Law360's September research confirms what we've suspected: AI use in legal services has crossed the adoption chasm and become routine. But the firms doing it have largely failed to build the governance frameworks the SRA Code of Conduct 2019 now demands, or that the FCA's Consumer Duty PS22/9 expects of legal service providers. This isn't a nice-to-have. The SRA's position on competence and technical proficiency (C4) is unambiguous: you must understand the tools you use. The PRA's approach to third-party management (SS1/23) applies to AI vendors as much as outsourced ops. Mid-market firms in insurance, law, accountancy and financial services are operating in a gap between 'we're using Harvey' or 'we've deployed Copilot' and 'we can prove to a regulator that we control the model, validate the output and manage the liability'. That gap is now a professional negligence claim waiting to happen.
The pattern is predictable. First wave: large firms buy expensive tools (Luminance, Harvey, LexisNexis+AI offerings) and treat them as magic boxes. Second wave: mid-market firms panic-buy the same tools or cheaper alternatives because competitors are using them. Third wave: nobody has written the policy, trained the users, audited the decisions, or documented why the AI was used instead of human judgment on a specific matter. Fourth wave: something goes wrong—a contract missed by an AI review, a risk rating corrupted by training data, a client advised based on hallucinated case law—and both the firm and the vendor blame each other. This story reflects firms at wave three, still thinking governance is someone else's problem.
Our view: the firms winning this transition are not the ones with the shiniest vendor partnerships. They're the ones that treat AI as a decision support tool that requires the same audit trail as a human would. That means: documenting why AI was used, what alternatives were considered, how outputs were validated, who approved the decision, and what the liability chain is. Most enterprise AI products—including the category leaders—fail to build this transparency in as a default. They assume compliance will be bolted on later. That doesn't work for regulated firms. The firms treating AI seriously have moved from 'deploy and hope' to 'validate and document', which means they need tools that embed governance into the workflow, not after it. Trovix Aria was built from first principles to show the source material, the reasoning chain, and the confidence score—precisely because regulated firms cannot accept black-box recommendations. Similarly, Trovix Sift and Trovix Brief are architected to create an audit trail that holds up to regulatory scrutiny, not just to speed up the work.
What should a mid-market firm do on Wednesday morning? First: take inventory of every AI tool in use—including generative AI, document intelligence, predictive analytics, intake automation. Second: for each tool, document what decision it supports, how you validate it, who is accountable if it fails, and how you've tested it against your firm's risk appetite. Third: appoint an AI governance owner (not a vendor liaison, an owner). Fourth: review whether your current tools were chosen for speed or for compliance—because those are different criteria and you may need to change. Fifth: don't wait for SRA guidance that won't come. Build the framework now, using the principles in the EU AI Act (which the UK will informally track) and FRC ISA UK standards for professional judgment. If your vendor can't explain how they meet this standard, that's your answer.
Source: Law360