Your fee earners are using AI. Do you know how?
A free, half-day assessment that tells you where you stand.
And what to do next. No vendor pitch — written to be shared with your leadership team.
Shown here for law firms. We run the same healthcheck for regulators, accountants, and other regulated professions — the five areas stay the same, the questions and benchmarks change to fit your sector.
Experimenting without a plan
Every law firm is being asked about AI. Many are experimenting without a plan. The result is inconsistent tooling, unmanaged risk, and fee earners using consumer AI on client data with unknown controls. Some firms do not really know where to start.
You have choices: ignore it, buy another AI tool subscription and hope it works, or find out where you are before you spend more or risk more.
What you get
- An independent assessment across five areas: AI adoption and value, AI governance and control, data protection, security posture, and resilience and recovery.
- A prioritised roadmap — sequenced by what matters most, with owners and timeframes.
- No vendor or product pitch — this is your assessment, not ours.
- Written to be shared with your leadership team — factual, technically grounded, and yours to circulate.
What we assess
AI adoption and value
What you pay for, what staff actually use, shadow AI.
AI governance and control
Policy, ownership, accountability, disclosure, audit trail.
Data protection
DPIA, lawful basis for AI, client restrictions.
Security posture
MFA, incidents, AI-specific attack surface.
Resilience and recovery
Backups, tested restore, continuity when an AI-dependent process fails.
Gathered for context, not scored
Infrastructure fitness, IT capability and capacity, document estate quality, change readiness and sponsorship.
Why now
Delay carries risk; ungoverned adoption carries a different one.
- Clients are comparing firms on AI capability, protection and security — and may leave for a more cost-effective, AI-enabled alternative, or require AI security and data protection certifications as a condition of engagement.
- Fee earners are already using free, publicly accessible AI tools without approval. In UK surveys, 59% admit to it for client work. Across enterprises generally, 40% of files uploaded to generative AI contain personal or payment-card data. See the full analysis and citations below →
- This is no longer theoretical. In Munir v Secretary of State for the Home Department [2026] UKUT 81 (IAC), the Upper Tribunal warned that putting confidential documents into a public AI tool such as ChatGPT breaches client confidentiality and waives legal privilege.
Who this is for
Managing partners and senior decision-makers who want an honest picture of where their firm stands — whether you've already committed to a vendor or a roadmap, or not. Particularly relevant if:
- The firm has no formal AI strategy.
- Fee earners are already using AI tools the firm does not provide.
- A client has asked — or is likely to ask — how the firm uses AI.
- The firm is considering new AI products.
- The partnership wants a fact-base to develop or refine its AI strategy.
What we will do
A half-day onsite — four hours — with structured interviews: an executive sponsor, the technology lead, one or two fee earners, and the risk lead. Expect about six hours of your people's time in total. Before the visit we ask for a short document list: your AI policy if you have one, your DMS and security overview, and your most recent DPIA. Where it helps, we run walkthroughs on your own systems, before or after the visit. This is a readiness healthcheck. It is not an assessment of specific legal AI tools, not an audit of data protection, and not a security penetration test. We work under a legal agreement to your satisfaction that includes a mutual non-disclosure agreement.
What it costs and what you get
The first 10 firms: no charge (standard price £5,000). We ask only for your time and honest answers. In return, within 14 days, we give you a Senior Partner readiness report covering AI adoption, AI governance, data protection, security posture, and resilience — with a prioritised roadmap. Later, once we have enough responses, we plan to publish an anonymised peer benchmark; that is a future intention, not a commitment to you. We can take 10 firms this quarter — email enquiries@abila.ai to secure your place.
Two senior practitioners
Current in AI and in regulated finance. Hands-on, and accountable for the work.
Simon Ordish
Technical & Infrastructure Lead
Over 35 years designing systems for high-stakes environments. Built deployment infrastructure for Salomon Brothers (London/New York). Founded Laverock von Schoultz, grew from 6 to 60 developers, served Ernst & Young, Reuters, William Hill. Acquired by La Française des Jeux (French national lottery operator). Expert in production AI: LLM infrastructure, RAG systems, vector databases. Now builds private, on-premises AI systems for firms that cannot send client data to public models.
Robert Quinlivan
Regulatory & Governance Lead
Chartered Accountant (Fellow, CAANZ) and CFA Charterholder. 35+ years in regulated finance — KPMG, Merrill Lynch corporate audit, CFO roles at Barclays (UK and Japan) and Macquarie (Asia teams). Group CFO of Sun Hung Kai & Co. Ltd (HK public). Until 2026, CEO of regulated digital asset operations at Bullish (NYSE-listed, multi-regulator licensed). Expert in governance, regulatory compliance, and control frameworks for emerging technologies.
Our commitment
We are co-founders of Abila Technologies Limited, a start-up developing private AI systems. We run this review to understand what practitioners actually face when they adopt AI. What we learn, in aggregate and de-identified, shapes what we build next.
We come from regulated financial services, not from law. That is deliberate. In banking and digital assets, the control bar is set by a supervisor who arrives unannounced and asks for evidence: who approved this, who has access, what is logged, and what happens when it fails. We hold AI use in your firm to that same bar.
