What the Law Society of Scotland Actually Requires When Fee Earners Use AI on Client Files
The Law Society of Scotland has not banned AI. It has done something far more consequential: confirmed that every existing professional obligation applies in full to AI-assisted work, then published a Guide to Generative AI explaining precisely how. If your fee earners are using public AI tools on client files without the safeguards that Guide demands, your firm is in breach of its conduct obligations right now.
For the full compliance exposure analysis, read our parent article on Shadow AI as an uncontrolled compliance risk in regulated Scottish practices. This piece isolates the Law Society’s requirements — rule by rule.
Rule B1.6: Nine Words That Govern Everything
Rule B1.6 of the Solicitors (Scotland) (Standards of Conduct) Practice Rules 2008, made under Section 34 of the Solicitors (Scotland) Act 1980, states:
You must maintain client confidentiality. This duty is not terminated by the passage of time.
No qualifications. No carve-outs for productivity tools. The Law Society’s guidance confirms that confidentiality covers all matters which are actually confidential and not in the public domain — instructions, advice, documents exchanged. Breach constitutes either professional misconduct or unsatisfactory professional conduct, both carrying regulatory sanction.
When a solicitor pastes a client’s separation agreement into ChatGPT, the full text — names, addresses, financial provisions — is transmitted to OpenAI’s servers in the United States. That is a disclosure of confidential information to an uncontracted third party, in an uncontrolled jurisdiction, without the client’s consent. The disclosure itself is the breach. Rule B1.6 does not require the disclosure to cause demonstrable harm.
The Guide to Generative AI: What “Extreme Caution” Means
The Law Society’s Guide to Generative AI, developed with AI legal platform Wordsmith and the Technology Law and Practice Committee, sets specific preconditions for solicitors considering sharing confidential data with AI systems:
- Appropriate contractual terms must be in place ensuring inputted information will not be accessible by the vendor or used for other purposes
- Security arrangements must meet appropriate information security standards
- Usage must comply with the firm’s own terms of business with clients
The Guide explicitly contrasts paid enterprise AI options — which typically offer contractual data protection terms — with free-to-use public tools, which do not. Its conclusion: “extreme caution” is required before any use of generative AI on client data.
ChatGPT’s free tier has no data processing agreement. No sub-processor disclosures. No audit rights. No contractual guarantee of deletion. Every precondition the Guide identifies is absent. A fee earner using it on client files fails every requirement.
Competence, Accountability, and Fabricated Authorities
Rule B1.10 requires solicitors to act only in matters where they are competent. The Guide warns that AI output is probabilistic — hallucinations (fabricated citations, incorrect legal propositions) are inherent to the technology. The skills required to verify AI output may be greater than those required for standard review.
The English cases of Ayinde v London Borough of Haringey and Gloriose Ndaryiyumvire v Birmingham City University — where AI-generated fictitious case citations led to judicial referrals, wasted costs orders, and regulatory sanction — demonstrate the severity of the consequences. The Law Society’s Guide explicitly references this risk.
The solicitor remains fully accountable for AI-assisted work product. The tool is not a defence. It is not a mitigating factor. It is a choice the solicitor made, and the output bears their professional responsibility.
Client Consent: The Obligation Firms Are Ignoring
The Guide identifies a requirement most firms have not yet addressed: the need to obtain client consent to the use of generative AI where appropriate.
Where client-confidential data is processed through a third-party AI system, the solicitor’s transparency duty is engaged. Firms that have adopted AI tools without updating their terms of business, without informing clients, and without obtaining consent where the nature of the processing warrants it, have a transparency gap that becomes a conduct issue the moment a client — or auditor — discovers their privileged data was processed through a service they were never told about.
2026: The Year of Reckoning
The Law Society has made AI governance a key project for 2026. The Legal Technology Conference 2025 drew record attendance. The Data Use and Access Act 2025 introduces enhanced accountability requirements that intersect directly with the Society’s conduct framework. The ICO’s 2025 enforcement record — a sevenfold increase in fines, specifically targeting security failures — confirms the direction of travel.
Firms treating AI governance as a future concern are misjudging the velocity of regulatory development.
Closing the Gap
The Law Society’s requirements are clear. Free-to-use public AI tools fail on every count. A sovereign AI deployment — running open-weight models on the firm’s own UK bare-metal infrastructure, behind a self-hosted access layer, with zero egress and no third-party processor — satisfies every requirement the Guide identifies. Appropriate contractual terms. Appropriate security standards. Full compliance with client obligations.
Talk to our team to see how Private AI Ltd’s deployment model maps directly to the Law Society of Scotland’s AI guidance.
Private AI Ltd (SC881079)