This article is for informational purposes only and does not constitute legal advice. You should consult with a qualified professional before making any decisions about the use of AI in your law firm.
What Are the EU AI Act Compliance Requirements for UK Law Firms?
The EU AI Act may matter to a UK firm depending on its role, where a system is marketed or used, and where its output is used. Assess each system and use case against the Act before assuming legal work is automatically high risk.
For each proposed use, record the system's purpose and the firm's role. Ask the legal reviewer to establish whether the Act applies and which classification and duties need to be considered.
When Does the EU AI Act Apply to a UK Law Firm?
Include these questions in the scope review:
- Does the firm provide an AI system placed on the EU market?
- Where is the firm using the AI system?
- Where is the AI system's output used?
For a matter involving a client in Germany or e-discovery data about EU citizens, record where the system and its outputs are used. Have the reviewer assess the actual activity before concluding that the Act applies.
The High-Risk Category: Administration of Justice
The category discussed here is "administration of justice and democratic processes." Check the relevant Annex III wording against the system's intended purpose before assigning a classification.
For a judicial or legal-use system, ask the responsible legal reviewer to establish the intended purpose, actor role and applicable classification from the current legislation. Do not infer the classification of a law firm's tool from this example.
For case law analysis, litigation-outcome prediction or legal research, ask the reviewer to assess the system's intended purpose against the relevant classification provisions. Record the basis for the decision; a resemblance to the quoted description is not a classification assessment.
Compliance Requirements for High-Risk AI Systems
The table below lists matters to refer for legal review. It does not establish which requirements apply to your firm: the reviewer needs to check the system's classification, the firm's role and the applicable provisions and dates before relying on any entry.
| Requirement |
What it Means for Your Firm |
| Risk Management System |
Risk management: ask the reviewer which provisions apply to the assessed system and actor role, then document the required process, owner and evidence. |
| Data Governance |
Data: identify the relevant training, validation and test activity, who controls it and which applicable provisions the reviewer has confirmed. Record limitations and responsibilities. |
| Technical Documentation |
Documentation: establish what the applicable provisions require from the relevant actor. Check which documents the supplier provides and which evidence the firm must produce for its activity. |
| Record-Keeping |
Records: have the reviewer establish the applicable logging and retention requirements, then test the selected system's actual coverage and access controls. |
| Transparency & Human Oversight |
Transparency and oversight: establish any applicable information and oversight duties for the actual use. Assign the confirmed review, intervention and communication tasks to named people. |
| Accuracy, Robustness & Cybersecurity |
Performance and security: identify the applicable requirements and test conditions for the system and actor role. Record observed failures and limits rather than assuming lifecycle resilience. |
The "Made in the UK" Delusion
Base the firm's assessment on the systems and activities in scope. Record the reasons for including or excluding each use from the legal review.
Check relevant client terms and insurance conditions alongside the statutory assessment. Ask the legal reviewer to identify any applicable penalties instead of using a headline maximum as the firm's exposure estimate.
The Bottom Line: Start Preparing Now
Ask the legal reviewer to record which provisions apply to each system and their applicable dates. Build the assessment and remediation plan around that record rather than a single full-compliance deadline.
Use the assessment to organise the following work:
- Mapping your AI usage: Identify every AI tool being used in your firm, who is using it, and for what purpose.
- Assessing the risk: Determine which of those tools could be classified as high-risk under the EU AI Act.
- Conducting a gap analysis: Compare your existing governance framework with the requirements identified as applicable to each use.
- Developing a remediation plan: Create a roadmap for addressing the gaps you have identified.
Assign a leadership owner to coordinate legal review, IT and the teams using each system, with responsibility for the agreed remediation plan.
Take the Next Step
For an AI Audit discussion, bring the firm's tool inventory, current controls and unresolved approval questions. Agree the work to be assessed before commissioning it.
Book a Discovery Call → or learn more about the AI Audit.
Need a safer AI route for your firm?
For any proposed Claude, ChatGPT or Copilot use, record the workflow, data, supplier controls and review owner. Take unresolved confidentiality, liability and professional-duty questions to the responsible reviewer before approving the use.