The failure modes we look for are not legal questions. They are control questions — access, retention, logging, disclosure, recovery. Those look the same in a law firm as they do in a bank.
We do not opine on privilege, on conduct rules, or on your retainer terms. Those stay with your Compliance Officer for Legal Practice. We give you the control picture; you apply the legal judgement.
This review is vendor neutral. It assesses your firm independently and prioritises the gaps. It does not sell you anything. If you want to discuss tooling — ours or anyone else's — that is a separate engagement, on your initiative.
We are present and accountable for the quality of your assessment. We do not outsource to junior staff or subcontractors.
How we handle your information
- We work under a mutual non-disclosure agreement, signed before we start.
- We take notes, not copies. We do not remove client files or client personal data from your systems. Where we need to see a document, we view it on your screen.
- What we do hold is encrypted, access restricted to the two of us by name, and deleted after we deliver the report.
- We put nothing from your firm into any AI tool — ours or anyone else's — and nothing from your firm is used to train any model.
- The report is yours. You decide who sees it. We report to you and to nobody else; any decision to notify a regulator or a client is yours alone.
- Aggregate learning only. Anything we carry forward is de-identified and aggregated — never your name, your documents, or anything that identifies your firm.
Data on unsanctioned AI adoption
And the risks to law firms.
Key finding
59% of UK fee earners use unapproved AI for client work. Across enterprises generally, 40% of files uploaded to generative AI like ChatGPT contain personal or payment-card data.
How widespread is shadow AI?
Lawyers are heavy AI users:
- 69% of legal professionals use generative AI tools such as ChatGPT for work.1
- 59% of UK fee earners admit to using unapproved AI tools like ChatGPT for client work.2
Yet leaders believe they are in control:
- 68% of firm leaders claim full visibility of AI use across their firm — and believe they face zero risk from unapproved AI.3
- Only 34% of firms have adopted legal-specific AI firm-wide, so most of that use runs on consumer tools.4
Why this matters: the data leakage problem
Using unsanctioned tools exposes law firms to data breaches and liability. The data is stark:
- Across enterprises generally, 77% of employees who use generative AI paste data into it; 82% of that activity comes from unmanaged personal accounts; and 40% of uploaded files contain personal or payment-card data. Most of what employees move into generative AI — including the sensitive material — travels outside any enterprise oversight.5
- 87% of respondents to the World Economic Forum's global cyber security survey identified AI-related vulnerabilities as the fastest-growing cyber risk of 2025. Data leaks — the exposure of personal data through generative AI — is now their leading generative AI concern for 2026, at 34%, up from 22% a year earlier.6
In a law firm context this is acute. In Munir v Secretary of State for the Home Department [2026] UKUT 81 (IAC), the Upper Tribunal observed that "uploading confidential documents into an open source AI tool, such as ChatGPT, is to place this information on the internet in the public domain, and thus to breach client confidentiality and waive legal privilege". Leaking a client contract, an email chain, or case facts into a public AI model means:
- Direct violation of the duty of client confidentiality.
- Loss of legal privilege, and non-compliance with regulatory obligations (UK or Gibraltar GDPR, and your regulator's conduct rules).
- Client data may be stored, logged, or used to train public algorithms.
- You have no way to measure the exposure.
Why it happens
Lawyers are responding to gaps in firm support:
- 54% of legal professionals report their firm has provided no training on responsible AI use and has no plans to do so.7
- 71% of paralegals and 57% of solicitors admit to using unapproved AI to keep up with workload demands.8
The path forward
Shadow AI usage is a symptom of lack of planning, governance, and visibility. It requires:
- Structured AI governance and clear, enforceable policies.
- Sanctioned, secure tools that meet client and regulatory requirements.
- Training and enablement so staff understand why and how to use AI safely.
- Audit and visibility into what tools are in use and what data is being exposed.
- 8am, 2026 Legal Industry Report, 5 March 2026. Online survey of more than 1,300 legal professionals, September–October 2025; respondents are predominantly US and Canadian, and mostly from small firms. ↩
- Censuswide for Access Legal, Unapproved AI use in UK law firms exposed after landmark ruling, 20 May 2026. 200 UK legal professionals — 100 firm leaders and 100 practitioners — surveyed in April 2026. ↩
- Censuswide for Access Legal, 20 May 2026 (base: 100 firm leaders). ↩
- 8am, 2026 Legal Industry Report, 5 March 2026. ↩
- LayerX, Enterprise AI and SaaS Data Security Report 2025. Based on enterprise browser telemetry across all sectors, not legal-specific and not UK-specific; "sensitive" means PII or PCI data. ↩
- World Economic Forum, Global Cybersecurity Outlook 2026, 12 January 2026. 804 qualified respondents from 92 countries, including 316 CISOs and 105 CEOs. ↩
- 8am, 2026 Legal Industry Report, 5 March 2026. ↩
- Censuswide for Access Legal, 20 May 2026 (base: 100 practitioners; the role splits are sub-samples of that base). ↩
Secure one of the first 10 places.
Standard price £5,000 — free for the first 10 firms this quarter.