A reported Upper Tribunal decision now states that uploading confidential documents into an open-source AI tool breaches client confidentiality and waives legal privilege, and should be referred to the ICO. The observation is obiter — persuasive, not binding — but it sits in a reported headnote, and the regulatory consequences are spelled out. SovereignBrief sets out what your firm needs to do before the next incident is yours.
Three reported decisions now govern this. In R (Ayinde) v London Borough of Haringey [2025] EWHC 1383 (Admin), the Divisional Court set out the professional duty to check AI-assisted research against authoritative sources before it reaches a court. In Munir [2026] UKUT 81 (IAC), published February 2026, the Upper Tribunal stated that uploading confidential documents into an open-source AI tool places them in the public domain, breaching client confidentiality and waiving legal privilege — conduct that might warrant SRA referral and should, in any event, be referred to the ICO. In Cork & Anor v Mark Smith [2026] EWHC 1199 (Ch), an AI pilot fabricated the text of a statutory rule that does not exist; the court held it had been misled twice, accepted there was no intention to mislead by the supervising solicitors, and treated the firm’s own self-referral to the SRA as the proportionate response. This briefing sets out what all three require your firm to do now.
The SRA has issued AI guidance that most firms have read but few have actioned. This briefing maps exactly what the SRA expects — on oversight, disclosure, competence, and supervision — with specific Code of Conduct references and a 10-point compliance checklist.
Fee earners across UK law firms are using personal ChatGPT, Gemini, and Claude accounts on client matters without firm knowledge. This is a live SRA Code breach and an active UK GDPR Article 28 violation — happening right now in most firms.
Law firms are deploying AI agents that take autonomous actions. The governance frameworks built for supervised AI tools do not apply. This briefing introduces the six-element supervision framework law firms need before deploying agentic AI.
The EU AI Act applies directly to UK law firms with EU clients, EU offices, or EU-facing work. This briefing covers which firms are in scope, which obligations apply, how this interacts with SRA and UK GDPR obligations, and what the Digital Omnibus changed — Article 4 and Article 50 obligations are live now, while Annex III high-risk obligations moved to 2 December 2027.
SRA updates, ICO enforcement actions, UK GDPR developments, and AI governance intelligence — distilled into one monthly briefing sent directly to your inbox. Read by Innovation Partners, COOs, and compliance teams at UK law firms.
Founder and Chief Executive of Cardinal AI Systems. Thirty years of governance and accountability work, eighteen of them as an accountable officer. LLB. ICSA qualifying examinations 1994 (ICSA is now the Chartered Governance Institute). Training completed with BSI in ISO/IEC 42001 and 23894 and the EU AI Act, in AI governance at Saïd Business School, Oxford, and in leadership at Harvard Business School. Twelve live AI applications designed and deployed across care, compliance, logistics and commerce, each governed under an ISO 42001 aligned stack. Author of the Cardinal Decision Evidence Assessment, published open access under CC BY (DOI 10.5281/zenodo.21952103). SovereignBrief is published monthly for UK law firms and regulated organisations navigating AI governance.