AI Governance & Mandatory Upskilling: Why It Is No Longer Optional for Lawyers

A practitioner briefing for lawyers in India and England & Wales

Your client just asked your firm for an AI governance policy. Do you have one?

This is no longer a hypothetical scenario. In 2026, the question of whether lawyers need to understand artificial intelligence has been definitively answered. The new question — the one that will define which practitioners and firms thrive — is whether that understanding is deep enough to satisfy clients, courts, and regulators who are now actively measuring it.

This briefing sets out what is happening, why it matters for practising lawyers in India and England and Wales, and what a credible response looks like in practice.

1. The Regulatory Moment Has Arrived

For two years, discussions about AI in legal practice were dominated by possibility and experimentation. That phase is over. Governance has moved from aspiration to obligation across multiple fronts simultaneously.

KEY DEVELOPMENT

Herbert Smith Freehills Kramer declared in their 2026 legal technology forecast that robust AI governance and mandatory upskilling are non-negotiable for legal teams. Clients and regulators are demanding transparency and accountability in AI-assisted outputs — and firms that combine guardrails with deep AI literacy will earn the trust that others will lose.

The regulatory architecture underpinning this shift is now substantial:

The EU AI Act entered its enforcement phase in 2025, with further obligations taking effect through 2026, imposing documentation, transparency, and human oversight requirements on AI systems used in professional contexts.
The Colorado AI Act (effective June 2026) and a patchwork of US state-level requirements have made formalised AI policies a compliance obligation rather than a best practice.
In England and Wales, the SRA’s 2025 guidance on AI use confirmed that solicitors remain personally responsible for AI-assisted work product, with competence obligations extending to understanding the tools used.
In India, the Bar Council’s emerging framework on technology in legal practice signals that AI governance will be a component of professional compliance — not a voluntary enhancement.

The question is no longer whether your firm will be asked to demonstrate AI governance. It is whether you will be ready when it is.

2. What Clients Are Now Asking For

The shift is not only regulatory. It is commercial.

Large institutional clients — particularly in financial services, infrastructure, and technology — are beginning to include AI governance requirements in their panel criteria and matter instructions. They are asking firms:

What AI tools are used in the preparation of their work?
Who reviews AI-assisted output, and how?
What data does the firm input into third-party AI systems, and under what terms?
Does the firm have a documented AI policy, and has it been tested?

These are not abstract questions. They are panel review questions. And firms that cannot answer them clearly are losing mandates to firms that can.

Clients are also becoming more sophisticated about what good AI practice looks like. A firm that describes itself as “using AI responsibly” without being able to specify what that means in practice is no longer distinguishable from one that is not using AI governance at all.

3. What AI Governance Actually Means in Legal Practice

AI governance in a legal context is not the same as general corporate AI policy. It requires a specific response to the professional obligations that lawyers already hold.

At minimum, a credible AI governance framework for a legal practice covers four areas.

Approved tools and access controls. Which AI tools are authorised for use, by whom, and for what purposes. This includes both firm-provided tools and tools lawyers may use independently. The default position in many firms — that lawyers can use any publicly available AI tool for legal work — is no longer defensible.

Data and confidentiality protocols. What information can be input into AI systems, and what cannot. Third-party AI tools process and in some cases retain input data. Inputting client-specific facts, unpublished transaction details, or confidential communications into a public AI tool without client consent and appropriate safeguards is a professional risk that has materialised in at least two reported regulatory matters in 2025.

Output verification standards. How AI-assisted work product is reviewed before it is used or delivered. The Mata v Avianca principle — that lawyers are responsible for every citation, legal proposition, and piece of advice they produce regardless of how it was generated — is now firmly established across jurisdictions. A governance framework must operationalise this responsibility, not just acknowledge it.

Training and competence requirements. Who is authorised to use AI tools, and what baseline understanding is required before use. This is the upskilling dimension — and it is the one most commonly underestimated.

4. Why Upskilling Is Now a Governance Requirement

The most significant shift in 2026 is not that regulators are paying attention to AI tools. It is that they are paying attention to whether lawyers understand the tools they are using.

Professional competence obligations in England and Wales, India, and most common law jurisdictions require lawyers to understand the work they do and the tools they use to do it. As AI becomes embedded in legal practice, this obligation extends to AI literacy.

This does not mean lawyers need to understand machine learning. It means they need to understand:

How AI tools generate output and where that output is unreliable
What types of legal tasks AI performs well and where it consistently fails
How to construct prompts that produce legally useful output
How to verify AI output against primary sources
What their professional obligations require when AI is used in client matters

A lawyer who uses AI without this understanding is not just less effective. They are potentially non-compliant — with their competence obligations, with their duty to clients, and in some jurisdictions with emerging regulatory requirements around AI tool use in professional contexts.

The implication for firms is that training is not optional and it is not one-time. AI tools are changing rapidly. What was true of a tool’s limitations six months ago may not be true today — and what is true today may not be true in six months. Governance frameworks must include a mechanism for keeping AI literacy current, not just a baseline training module completed at onboarding.

5. What a Credible Response Looks Like

Firms and practitioners who are ahead of this are not doing anything exotic. They are doing four things consistently.

They have a documented AI policy. One that has been reviewed by someone who understands both the technology and the professional obligations. Not a policy downloaded from a template library — one that reflects how AI is actually used in the practice.

They train before they deploy. Lawyers using AI tools have a working understanding of those tools before using them on client matters. This is not a lengthy process — structured AI literacy training for legal professionals can be delivered efficiently — but it is a non-negotiable step.

They verify consistently. Every piece of AI-assisted output is reviewed by a qualified lawyer before use. Not reviewed in the sense of “scanned quickly” — reviewed in the sense of verifying accuracy against primary sources for legal propositions, checking citations, and applying professional judgment to the whole.

They build governance into workflow, not around it. The firms that get this right do not treat AI governance as a compliance exercise that runs parallel to how they work. They build it into how matters are run — into file notes, supervision structures, and quality standards — so that it does not depend on individual discipline to operate.

The Practice Implication

The regulatory and commercial environment of 2026 has made AI governance and upskilling table stakes for legal practice, not differentiators. The question for individual lawyers and firms is not whether to invest in this — it is how quickly they move from acknowledgement to implementation.

Clients are asking. Regulators are watching. The profession is dividing, not between those who use AI and those who do not, but between those who can demonstrate that they use it well and those who cannot.

That distinction is now worth money, mandates, and in some cases, professional standing.

This briefing is part of The AI Bar’s ongoing series on AI governance and legal practice.

For structured training on AI tools, verification workflows, and governance implementation — built for practising lawyers in India, England and Wales, and common law jurisdictions — visit theaibar.in.