UK AI regulation: key risks for in-house lawyers

No UK AI Act does not mean no regulation

A common misconception is that, without an AI Act, AI use in the UK is largely unregulated. While the UK does not (yet) regulate AI as a technology, its use is governed by existing frameworks, including financial services, data protection and intellectual property law.

The Artificial Intelligence (Regulation) Bill, introduced in the House of Lords in March 2025, did not progress beyond its first reading. Other jurisdictions have gone further. The EU AI Act classifies AI systems by risk, bans some uses outright (such as government-run social scoring and biometric categorisation and identification) and imposes heavy obligations on high-risk systems. The US approach has largely favoured innovation through executive orders, state laws and guidance, although more prescriptive federal proposals are under discussion. In the UK, the practical rules come from regulators and the courts. 

The bodies that regulate solicitors – the Solicitors Regulation Authority (SRA) and the Law Society of Scotland – have issued AI guidance, as have sector regulators including the Financial Conduct Authority (FCA), the Information Commissioner’s Office (ICO), Ofcom and Ofgem.

For in-house lawyers, these risks are real. They arise under existing duties and rules, including the duty not to mislead the court, legal privilege and copyright. In regulated sectors such as financial services, regulators' expectations also apply, including the FCA's focus on governance and accountability, so a misstep can have both professional and regulatory consequences.

When AI goes wrong in court

In Cork v Smith [2026] EWHC 1199 (Ch), a law firm put AI-hallucinated material before the court, citing regulations that did not exist, even though the tool had warned that its output could be inaccurate and should be checked against primary material. The court publicly admonished the firm and referred the matter to the regulator. The judge stressed that “legal professionals bear ultimate responsibility for their work and cannot outsource the process of legal research or of legal reasoning to an AI” noting that AI “is a tool to be used with caution.” 

Privilege is also at risk. It shields legal advice and material prepared in contemplation of litigation, however damaging, from an opposing party, but only while that material remains confidential. In UK v Secretary of State for the Home Department [2026] UKUT 81 (IAC), the Upper Tribunal said that uploading confidential documents to a public AI tool such as ChatGPT puts that information in the public domain, breaching confidentiality and therefore waiving privilege. Commentators have questioned this, and a higher court may take a more nuanced view. Until then, few will want to be the test case. Internal clients, particularly those involved in litigation, should be reminded not to upload case-related material to a public AI tool.

Using AI safely: four simple rules

A simple, proportionate approach addresses most of these risks:

• Don't rely on the output. Check facts, figures and citations against original sources, especially anything going before a court or regulator.
• Don't put anything you want to keep privileged into a public AI tool. Use secure tools with contractual protections over how data is stored, retained and used.
• Don't treat the output as original work. AI output may reproduce third-party copyright material, and in the UK it is uncertain whether wholly AI-generated work attracts copyright protection at all.
• Do follow your sector regulator’s guidance. UK regulation is context-specific, so this is where the practical rules are being set.

The benefits, without the exposure

AI offers organisations significant opportunities to work more efficiently, but, as these cases show, it also carries significant risks. These steps can support confident AI use, delivering efficiency gains without exposing privileged advice, misleading a court or building a business on content the organisation may not own. Clear rules on approved tools, prohibited uploads and how outputs must be checked will help manage these risks.