Published by
Deploying AI privately in a law firm means choosing a model — public tool, enterprise service with a no-training guarantee, private in-region deployment, or self-hosted — that keeps client data confidential and defensible under SRA and UK data-protection duties. The right choice depends on matter sensitivity, not on the tool's features alone. Helium42 helps UK firms select and govern that deployment under the Education-to-Implementation Pathway, drawing on work with 500+ leaders and 2,000+ trained professionals.
UK law firms have adopted AI fast — 82% of lawyers now use generative AI or plan to — but the regulators have made one thing clear: a solicitor remains personally responsible for every output, whether or not AI produced it. That is why how you deploy AI now matters as much as which tool you pick. This guide sets out the four deployment models for legal AI, what "no training on your data" and data residency actually guarantee, the UK rules driving private deployment, and how a managing partner chooses a model that protects client confidentiality and privilege.
82%
of UK lawyers use generative AI or plan to
49%
fear leaking confidential information through public AI
76%
worry about fabricated output from public AI tools
4×
rise in UK firms actively using AI (11%→41% in a year)
Source: LexisNexis survey of UK lawyers, September 2024 (active-use rise from 11% in July 2023 to 41% in September 2024).
Key Takeaway
There is no single "secure" AI tool — there is a deployment continuum, from public consumer tools to self-hosted models, each with a different confidentiality profile. The disciplined approach is to match the deployment model to the sensitivity of the matter, back it with a no-training and data-residency guarantee, and keep a named solicitor accountable for every output. Firms that skip this step are the ones being referred to the SRA.
Why the deployment model is now a confidentiality decision
Choosing how to deploy AI is no longer just an IT question — it is a professional-conduct one. The SRA has not banned AI or named approved tools; instead it holds that a solicitor is personally responsible for every piece of work, must verify AI output, must protect client confidentiality, and must be clear with clients where they interact with AI (SRA compliance tips, February 2026). The consequences of getting this wrong are now concrete: in a June 2025 ruling, a senior High Court judge warned that lawyers could face contempt or even criminal sanctions for relying on fictitious AI-generated cases, and two firms have already been referred to the SRA after AI-generated citations turned out to be fake.
The confidentiality dimension is just as sharp. Nearly half of UK lawyers (49%) already fear leaking confidential information through public AI, and 76% worry about fabricated output. Those fears are well-founded when client data is typed into a consumer tool that may retain or train on it. The deployment model is the control that addresses this — it determines where client data goes, whether it is used to train a model, and whether the firm can evidence all of that to a regulator or client. For the tools themselves, see our guide to the best legal AI tools for UK law firms; this guide is about how to deploy them safely.
The four deployment models for legal AI
Legal AI deployment sits on a continuum from least to most private. Each step increases confidentiality and control but also cost and complexity. Most firms will use more than one model, matching the model to the sensitivity of the work.
| Model | Confidentiality profile | Best suited to |
|---|---|---|
| 1. Public consumer AI | Data may be retained and used to train the model; lowest control. Not appropriate for client data. | Non-confidential, general tasks only |
| 2. Enterprise SaaS (no-training) | Contractual "no training on your data"; vendor acts as data processor (e.g. ChatGPT Enterprise, Microsoft 365 Copilot under Enterprise Data Protection) | Most firms, most matters |
| 3. Private / in-region | Single-tenant or region-locked data with retention controls (e.g. Harvey's in-region EU/UK hosting); stronger residency guarantees | Larger firms; sensitive or regulated matters |
| 4. Self-hosted / on-prem | Open-weight models run inside the firm's own environment; data never leaves. Highest control, highest cost and engineering burden. | The most sensitive work; firms with IT capability |
The practical answer for most UK firms is model 2 or 3: an enterprise service with a genuine no-training guarantee for everyday work, and a private or in-region deployment for the most sensitive matters. Model 1 should be governed out of use for anything touching client data, and model 4 is justified only where matter sensitivity or client mandate demands it. Whichever mix a firm adopts, the mapping of matter type to deployment model should be written down and approved, not left to individual fee-earners to decide case by case — a documented mapping is both a better control and the evidence a regulator or client will expect to see.
What "no training on your data" and data residency actually mean
The two guarantees that matter most are "no training on your data" and data residency — but they cover less than firms assume, so read them precisely. OpenAI states that business data across ChatGPT Enterprise and its API is not used to train its models and remains owned by the customer. Microsoft 365 Copilot, under Enterprise Data Protection, treats Microsoft as a data processor under its Data Protection Addendum, with prompts and responses not used to train the foundation models. Harvey offers in-region data hosting (EU, US or Australia) with customer-set retention and deletion. These are meaningful protections — but they are contractual and configuration-dependent, not automatic: they apply to the enterprise tier, not the consumer version; they do not remove the firm's own obligation to obtain a lawful basis and to supervise output; and "grounding" or web-search features may route data through third parties on different terms. The governance rule is simple: confirm the guarantee in writing, at the tier you are actually using, before any client data touches the tool.
