The £2.1 billion pouring into legal-tech startups in the first half of 2026 is not good news for most UK law firms—it is a warning. The story being sold is seductive: AI-generated documents reviewed by licensed attorneys cut costs dramatically, startups build law firms from scratch, Google Cloud makes legal AI available to everyone. But this is VC fiction meeting regulatory reality. For mid-market practices already bound by SRA Outcome 9 (management of information), PRA SS1/23 (operational resilience), and FCA Consumer Duty PS22/9, the real question is not whether AI cuts costs. It is whether these £2bn of startups—Harvey, Legora, Luminance and the rest—have built compliance infrastructure that a regulated UK firm can actually depend on. Most have not. They have built document engines. The firms that will win are not those that buy the cheapest AI tool. They are those that build AI governance that the regulator can audit.
What this funding wave actually reveals is that the legal market is bifurcating. On one side: AI-native practices designed for cost arbitrage, relying on hybrid human-AI workflows and regulatory arbitrage in looser jurisdictions. On the other: established regulated firms that cannot move as fast but must not move recklessly. The £2bn assumes the first model will win. History suggests it will not. When PSD2 arrived, we heard the same thing about fintech disrupting banking. Fintech did disrupt banking—but only the firms that integrated properly with regulatory oversight survived. The ones that moved fast and broke things broke things. Legal services will follow the same pattern. The question is which firms will be left standing when the inevitable regulatory reckoning comes.
Trovix's view is simple: AI in regulated firms is not about the model. It is about the audit trail. Document generation tools are commodity. Tools like Harvey and Luminance do fine document work in isolation. The problem is what happens next: How do you prove to the SRA that a document generated by AI met your duty of care? How do you show the FCA that your use of AI did not create information governance risk? How do you demonstrate to the ICO that you complied with UK GDPR when processing client data through a third-party LLM? These firms selling pure document AI have no answer. They have no compliance layer. That is why Trovix Audit was built—not to replace document tools, but to sit above them, creating the governance framework that turns AI from a regulatory liability into a defensible asset. A mid-market law firm using Harvey without governance is more exposed than one using no AI at all.
If you run a law firm, insurance practice, accountancy or financial services firm with regulatory obligations, your move is not to chase the cheapest AI. It is to audit what you are already doing. Where are you using AI now? Do you have documented approval for those workflows? Can you explain your information security controls to a regulator? If the answer to any of these is no, that is your urgent problem. Start there. Deploy governance before you deploy more models. That means mapping your AI use case, understanding your data flows, and building an audit capability that survives regulatory scrutiny. Trovix Audit is built for exactly this. Only after that foundation is solid should you think about which document tools to integrate.
Source: Forbes