The COLP's AI job, on one page

The SRA's compliance tips for solicitors using AI and technology say that, to ensure there is senior leadership and oversight, "we would expect as a minimum" the COLP to be responsible for regulatory compliance when new technology is introduced (SRA, Compliance tips, updated 9 February 2026). The August 2026 warning notice on misuse of AI adds the teeth, pointing to the COLP's duty under paragraph 9.1 of the Code for Firms to take reasonable steps to ensure compliance (SRA, Warning notice, 17 August 2026).

In a firm of five to thirty people, the COLP is usually a partner with a full caseload. So the question is what the job comes to in practice. The SRA's own list is a good starting point.

What does the SRA expect good AI governance to include?

Five things, in the SRA's words: appropriate leadership and oversight, risk and impact assessments, policies and procedures, training and awareness, and monitoring and evaluation of the technology's impact to avoid unintended consequences (SRA, Compliance tips). Each one has a small-firm version.

1. Leadership and oversight

The COLP's name on it, in writing. A line in the firm's compliance records that says the COLP is responsible for the firm's use of AI, and that new AI tools and features are approved by them before use. That last part matters more than it sounds, because AI now arrives as features inside software the firm already has, and "approved by the COLP" is what stops them being switched on by accident.

2. Risk and impact assessment

One page per tool, before it's used on client work. What the tool does, what information goes into it, where that information is stored, whether it's used for training, who at the firm can use it, and what could go wrong. The warning notice's confidentiality section is the checklist: client information only goes in "where appropriate contractual, technical and organisational safeguards are in place", data isn't used to train models unless that's "explicitly authorised and appropriate", and it isn't kept longer than necessary.

For a note-taker, a drafting tool and a research tool, that's three pages. It's an afternoon's work, and it's the document the SRA would ask for first.

3. Policies and procedures

A short AI policy. Which tools are approved and for what, what never goes into them, the rule that every citation is checked against a primary source, and the rule that nothing AI-assisted goes to a client or the court without a qualified person reviewing it. The warning notice's central line belongs in it word for word: "You remain accountable for all work and advice delivered to clients, whether or not AI has been used in its preparation."

4. Training and awareness

Everyone who uses AI, including support staff, does a short session, and the COLP keeps the attendance record. The session covers the policy, how the approved tools work, and the cases where it went wrong. R (Ayinde) v Haringey LBC [2025] EWHC 1383 (Admin), where false AI-generated citations were put before the court, is the one that makes people sit up.

5. Monitoring

A light log of AI use on client work, reviewed by the COLP monthly. One line per use: the matter, the tool, who checked the output and against what. It takes a minute to fill in and it's the evidence of supervision the warning notice expects. The review is where the COLP spots a tool creeping into work it wasn't approved for.

What doesn't the COLP have to do?

Understand how the models work. Read every AI-assisted document. Convene a technology committee. The SRA asks for reasonable steps, and in a small firm reasonable steps are a named owner, a short assessment per tool, a policy people have read, a training record and a log. The COLP checks that the system is working, not every piece of work that goes through it.

What does this look like with a caseload?

I lead a live AI rollout inside a regulated business, so the governance questions a COLP faces are ones I've had to answer myself. What makes it workable alongside a caseload is writing the five things down once, properly, and then keeping the monthly review short. The documents do the remembering.

What should a COLP do this month?

Put your name on AI in the compliance records, assess the tools already in use, and start the log. The policy and training can follow in the weeks after.

• Record that the COLP is responsible for AI, and that new tools need the COLP's approval.
• Write a one-page assessment for each AI tool already in use, starting with anything that records client meetings.
• Start the usage log, and put the monthly review in the diary.
• Draft the policy, then run the training and keep the register of who attended.

My AI governance kit for law firms has the policy, the tool assessment, the usage log and the training outline, mapped to the SRA's warning notice and compliance tips. If you'd rather I did it with you, that's the team AI rollout.

Sources

1. 01SRA, Compliance tips for solicitors regarding the use of AI and technology, updated 9 February 2026. sra.org.uk/solicitors/resources/innovate/compliance-tips-for-solicitors
2. 02SRA, Warning notice: Misuse of AI, 17 August 2026. sra.org.uk/solicitors/guidance/misuse-ai
3. 03R (on the application of Ayinde) v Haringey LBC [2025] EWHC 1383 (Admin).

This article is general information, not legal or regulatory advice. Read the SRA's guidance in full and speak to your COLP about your firm.