Helium42 helps UK firms choose a deployment model, verify vendor guarantees, and govern AI for SRA and UK GDPR compliance — before client data is ever exposed.
Discuss a secure AI deployment
The UK rules driving private deployment
Three regulatory strands make private, well-governed deployment a requirement rather than a preference. First, the SRA: the duty of confidentiality (Code of Conduct paragraph 6.3), competence and supervision apply unchanged to AI-assisted work, and the SRA's February 2026 compliance tips restate that solicitors must verify outputs and remain accountable. Second, the ICO and UK GDPR: firms need a lawful basis to process personal data through AI, must consider data residency, and must respect rights around solely automated decisions — and the Data (Use and Access) Act 2026, which received Royal Assent on 19 June 2026, is now in force and reshapes parts of this landscape. Third, legal professional privilege: sending privileged material to a third-party model on the wrong terms risks waiving or compromising it. The Law Society has published guidance warning that unsafe AI adoption exposes firms to exactly these risks. For the governance layer that operationalises all three, see our guides to AI governance consulting and the AI usage policy template.
Key risks and failure modes to design out
A secure deployment is defined as much by the failure modes it prevents as by the model it uses. Five deserve explicit control. Hallucination in privileged work — the fake-citation cases show fabricated output reaching court; every AI output on a matter must be verified by a named solicitor. Data leakage through training or misconfiguration — the reason model 1 is off-limits for client data and why no-training guarantees must be confirmed. Shadow AI — staff pasting client data into public tools; the most common real-world breach, addressed by policy plus a sanctioned tool that removes the temptation. Vendor lock-in — over-dependence on one provider; mitigated by retaining data portability and internal capability. And agentic AI risk — the UK's National Cyber Security Centre and its Five Eyes partners have warned that autonomous, goal-driven AI introduces security and governance risks beyond standard generative AI, so agentic tools warrant extra scrutiny before deployment on legal work.
How to choose a deployment model
The selection method is a matrix of matter sensitivity against firm capability, not a hunt for the "most secure" tool. Triage work by sensitivity: general, non-confidential tasks can use a governed enterprise tool; client-identifiable or privileged work needs a no-training enterprise tier at minimum; the most sensitive matters justify private, in-region or self-hosted deployment. Then match that to the firm's IT and risk capability — a self-hosted model is only "secure" if the firm can actually run and patch it. The reliable path is education-first: build the literacy and governance to make these judgements before scaling any tool, which is the logic of Helium42's Education-to-Implementation Pathway — a 6–8 week sequence that takes a firm from AI literacy to a governed, compliant deployment. Getting the sequence right is what separates the firms realising AI's benefits from the ones explaining a breach to the SRA. Whatever model is chosen, the decision — and the reasoning behind it — should be documented alongside the vendor's written guarantees, so the firm can evidence a defensible, deliberate choice if a client or regulator asks how confidential data is handled. For where AI fits across the practice, see our overview of AI for law firms.
Frequently Asked Questions
Is it safe for a law firm to use public AI tools like ChatGPT?
Not for client data on the consumer tier, where inputs may be retained or used to train the model. It is safer on an enterprise tier with a contractual no-training guarantee (such as ChatGPT Enterprise or Microsoft 365 Copilot under Enterprise Data Protection). Even then, a named solicitor must verify every output, and the firm must have a lawful basis to process the data.
What does "no training on your data" actually guarantee?
It means the vendor contractually undertakes not to use your prompts and outputs to train its models, and it applies to the enterprise tier — not the consumer version. It does not remove your own duties to obtain a lawful basis, confirm data residency, or supervise output, and some features such as web "grounding" may route data through third parties on different terms. Confirm the guarantee in writing at the tier you use.
Do UK law firms need to host AI on-premise to be compliant?
No. On-premise or self-hosted deployment gives the most control but is only justified for the most sensitive matters, and only where the firm can actually run and secure it. For most firms, an enterprise service with a no-training guarantee, or a private in-region deployment, meets SRA and UK GDPR expectations without the cost and engineering burden of self-hosting.
What does the SRA require for AI use?
The SRA permits AI and has not banned it, but its February 2026 compliance tips make clear that a solicitor remains personally responsible for all work, must verify AI outputs, must protect client confidentiality under the Code of Conduct, and should be transparent with clients about AI use. Two firms have already been referred to the SRA over fake AI-generated citations.
What is the biggest AI data-security risk for law firms?
Shadow AI — staff pasting confidential client information into public AI tools without approval. It is the most common real-world exposure. The fix is a written usage policy combined with a sanctioned, no-training enterprise tool, so people have a safe option and no reason to use an unsafe one.
Deploy AI in your firm without compromising client confidentiality
Helium42 partners with UK firms to choose the right deployment model, verify vendor guarantees, and govern AI for SRA and UK GDPR compliance under the Education-to-Implementation Pathway.
Explore AI consultancy Book a discovery callSources: SRA compliance tips for solicitors (February 2026); Law Society, guide warning over AI risks; ICO, Guidance on AI and data protection; LexisNexis UK lawyer survey (Sep 2024); Microsoft 365 Copilot Enterprise Data Protection.
