GDPR Compliant AI for Solicitors: The COLP’s List, Shortened
A COLP assessing a cloud AI tool holds two lists at once: the UK GDPR one and the SRA one. A machine in the firm shortens both, because the material never leaves the office.
£500 per month for the software and the hardware rental. You rent the machine — you don’t buy it.
GDPR compliant AI for solicitors means AI used in a way that meets the UK GDPR and Data Protection Act 2018 alongside the firm’s SRA duties. A machine installed in the firm means no third-party AI processor, no restricted transfer and no disclosure of privileged material for the AI step; lawful basis, retention and fee earner conduct remain the firm’s.
Bring your DPO to the call
A short call with the COLP or a partner. Bring your engagement terms and the insurer’s AI questions; we will walk through both lists.
Model, matter files and chat history on one machine in the firm. Privileged material never leaves the office.
Cloud Agents for Intake, Local AI for the Matter Files
New-client calls and the general enquiries inbox carry little that is privileged, so firms run those on our hosted agents and keep client files on a Local AI machine in the office.
- ☁ Cloud-based AI Receptionist
- ☁ Cloud-based Email Manager
- ☁ Cloud-based Leads Outreach
- 🏢 On-premise Local AI
The Questions Your DPO Asks About AI and GDPR Compliance
Most of the hard work in an AI GDPR assessment is about the processor and the transfer. Here is what each looks like for law firms.
| The question | Cloud AI service | A machine in the firm |
|---|---|---|
| Who is the processor for the AI step? | The AI provider — appoint, assess, contract, review | Nobody — the model runs on your own machine |
| Is there a restricted transfer? | Often — IDTA or UK Addendum, plus a transfer risk assessment | No — the data never leaves the building |
| Is our data used to train models? | Depends on the plan, the settings and the small print | Never |
| What goes in the Article 30 record? | A new processor and, often, a new transfer | One fewer of each |
| Erasure requests | Your copy and theirs | Your copy only |
| Lawful basis, purpose, retention | Yours | Still yours |
Two Lists, One Answer
When a law firm assesses an AI tool, the COLP holds two lists. The UK GDPR list: who is the processor, is there an Article 28 contract, does data leave the UK, which transfer mechanism, is a transfer risk assessment needed, what goes in the Article 30 record, is our data used to train models. The SRA list: is client confidentiality kept, is privileged material disclosed, does the engagement letter permit this, what do we tell the insurer. A cloud tool needs an answer to every line, and the answers are provider-specific and kept under review.
A machine in the firm gives the same answer to most lines: the material does not leave the office. The model runs on the firm’s own network; matter files, correspondence, counsel’s advice and chat history stay on it. No AI provider processes client data, so no processor for that step. Nothing leaves the building, so no transfer. Privileged material is not disclosed because it is not sent anywhere. The engagement letter’s third-party clause is not engaged. The insurer’s question gets one sentence.
What stays with the firm is what the SRA always expected the firm to own: which fee earners can see which matters, set through the Microsoft 365 or Google Workspace sign-in the firm already administers; retention under the firm’s existing policy; and the rule that every output is a draft for a qualified person, never advice. Your content is never used to train models, and a deletion is a deletion because no third-party copy exists.
We act as a processor only for the support access the firm grants us, under a data processing agreement drawn narrowly enough for the COLP to read in one sitting. Bring them to the first call; the data flow takes ten minutes and the questions are easier before hardware is ordered.
What Is Installed, and What the Paperwork Looks Like
The machine, the software on it, the sign-in and the support — and the two documents your advisers will ask for.
No third-party AI processor
The model runs on your own machine, so your documents are never sent to an AI provider. Nothing to appoint, assess or keep under review for the AI step.
No restricted transfers
Your data never leaves the UK. The IDTA, the UK Addendum and a transfer risk assessment simply do not arise for the processing it does.
A shorter Article 30 record
One fewer processor and one fewer transfer to describe, review and keep current — and one less thing to explain if the ICO ever asks.
| Document | What the fee earner asks for | What stays where |
|---|---|---|
| Correspondence on a matter | A chronology, every entry cited | On the machine, in the office |
| Bundles and disclosure | A summary; the passages on a point | On the machine, in the office |
| Leases, contracts, agreements | What clause 14 says; the differences between two versions | On the machine, in the office |
| Precedents and house style | A first draft, for a supervisor to review | On the machine, in the office |
| Counsel’s advice and privileged notes | Searchable within the matter, by permitted staff | On the machine, in the office |
| Case management system | Not connected — remains the system of record | Your existing system |
From the COLP’s Call to a Machine in the Firm
Weeks, not months. Most firms start with one practice area and widen once it is in daily use.
