By The AI Bar  · 

Law Firm AI Use Policy: A Template for India, UK & Singapore Firms

Build a written AI use policy that actually holds up, grounded in SRA, Singapore MinLaw, and Indian regulatory guidance. A practical template, not a theoretical one.

The SRA received 42 reports of AI-related misconduct in the twelve months to July 2026. Several Singapore firms now treat an AI policy breach as a disciplinary matter that can end in dismissal. India’s Supreme Court has twice this year set aside tribunal and government decisions built on AI-hallucinated citations and told the Bar Council of India to draft disciplinary guidelines. If your firm still doesn’t have a written AI use policy, you are no longer early to this conversation. You are late.

Most templates circulating online are American and assume a single regulator. If you practise across India, England and Wales, or Singapore, or advise clients who do, you need something built on what your actual regulators have said. Here is a practical structure, grounded in the SRA’s warning notice, Singapore’s Ministry of Law Guide for Using Generative AI in the Legal Sector, and India’s current regulatory direction, that you can adapt into your own firm’s policy document.

1. State the Accountability Principle First

Every jurisdiction we cover has converged on the same starting point, worded slightly differently each time.

  • The SRA: “the use of AI does not change the professional standards expected of solicitors and law firms,” and individuals remain responsible for the work they produce.
  • Singapore’s MinLaw Guide (launched 6 March 2026): legal professionals “remain fully responsible for their work products” regardless of AI involvement.
  • India’s Bar Council position, ahead of formal rules: AI use is not prohibited, but accountability rests entirely with the advocate.

Put this sentence at the top of your policy, not buried in an appendix: AI does not share your professional responsibility. You carry all of it, every time.

2. Write the Verification Rule as a Hard Red Line

This is the rule every case in our sanctions tracker broke. Make it non-negotiable and specific rather than aspirational.

  • No AI-generated citation, quotation, or statutory reference goes into any filing, affidavit, advice letter, or client-facing document until a named human has opened the primary source and confirmed it says what the draft claims.
  • “I didn’t check it personally but trusted my junior” is not a defence. The SRA’s notice makes supervisors accountable for work produced by juniors or unauthorised staff, and the Singapore sanctions above all involved exactly this failure passing up the chain.
  • Define what counts as AI-assisted for disclosure purposes, drafting, summarising, research, translation, and say so explicitly rather than leaving it to individual judgement.

3. Build in a Confidentiality Red Line, Separately From the Verification One

This is the rule firms get wrong even when they have nailed verification.

  • Client information goes into an AI tool only where contractual, technical, and organisational safeguards actually protect it, per the SRA’s notice.
  • Entering confidential material into a public tool such as a consumer-facing chatbot can permanently waive legal professional privilege. Treat this as a one-way door, not a mistake you can walk back.
  • Confirm in writing, for every approved tool, whether it trains on submitted data, where data is stored, and how long it is retained. If your vendor can’t answer this in writing, that tool is not approved.
  • Singapore’s MinLaw Guide adds a transparency dimension the UK notice does not emphasise as strongly: consider telling clients when GenAI plays a substantial role in their matter, particularly if it affects cost or involves data handling they might not expect.

4. Name Your Approved Tools, and Say What Happens Outside That List

Several Singapore firms already do this well:

  • Withers KhattarWong lets junior lawyers use GenAI for efficiency, but senior lawyers must validate every output before anything is filed or shared externally, with disciplinary consequences ranging from retraining to restricted tool access.
  • Drew & Napier treats AI policy violations like any other transgression under firm policy, requiring lawyers to verify all output and disclose AI use when asked.
  • Allen & Gledhill built its own internal tool with hallucination safeguards, designed specifically so outputs are easy for lawyers to verify rather than assuming good faith will be enough.
  • TSMP Law’s managing partner put the underlying principle plainly: AI “is only a tool,” and relying on its output without checking “is asking for trouble.”

Your policy should name the specific tools your firm has approved, who approved them, and state clearly that using an unapproved tool for client work is itself a policy breach, independent of whether anything goes wrong.

5. Set Out Supervision Duties by Seniority

Supervisors remain accountable for AI-assisted work produced by anyone they supervise, including non-authorised staff and paralegals. The Singapore SGHCR 33 and SGHC 217 cases both involved a fake citation entering submissions through a junior researcher or paralegal, with the supervising lawyer personally sanctioned for not catching it.

  • Set a minimum experience bar for anyone with AI supervisory sign-off responsibility, consistent with your jurisdiction’s general supervision rules.
  • Require a second-person check on any AI-assisted work heading to a court filing, regardless of the drafting lawyer’s seniority.

6. Build in Training, Not Just Rules

A policy without training becomes a document nobody reads until something goes wrong. Withers KhattarWong runs dedicated training on prompt engineering, hallucinations, and fabricated citations. TSMP Law holds weekly team meetings specifically to share AI experiences and problems as they arise, rather than waiting for an annual refresher. Build at least this much cadence into your own firm, however small your practice.

7. Write the Enforcement Consequence, Not Just the Rule

A policy that doesn’t say what happens on breach will not be taken seriously. Across the Singapore firms cited above, consequences range from retraining and restricted tool access through to dismissal, scaled to the severity and whether it reached a client or a court. Decide your firm’s equivalent scale in advance, in writing, before you need it.

8. Review It Against Your Regulator’s Own Output, Not Just This Article

This template reflects the SRA’s warning notice, Singapore’s MinLaw Guide, and India’s current regulatory trajectory as of this writing. All three are moving targets. India’s draft Regulations for Use of Artificial Intelligence in Courts, 2026 are still subject to the Chief Justice’s final notification, and the Bar Council of India has been directed to form its own disciplinary committee. Treat this policy as a living document, and review it at least annually, or immediately after any new regulatory notice in your jurisdiction.

Building this correctly from the start, rather than patching it together after a near miss, is exactly what our Compliance & Governance module walks through in detail, with worked examples from each of the three jurisdictions above.