In November 2023, the UK Solicitors Regulation Authority (SRA) published its guidance on artificial intelligence in the legal sector. Two years later, ask most UK law firms which specific matters involved AI in drafting or analysis, and the typical response is a shrug or a vague promise to check with IT. This operational gap is not a minor issue: it reflects the fact that the internal infrastructure to answer that regulatory question simply does not exist in many practices. And this is not a compliance panic piece; it is a technical and business reality that separates prepared firms from those that are not.
The SRA guidance did not ban anything in 2023. It set expectations around digital competence, confidentiality, accountability, and client communication. The subtext, however, was clear: if a regulator or client asks whether AI touched a specific piece of work, the firm must be able to answer. To this day, most firms treat AI usage as a tooling question, but it is actually a records question. You cannot supervise a matter, bill it honestly, or defend it later if you cannot reconstruct what happened. The ABA, in its Formal Opinion 512 of 2024, made this explicit regarding billing: you cannot bill hours that AI actually saved. That only works if you know where AI was used.
The reputational risk is real. Stanford University’s tracker of AI-fabricated citations in court filings went from 87 cases to over 1,300 in eleven months during 2024. That is the visible failure mode. The invisible one is a partner who cannot tell a client what tools touched their confidential documents. To avoid this, a matter-level AI usage log is required. When people hear 'AI log,' they imagine a spreadsheet of ChatGPT prompts. That is not it. A useful log ties to the matter number and captures enough to reconstruct what happened without recording every keystroke. A practical shape includes: matter ID and responsible fee earner, tool used with version if exposed, task category (research, first draft, summarisation, review, translation, redlining), input classification (whether client-confidential material was sent to the tool and under which vendor agreement), output disposition (kept, discarded, materially edited, used verbatim), human reviewer and timestamp of sign-off, and time saved estimate for the billing conversation. You do not need every prompt; you need enough to answer three questions: what did the AI do on this matter, who checked it, and did any confidential data leave the perimeter.
If the log answers those, the firm is ahead of most of the market. Why does integration break in practice? It is not laziness. It is that the AI tools lawyers actually use — Copilot in Word, Harvey, Legora, ChatGPT on personal accounts — do not push structured events into the matter management system. So the log must be manually maintained, which means it is not. The pattern seen in firms that get this working: they pick a small set of sanctioned tools and block the rest at the network layer. Each sanctioned tool has an API or an SSO-based audit export. A thin service reads those exports on a schedule and posts events into iManage, NetDocuments, or the practice management system, tagged by matter. Fee earners confirm or edit the auto-generated log entry when they close their time. That is the only manual step. If the log requires a separate workflow, it dies. If it is a two-click confirmation inside the time entry the lawyer is already doing, it survives.
This challenge gets harder, not easier, from here. The EU AI Act’s Article 50 transparency obligations apply from 2 August 2026, and the high-risk provisions from 2 December 2027. Legal services touch several categories where the high-risk framing is actively debated. Whatever the final scope, the direction is more disclosure, not less. GDPR fines already reach up to €20 million or 4% of global turnover, and the AI Act adds its own regime on top. Firms that already have matter-level AI logs will treat the 2026 and 2027 deadlines as configuration changes. Firms that do not will treat them as projects, and projects at law firms tend to run late.
The SRA gave everyone a two-year head start in November 2023. The firms that used it are quietly building the plumbing now. The ones that did not will be answering the question under time pressure, which is the worst way to face any regulatory requirement. In this context, the right technology is not a luxury but a strategic necessity. This is where custom software development comes into play. Custom applications can integrate sanctioned AI tools with matter management systems, eliminating manual overhead and ensuring traceability. Furthermore, artificial intelligence applied to legal processes not only optimises repetitive tasks but, when combined with cloud platforms like AWS or Azure, offers scalability and security. Cybersecurity becomes critical when handling confidential client data; a well-implemented AI log must ensure that no sensitive information leaves the perimeter uncontrolled. Additionally, business analytics through Business Intelligence (Power BI) allows firms to visualise AI usage by matter, identify efficiency patterns, and justify billing with objective data. Finally, AI agents — autonomous assistants that perform tasks like contract review or clause extraction — must be perfectly logged to meet future regulatory demands.
Q2BSTUDIO, as a software development and technology company, understands that the digital transformation of law firms is not limited to installing a tool, but to building the infrastructure that connects people, processes, and data. From implementing AI usage logs to integrating with cloud environments and protecting through advanced cybersecurity, we offer solutions that turn a regulatory requirement into a competitive advantage. The time to act is now: firms that invest in this middle technical layer will be able to answer with certainty when the regulator asks. The rest will face an urgent project in 2026. The decision is strategic, and the moment is here.
