Shadow AI in Law Firms: The Risk Most Partners Cannot See

Shadow AI is what happens when people in a firm use AI tools the firm has not approved, usually free or personal accounts, with no policy, no oversight and nobody checking the output. In UK law firms it is not a fringe problem. It is the normal state of things, and most partners do not know it is happening.

This article explains how widespread shadow AI in law firms has become, why it matters, and how to replace it with AI use the firm can actually see and control.

The figures here come from our quarterly report, The impact of AI in the legal sector: Q4 2026 edition. It tracks how UK law firms use AI, what the SRA and the courts have said, and what it means for small and mid sized firms. Every figure in it names its source and date, and vendor figures are clearly marked.

The gap between what lawyers do and what firms know

Ask lawyers whether they use AI and almost all of them say yes. A LexisNexis survey in September 2026 found 94% of UK legal professionals use AI for legal work, and Clio's UK and Ireland research put the figure at 89%. Ask whether AI is actually part of how their firm runs, and the answer falls sharply. Only 29% say AI is embedded in their firm's strategy and operations, and Clio found just 27% of firms have embedded AI widely across the organisation.

That gap of more than 60 points is shadow AI. People are using AI, but mostly on their own terms, on their own accounts, outside anything the firm has set up. It is the central finding of our report on the impact of AI in the legal sector.

The most striking figure comes from an Access Legal study of small and mid sized UK firms, published in May 2026. Nearly 60% of fee earners admitted using unapproved tools such as free ChatGPT. At the same time, 68% of firm leaders were confident there was zero risk of unapproved AI being used on client work. In other words, most leaders believe the problem does not exist in their firm, while most of their fee earners are quietly doing exactly that.

This is not just a UK pattern. Thomson Reuters' 2026 Future of Professionals research found a third of professionals use AI tools their organisation has not sanctioned, rising to 41% among those who feel their organisation is moving too slowly.

These surveys come from legal software vendors, so it is fair to read them with some care. But different vendors, asking different questions, keep finding the same thing. People are using AI whether or not their firm has said yes.

Why people turn to shadow AI

It is tempting to treat shadow AI as a discipline problem. It is better understood as a demand problem.

Fee earners are under constant pressure on time. AI tools help them draft faster, summarise long documents and tidy up correspondence. When the firm offers no approved tool, people find their own. The same Thomson Reuters research suggests that the slower an organisation is to act, the more likely staff are to go around it.

The research also shows most firms have not given people an alternative. In 8am's 2026 legal industry report, 43% of firms had no AI policy and no plans for one, 54% provided no AI training, and only 9% had a written policy that was actually enforced. Without a safe option or clear rules, people make their own decisions. Most of those decisions are well meant. Some of them put the firm at real risk.

The risks of shadow AI in law firms

Confidentiality and privilege

The most serious risk is client data ending up in tools the firm has no contract with. Free and personal AI accounts are built for consumers. Depending on the settings, what people type may be kept by the provider and used to improve its models. There is no data processing agreement with the firm, and no way for the firm to see, control or delete what was shared. We explain this in more detail in what happens to your client's data when you use an AI tool.

The courts are taking a hard line. In UK v Secretary of State for the Home Department [2026] UKUT 81 (IAC), the Upper Tribunal said that putting client letters into an open AI tool such as ChatGPT places them in the public domain, breaching client confidentiality and waiving legal privilege.

Data protection

If a fee earner pastes a client's personal data into a free AI tool, the firm may have shared that data with a third party without a lawful basis or a proper contract. Under UK GDPR, that can be a personal data breach. If it is reportable, the ICO must be told within 72 hours. The difficulty with shadow AI is that the firm usually has no idea it has happened.

Made up cases and inaccurate work

AI tools can produce confident, well written answers that are wrong, including cases and citations that do not exist. This is not a theoretical risk. Our report counts 76 court decisions in the UK involving fabricated AI output, and the SRA received 42 reports of possible AI misuse in the year to July 2026, many involving false citations.

Shadow AI makes this worse because nobody knows which work was AI assisted. Without a policy, there is no consistent rule that every authority must be checked against the original source.

Supervision

Supervising solicitors are responsible for the work of the people they supervise. If a trainee uses an unapproved AI tool to draft a submission and a made up citation reaches the court, the supervisor may be in breach too. Shadow AI means supervisors are signing off work without knowing how it was produced.

Inconsistency and lost value

There is a quieter cost as well. When everyone uses different tools in different ways, the firm learns nothing. Good prompts, useful workflows and time savings stay with individuals. The firm gets the risk of AI without the benefit of using it well.

What the SRA expects

In August 2026 the SRA published a formal warning notice on the use of AI. It does not ban AI or create new rules. It reminds solicitors that they remain responsible for AI assisted work, that supervisors must properly check the work of those they supervise, and that client information should only go into AI systems where proper contractual, technical and organisational safeguards are in place.

Shadow AI, by definition, has none of those safeguards. A firm that does not know how AI is being used cannot show the SRA that it is in control.

Why banning AI does not work

Faced with these risks, some firms reach for a ban. It feels decisive, but it rarely works.

People do not stop needing to work faster because a policy says so. A ban pushes AI use further out of sight, onto personal phones and home laptops, where the firm has even less visibility. It also sends a message that the firm is not interested in better ways of working, which matters when recruitment is already one of the biggest challenges small firms face.

The better approach is to replace shadow AI with something better: an approved tool that is safe to use, clear rules about how to use it, and training so people use it well.

How to deal with shadow AI

Find out what is already happening

Start by asking staff which AI tools they use and what for. Make it clear this is not a disciplinary exercise. You want honest answers, because they show you where the demand is and where the firm may already be exposed. Most firms are surprised by what they find. An AI readiness assessment does this systematically.

Give people a safe, approved tool

The single most effective way to reduce shadow AI is to give people something better. Business plans such as Claude Team, ChatGPT Business and Microsoft 365 Copilot come with a data processing agreement, admin controls, and do not use your data to train their models by default. Once people have a tool that works and that they are allowed to use, the reason for going around the firm largely disappears.

Write a short AI policy

A policy does not need to be long. It needs to say which tools are approved, what can and cannot go into them, how outputs must be checked, who is responsible, and who to ask. Two or three pages that people actually read are worth far more than a long document nobody opens. Our free AI policy template for law firms gives you a starting point.

Train everyone

Training turns a tool into a habit. People need to know how to write good instructions, how to check outputs, and where the lines are on confidentiality. Include support staff as well as fee earners, because they often handle more documents than anyone.

Keep it under review

AI tools change quickly, and so does the guidance. Review your approved tools and your policy every few months, and keep asking staff what is working and what is not.

From shadow AI to structured AI adoption

The goal is not to stamp out AI use. It is to bring it into the light, so the firm gets the benefits and controls the risks. Firms that do this well end up with one approved tool, a short policy, trained people and a clear view of how AI is used across the practice. That is also the foundation for everything that comes next, from automating routine work to deciding whether your case management system still fits.

Read the full report

This article covers one part of a bigger picture. The impact of AI in the legal sector: Q4 2026 edition sets out the evidence on how UK lawyers use AI, what the SRA and the courts now expect, how pricing, complaints and recruitment are changing, and six things to do in the next three months. You can read it online or download the PDF, and it is updated every quarter.