Give your team AI tools. Keep supervision in control.

Confidence starts with a workflow you can explain

For law firms and in-house legal teams using AI-assisted research, drafting, document review, meeting notes or client-facing workflows. The focus is operational governance, with professional decisions retained by qualified lawyers.

• Confidentiality and privilege: identify data-handling questions for your legal and privacy owners, and set practical approved-tool boundaries.
• Reliable supervision: establish source and citation checks, named reviewers and escalation for uncertain output.
• Agent control: define permissions and approval gates before systems send messages, change matter records or perform external actions.

The SRA’s misuse of AI warning notice addresses risks under existing professional obligations for those it regulates in England and Wales. It is not a UK-wide AI certification scheme. We confirm the relevant jurisdiction during scoping; Scottish and other legal practices require their own professional-rule review.

A working system, not just a policy

Seven practical outputs. Clear next steps.

1. AI system and agent inventory. Record the agreed tools and use cases, owners, data, suppliers and agent permissions. Include staff-reported shadow AI and embedded AI features.
2. Risk-appetite workshop. Agree acceptable use, escalation thresholds and activities that require approval or must stop.
3. Governance roles and RACI. Name who approves, operates, reviews and challenges each use case.
4. Completed risk register. Capture the identified risks, current controls, evidence gaps, owners and residual-risk decisions for the agreed scope.
5. Prioritised treatment plan. Separate urgent restrictions from 30-, 60- and 90-day actions, with owners and target dates.
6. Monitoring dashboard and review cadence. An editable, initially populated management dashboard using available evidence, with measures, review dates and triggers for incidents, supplier changes, expanded agent permissions and retirement. No live integrations or continuous monitoring.
7. Framework crosswalk. Map the outputs at a high level to the DSIT toolkit, ISO/IEC 42001 and NIST AI RMF. Flag potentially relevant EU AI Act duties for specialist confirmation where the organisation’s role, use case and territorial scope make them relevant.

A focused two-week engagement

Fixed fee: £4,950 + VAT. One entity or business unit, up to five AI systems or use cases and six stakeholders, delivered remotely. Includes a 90-minute discovery session, a two-hour risk-appetite workshop, an executive readout and editable deliverables.

Week one establishes the inventory, evidence gaps and decisions. Week two turns those findings into ownership, controls and an agreed action plan. Timing assumes access to the agreed people and evidence. Unknowns are recorded, not presented as verified controls.

We apply the government’s AI Risk Management Toolkit to the way your team actually works. The toolkit is guidance; using it is not government approval or certification.

The Sprint is a governance and readiness engagement, not a certification, legal opinion, full DPIA or fundamental-rights assessment, penetration test, technical model evaluation or implementation project. Discovery is interview- and evidence-led, not a network scan. Remediation, integrations and specialist reviews are scoped separately. Professional decisions and approvals remain with your organisation.

Turn a policy into decisions people can use

Give partners, compliance owners and practice managers a working inventory, risk decisions and review responsibilities. Make the distinction between permitted assistance and work that needs qualified professional approval explicit.