What it means for a UK law firm
Shadow AI is a confidentiality risk for law firms because the firm has no contract with the provider and no control over whether client information is kept or used to train models. In UK v Secretary of State for the Home Department (AI hallucinations; supervision; Hamid) [2026] UKUT 81 (IAC), the Upper Tribunal said that uploading confidential documents into “an open-source AI tool, such as ChatGPT” breaches client confidentiality and waives legal privilege, that such conduct might warrant referral to the SRA, and that it should in any event be referred to the Information Commissioner's Office.
Shadow AI is rarely removed by a ban alone, because staff use AI to save time. Firms usually reduce shadow AI by providing an approved tool, publishing a short AI policy that says which tools may be used with which information, training staff, and asking how AI was used when supervising work.
Example
Illustrative scenario
A firm finds that staff are using consumer AI chatbots during the working day. Rather than only blocking the sites, the firm approves a tool for client work, publishes a short policy, and asks supervisors to check how AI was used when they review drafts.
Related terms
- Client confidentiality
- Legal professional privilege
- Model training on client data
- Supervision of AI-assisted work