Risk management for law firms in the age of AI and Legal Tech

Artificial Intelligence (AI) and tech offer to revolutionise delivery of professional services, promising more efficient and cost-effective ways of working.

Rapid adoption and integration of AI into workflows brings challenges and complex risks, particularly in sectors handling sensitive data and those which are reliant on accuracy and precision such as legal services. This article explores some of the key challenges associated with AI and cyber threats and considers practical tips to balance innovation with robust governance aimed at ensuring responsible and transparent use of AI and tech.

Key risks

1. Client confidentiality and data security

Law firms are prime targets for cybercriminals due to the significant volumes of confidential data they are likely to hold. Where data is not appropriately controlled and secured, bad actors can extract confidential details and organisations must be cautious around “phishing” scams, where cybercriminals impersonate clients, court officials and, increasingly, senior colleagues to perpetrate theft or fraud. Law firms must ensure proper virus prevention and security software is in place to minimise vulnerability to ransomware or data extortion. Physical security of documents remains a concern too, particularly for smaller practices, paper-based businesses, and remote workers.

AI systems, too, rely on vast amounts of data to function effectively. This dependency creates vulnerabilities, particularly when sensitive client information is processed through cloud-based platforms. Inadequate encryption and weak access controls can expose firms to data breaches and GDPR violations. Firms using LLM (large language model) AI technology such as the GPT series and OpenAI must be cautious only to use secure platforms when inputting confidential data to ensure that confidential data isn’t retained or reused by the AI outside the firm. There are reports of bad actors seeking to extract confidential data submitted to open LLM’s as with these models, any prompt becomes part of the data it uses to generate future answers.

2. Data integrity and accuracy

AI models are only as reliable as the data they process and errors in input data can lead to flawed outputs. Using legal tech to expedite tasks is not an excuse to forgo any of the usual checks and controls your firm has in place to ensure data integrity or accuracy of advice.

Technology doesn’t replace human expertise, so it’s always important to have “a human in the loop” to check and verify any output produced by AI or automation. This collaborative process involves human participation or supervision in the decision-making of AI. Cautious policies for training AI systems can minimise the risk of “algorithmic bias” – where unconscious bias in training materials results in biased results. In 2018, Amazon famously rolled back an AI recruitment tool which had been trained on data submitted by primarily male candidates, resulting in the tool self-learning to prioritise male candidates and on occasion “downgrading” CVs submitted by women. Users must thoughtfully consider and question the decision-making processes of AI or legal technology solutions including their training data.

3. AI hallucinations

Some users of generative AI tools such as ChatGPT, Harvey, and Copilot have encountered results which appear plausible but are factually incorrect, known as “hallucination.” In legal practice, a flurry of judgments has exposed the serious consequences of AI misuse resulting in hallucinations such as citations of non-existent case law or misinterpretation of statutory provisions.

In Ayinde v London Borough of Haringey & Others, a barrister relied on five fabricated cases and misstatements of law, leading to the judge to consider a referral to the Bar Standards Board and the instructing solicitor to the SRA, as well as a wasted costs order. Dame Sharp also warned that citing false authorities could amount to contempt of court.

In Gloriose Ndaryiyumvire v Birmingham City University & Others, a wasted costs order was made against a firm of solicitors which had filed an application to amend pleadings citing two fictitious cases produced by generative AI software. Although it was explained that the document referring to fictitious cases was a draft which was mistakenly filed by administrative staff and was withdrawn as soon as the error came to light, the judge was clear that the administrative failures on behalf of the firm were improper, unreasonable and negligent. Furthermore, the judge directed that a transcript of the judgment was prepared and published on the judicial website, to provide a record of the firm’s failure. There are real and significant reputational, financial, and regulatory risks of unchecked AI use which reinforce the need for rigorous human oversight. Generative AI can produce a great first draft, but having not been trained as a lawyer it may not understand legal nuance even if it does not “hallucinate.”

4. Jurisdictional risks

Generative AI tools are trained on general datasets and often fail to recognise jurisdictional distinctions. Scotland’s legal system differs significantly from that of England and Wales, yet AI may conflate the two. This can result in incorrect use of terminology, inaccuracy, and inappropriate legal arguments. For example, we are aware of increasing use of Generative AI by party litigants unaware of the differences in Pre-Action Protocols between Scotland (where the process is voluntary) and England. AI cannot replace the skill and expertise of a trained legal professional expert in their jurisdiction.

Sheriff MacRitchie’s rejection of a simple procedure action in Your Home Partners v Kellichan and Hood provides a recent Scottish example of an AI hallucination giving rise to a jurisdictional dispute. In that case, the pursuers sought to recover £5,000 in rent arrears arising from a private residential tenancy. Rather than correctly raising proceedings before the First-tier Tribunal for Scotland, they attempted to proceed through a simple procedure action, asserting that the Sheriff Court had jurisdiction. In support of this position, the pursuers lodged documents purporting to be extracts from section 41A of the Small Claims (Scotland) Rules and section 1 of the Interest on Debts (Scotland) Act 1985. However, the provisions quoted did not exist and the pursuers admitted to using an AI tool in preparing their submissions.

Although Sheriff MacRitchie ultimately declined to find the pursuers in contempt of court, he expressly contemplated such a finding and it is likely that contempt would have been established had the error been made by a legal professional.

5. Regulatory uncertainty

Current regulation is principles-based, requiring compliance with existing professional standards. Whilst bodies like the Law Society of Scotland and the SRA have issued guidance, the regulatory framework has not yet taken AI’s presence into account. The UK Government’s AI White Paper proposes high-level principles in respect of safety, transparency, and fairness but their implementation is proposed to be voluntary. The lack of specific regulatory provision leaves solicitors and firms exposed to ethical and compliance risks.

Firms may consider taking steps to demonstrate to clients and contacts their desire for transparency and openness around use of AI. LITIG is a voluntary body allowing law firms to discuss legal IT issues and its AI Benchmark InitiativeTransparency Charter is one way in which law firms can collaborate in an accountable way with vendors of legal AI products. The Charter invites vendors to sign up “to support an industry-wide approach for AI trust and accountability, enabling firms to embrace innovation while safeguarding ethical and professional standards.”

Mitigating risks

Mitigating the risks of AI adoption and the increasing prevalence of technology requires a proactive and structured approach.

• Organisations should implement robust data governance frameworks, setting clear standards and policies for AI and data use more generally. All colleagues must use, store and process firm and client data in accordance with clear and thorough policies to ensure security and confidentiality.
• Employee training is equally critical, covering data handling, AI limitations, and ethical considerations.
• Manual review of all AI-generated outputs, particularly legal, financial, or technical content is essential to prevent inaccuracies and “hallucinations.” Double-check facts, citations, and legal reasoning against trusted sources. AI use should never replace your own legal expertise.
• Requiring a review and formal sign-off process before making large payments or transferring funds with multi-factor authentication and internal training and awareness of potential scams and red flags. These extra layers of security can help minimise potential exposure to financial fraud or other phishing scams.
• Sensitive client data should never be uploaded to public AI platforms like ChatGPT; instead, organisations should use secure, encrypted tools that comply with the GDPR and apply data anonymisation where possible. IT teams must assess AI vendors and third-party partners for security certifications, compliance with data laws and retention policies, and could consider incorporating confidentiality and liability clauses into contracts.
• Finally, professionals should always ensure their practices comply with existing professional standards and monitor evolving regulatory guidance to guarantee compliance and maintain trust.

Please get in touch with our Professional Negligence team if you would like more information on this article.

This article originally appeared in the Journal of the Law Society of Scotland on 14th January 2026.