AI is already in your firm. Can you prove it’s under control?

A policy tells people what they should do. It doesn’t tell you what they did. Both the SRA and ICAEW expect more than a document: the SRA’s warning notice talks about effective governance, systems and controls, and ICAEW’s audit guidance expects policies backed by procedures and training. Most firms we speak to have a policy of some kind, but nothing that reports on actual usage, blocks unauthorised tools, or prevents confidential data being pasted into them. The controls in this service are what turn a policy into something you can evidence.

More than most firms realise. The SRA issued a warning notice on the misuse of AI in August 2026, naming confidential client information entered into public AI tools as a specific concern. The ICO’s AI and data protection guidance already applies, with a statutory code of practice on AI and automated decision-making now on its way. The FCA has said it won’t write separate AI rules and expects firms to manage AI under existing frameworks like the Consumer Duty and SM&CR. ICAEW’s Code of Ethics treats loading client data into public AI tools as a confidentiality problem.

For law firms, that risk is real enough that the SRA has drawn attention to it. A 2026 Upper Tribunal decision observed that putting client material into an open AI tool amounts to placing it in the public domain, and the SRA’s warning notice makes the point that privilege lost this way may be permanently waived. This is precisely why shadow AI reporting and data loss prevention matter more than a policy asking people not to do it.

Application controls and endpoint protection cover firm devices, and data loss prevention follows the data rather than the device, so confidential information is blocked from leaving your environment regardless of where someone tries to take it. Personal device use is a real gap for every firm, which is why shadow AI reporting matters. You need to know the scale of it before deciding how far to go.

No, and that would be the wrong outcome. The point is to make safe AI use possible by drawing a clear line between the tools that are governed and the ones that aren’t. Once confidential data is labelled and protected, you can let people get on with using AI properly rather than banning it and watching them do it anyway.

Our Copilot service is about adopting one tool safely, readying your data, setting guardrails and rolling it out. This service is about everything else: the AI already in your firm that nobody chose, the confidential data that could leak into it, and the evidence that it’s all under control. Copilot does not work for many firms and Claude and ChatGPT are in regular use, especially in Financial Services firms.

To get the full benefit of our AI compliance and security service, SME firms require Microsoft Defender Suite and Microsoft Purview Suite in addition to their Microsoft 365 Business Premium licences. There are still many controls that can reduce your risk without buying these additional licences and these should be in place as a bare minimum. Contact our team for further details.

You have the capability to put in place some basic AI controls, which go some way to reducing risk. However, most firms do not have them configured or managed. To find out what you do have, and what your risk is, consider asking our team to audit your Microsoft 365 environment.