A call with a partner or the COLP
Practice areas, headcount, which team goes first. We specify the machine from that and walk through the data flow.
Install and import
The machine goes on the firm’s network. Sign-in connects to your Microsoft 365 or Google Workspace. Files, correspondence and precedents for the first team are imported into spaces.
Train fee earners, then support
We train the people who will use it, including what it is not for. Updates, model upgrades and support follow, from the people who installed it.
Where Local AI Is the Wrong Answer
We would rather lose the enquiry than the trust. Three things we tell every prospect before they sign anything.
It is not a compliance certificate
No product can make law firms UK GDPR-compliant on their own. A machine in the building removes the processor and transfer questions for the AI step. Purpose, lawful basis, retention and staff conduct remain yours, and we will not tell you otherwise.
It is slower than the big cloud models
Open-weight models on a single machine are capable for summarising, drafting and answering questions about your own documents. For frontier reasoning on hard, novel problems, the largest cloud models are still ahead. That is the trade.
It is a weeks-long install, not a sign-up
A cloud agent is live in days. Local AI needs the machine specified, delivered, installed on your network and your documents imported. Weeks, not months — but not tomorrow.
Built With the Regulator in Mind
Data never leaves the building
Open-weight model, documents and chat history on one machine in the firm. The only outside connection is your own sign-in.
Never used for training
Your content is not used to train or improve any model. The models arrive trained and stay that way unless you ask.
One DPA, for one thing
We are a processor only for the support access you grant, and the agreement says so in plain terms.
Honest about the trade
Local models are capable and somewhat slower than the largest cloud services. We say so before you sign anything.
Which Page Answers Your Firm’s Question
| If your question is… | The short answer | Read more |
|---|---|---|
| The general GDPR picture for AI | The processor and transfer questions, in full | GDPR compliant AI |
| We want the Local AI overview for solicitors | The head page for law firms | Local AI for solicitors |
| Is this a private LLM for law firms? | Yes — private by construction | Private AI for solicitors |
| What exactly is installed in the firm? | One machine in the office, supported | On-Premises AI for solicitors |
| We would rather host it ourselves | It sits in your building; we maintain it | Self-Hosted AI for solicitors |
| We are a City firm | The transfer question, London edition | GDPR Compliant AI London |
| Why on-premises at all? | The case for Local AI, in full | Local AI product page |
AI and GDPR Compliance for Law Firms: Common Questions
Is there such a thing as GDPR compliant AI?
Not as a product label. Compliance is a property of how law firms use a tool, not of the tool. What a product can do is make the assessment easier: a machine in the firm removes the processor and transfer questions for the AI step entirely.
Do we need a DPIA for AI?
Often, yes, and we would rather you did one. A machine in the building makes it shorter: the questions about the processor, the transfer mechanism and the training use of your data have plain answers. Purpose, lawful basis, retention and access are still yours to answer.
Does a machine in the firm satisfy our SRA confidentiality duty?
That is the firm’s judgement, but the facts are simple: the model, the documents and the chat history stay on a machine in your building. There is no third-party AI processor and no transfer, and privileged material is not disclosed because it is not sent anywhere.
What do we tell our professional indemnity insurer about AI use?
That AI at the firm runs on a machine in the office, that no client material is sent to an AI provider, that outputs are drafts reviewed by a qualified person, and that access follows the firm’s existing controls. We will put it in writing for the renewal form.
Does it give legal advice?
No. It drafts, summarises and finds. Every output is a starting point for a fee earner, and anything constituting legal advice stays with a qualified person. We say so in the training and we would say so to your insurer.
Can it read our case management system?
It does not connect to it. Documents and correspondence are exported into spaces on the machine, organised by matter or practice area. The case management system stays the system of record.
How much does Local AI cost?
£500 per month for the software and the hardware rental. The dedicated machine is rented to your business, not sold: you never buy the hardware. It is installed in your building and runs the private chat, document spaces and assistants. Local AI is for business customers only.
Bring Both Lists to the First Call
Tell us your practice areas and what is blocking AI sign-off. We will walk through the data flow with your COLP and say plainly what a machine in the firm settles.
Prefer email? sghaith@businessaiagents.co.uk