Published by Cardinal AI Systems

AI governance
intelligence for
UK law firms.

A reported Upper Tribunal decision now states that uploading confidential documents into an open-source AI tool breaches client confidentiality and waives legal privilege, and should be referred to the ICO. The observation is obiter — persuasive, not binding — but it sits in a reported headnote, and the regulatory consequences are spelled out. SovereignBrief sets out what your firm needs to do before the next incident is yours.

Published by Ronke Jegede · Founder, Cardinal AI Systems · Free governance tools →
Intelligence Briefings · Updated August 2026
NEW · SRA · Legal Privilege · ICO7 min readUpdated August 2026

AI, Confidentiality and Supervision: What Ayinde, Munir and Cork Mean for Your Firm

Three reported decisions now govern this. In R (Ayinde) v London Borough of Haringey [2025] EWHC 1383 (Admin), the Divisional Court set out the professional duty to check AI-assisted research against authoritative sources before it reaches a court. In Munir [2026] UKUT 81 (IAC), published February 2026, the Upper Tribunal stated that uploading confidential documents into an open-source AI tool places them in the public domain, breaching client confidentiality and waiving legal privilege — conduct that might warrant SRA referral and should, in any event, be referred to the ICO. In Cork & Anor v Mark Smith [2026] EWHC 1199 (Ch), an AI pilot fabricated the text of a statutory rule that does not exist; the court held it had been misled twice, accepted there was no intention to mislead by the supervising solicitors, and treated the firm’s own self-referral to the SRA as the proportionate response. This briefing sets out what all three require your firm to do now.

Read full briefing →
SRA · UK GDPR7 min readUpdated August 2026

The SRA's AI Expectations: What the Guidance Actually Requires

The SRA has issued AI guidance that most firms have read but few have actioned. This briefing maps exactly what the SRA expects — on oversight, disclosure, competence, and supervision — with specific Code of Conduct references and a 10-point compliance checklist.

Read briefing →
SRA · UK GDPR · ICO6 min readUpdated August 2026

Shadow AI in Law Firms: The Risk Your Partners Don't Know They're Running

Fee earners across UK law firms are using personal ChatGPT, Gemini, and Claude accounts on client matters without firm knowledge. This is a live SRA Code breach and an active UK GDPR Article 28 violation — happening right now in most firms.

Read briefing →
SRA · EU AI Act9 min readUpdated August 2026

Agentic AI in Legal Practice: The Governance Gap Nobody Is Talking About

Law firms are deploying AI agents that take autonomous actions. The governance frameworks built for supervised AI tools do not apply. This briefing introduces the six-element supervision framework law firms need before deploying agentic AI.

Read briefing →
EU AI Act · SRA · ICO8 min readUpdated August 2026

EU AI Act: What UK Law Firms with EU Clients Must Know

The EU AI Act applies directly to UK law firms with EU clients, EU offices, or EU-facing work. This briefing covers which firms are in scope, which obligations apply, how this interacts with SRA and UK GDPR obligations, and what the Digital Omnibus changed — Article 4 and Article 50 obligations are live now, while Annex III high-risk obligations moved to 2 December 2027.

Read briefing →

New briefings.
Every month.
Free.

SRA updates, ICO enforcement actions, UK GDPR developments, and AI governance intelligence — distilled into one monthly briefing sent directly to your inbox. Read by Innovation Partners, COOs, and compliance teams at UK law firms.

Subscribe — Free →
Delivered via Substack. No spam. Unsubscribe anytime. One email per month.
Ronke Jegede, Founder and Chief Executive of Cardinal AI Systems and publisher of SovereignBrief
Ronke Jegede · Founder and Chief Executive
Published by
Ronke Jegede

Founder and Chief Executive of Cardinal AI Systems. Thirty years of governance and accountability work, eighteen of them as an accountable officer. LLB. ICSA qualifying examinations 1994 (ICSA is now the Chartered Governance Institute). Training completed with BSI in ISO/IEC 42001 and 23894 and the EU AI Act, in AI governance at Saïd Business School, Oxford, and in leadership at Harvard Business School. Twelve live AI applications designed and deployed across care, compliance, logistics and commerce, each governed under an ISO 42001 aligned stack. Author of the Cardinal Decision Evidence Assessment, published open access under CC BY (DOI 10.5281/zenodo.21952103). SovereignBrief is published monthly for UK law firms and regulated organisations navigating AI governance.