used for training, and write down the date you checked.
  3. Run a 45-minute session, then send a one-page summary. Walk through the three levels (Public, Internal, Confidential) with real examples from your own matters. People remember the example where a client name almost went into a chatbot. They don't remember paragraph 4. The one-pager is what they'll check six weeks later.
  4. Put the review in the calendar now. Six months from today. Rules will have moved by then.

Your one thing this week: send the “what do you already use?” question to your team. Everything else builds on the answer.

How this was written

This article was drafted with Claude, an AI assistant. It did the research and the first draft, and a separate AI review re-checked every source. I read it, edited it, and the views in it are mine.

Sources

Checked on 15 October 2026 and re-checked on 19 October 2026. Court rules in particular change often, so open the current version before relying on any of these.

02Next step

Want help making this fit your firm?

Thirty minutes, free. Bring your draft policy or your questions.

Book a free callPrefer email or WhatsApp? hello@lilianaoperations.com or WhatsApp me — I reply within a dayMove across to stir the paint
Quick question? WhatsApp me