California makes lawyers’ AI duties statutory: what UK legal-tech suppliers should learn

What the California statute requires

New section 6068.1 of the California Business and Professions Code preserves an attorney's duties of competence and diligence and says an attorney must not delegate the practice of law to generative AI. Responsibility therefore remains with the human professional even where a system drafts, researches or summarises.

The confidentiality rule is specific rather than absolute. An attorney must not enter confidential, personal identifying or other nonpublic information into a generative-AI system unless access to the information is restricted to the attorney and persons authorised by the attorney who are under confidentiality obligations. A supplier's general assurance that data is 'secure' is not the same as proving that this condition is met.

An attorney using generative AI must take reasonable steps to verify output accuracy, including every case and statutory citation, and correct erroneous or hallucinated output in material the attorney uses. Separately, amended section 128.7 of the Code of Civil Procedure prohibits a court paper from containing a citation that the responsible attorney has not personally verified. The existing sanctions framework can apply to a violation.

The statute also requires an attorney to disclose generative-AI use to the court for all documents submitted to the court and to consider disclosure where AI is used to create public content. The court-document rule is broader than a materiality-based disclosure test: its text is triggered by use of generative AI in a submitted document.

For arbitration, new section 1282.1 prohibits an arbitrator from delegating any part of the decision-making process to generative AI. An arbitrator must not rely on AI-generated information outside the record without prior disclosure to the parties and, as far as practical, an opportunity for them to comment.

What the statute does not do

SB 574 does not certify any model, prohibit every use of generative AI, transfer the lawyer's professional duty to the vendor or create a general statutory duty for all legal-tech suppliers. The immediate statutory duties described above fall principally on California attorneys and arbitrators, with related court-procedure consequences.

A supplier may nevertheless become a practical part of compliance. Product architecture, default settings, contractual terms, logging, source presentation and data use can either help a professional meet the statutory standard or make compliance difficult to demonstrate. That commercial consequence is an inference from the law, not a separate vendor obligation stated in SB 574.

The position in England and Wales

There is no equivalent UK statute imposing SB 574's complete set of AI-specific duties on solicitors. Existing binding professional and court duties already reach many of the same outcomes, however. The Solicitors Regulation Authority's warning notice of 17 August 2026 points to duties concerning competence, effective supervision, properly arguable submissions, confidentiality, governance and not misleading the court or others. The notice is regulatory guidance rather than legislation, but the SRA says it will have regard to the notice when exercising its regulatory functions.

In Ayinde v London Borough of Haringey and Al-Haroun v Qatar National Bank [2025] EWHC 1383 (Admin), the High Court said a lawyer using AI for legal research has a professional duty to check the output against authoritative sources. It also emphasised training and supervision. Depending on the facts, inaccurate material can engage costs, wasted costs, strike-out, regulatory referral and, in sufficiently serious circumstances, contempt or criminal processes. The judgment does not turn every AI error into misconduct; the relevant conduct and applicable test still matter.

The Bar Standards Board's May 2026 guidance likewise keeps responsibility with the barrister, calls for independent verification and treats some technology arrangements as outsourcing requiring proper due diligence. It recommends governance measures including policies, deletion arrangements and audit logs. Its approach to transparency is contextual: de minimis use may not need disclosure, while material use may. That differs from California's express disclosure rule for all court documents produced with generative-AI assistance.

Data protection and confidentiality remain separate analyses. A UK provider or firm should identify the controller and processor roles, lawful basis, special-category conditions where relevant, transparency, retention, security, international transfers and whether a data protection impact assessment is required. A model setting that prevents training on prompts is useful, but it does not answer all of those questions.

The EU position is a product-and-use analysis

The EU AI Act is binding law, but SB 574 does not classify a system under it. Annex III addresses AI systems intended to be used by or on behalf of judicial authorities to assist in researching and interpreting facts or law and applying law to facts, and certain corresponding uses by alternative-dispute-resolution bodies. Subject to the Act's detailed scope and exclusions, those intended uses can fall within the high-risk regime.

A private law firm's research, drafting or knowledge-management tool is not automatically high-risk merely because it is described as legal AI. Classification depends on the provider's intended purpose, the actual function, the actor using it and the relevant exclusions. Provider, deployer and general-purpose-model obligations must also be assessed separately, alongside the GDPR, professional rules, cybersecurity requirements and national procedural law.

Practical actions for legal-tech founders and suppliers

1. Define the product boundary. State which tasks the system supports, which judgments remain human, which uses are excluded and when the workflow must stop for professional review. Avoid claims that the product replaces the lawyer or independently verifies the law unless the evidence genuinely supports that claim.
2. Make verification operational. Link propositions and citations to authoritative sources; show the jurisdiction, court, date and document version; preserve quoted passages; flag inaccessible or uncertain sources; and require a named reviewer before a filing or advice is finalised.
3. Design for restricted access to client information. Use tenant isolation, least-privilege access, encryption, controlled support access, defined retention and deletion, documented sub-processors and transfers, and no training on customer content by default unless the customer has knowingly authorised it on a lawful basis.
4. Support disclosure without overclaiming. Allow a customer to identify the model, version, date and parts of a document for which AI was used, and export a review record suitable for the relevant court or professional process. Do not assume one disclosure statement works in every jurisdiction.
5. Keep reconstructable evidence. Record the instruction, model and version, retrieved sources, generated output, user edits, verification steps, approvals, exceptions and corrections. Apply confidentiality, access and retention controls to the audit trail itself.
6. Use hard controls for adjudicative workflows. An arbitration product should separate administrative assistance from the decision-making function, prevent autonomous determination and provide a route to disclose any material generated outside the record and invite party comment where required.
7. Contract for the regulated use. Allocate instructions and roles, confidentiality, data use, source availability, material model changes, security incidents, service levels, audit evidence, deletion, portability and exit. A disclaimer that outputs may be inaccurate cannot substitute for controls that make professional verification possible.
8. Maintain jurisdiction-specific configurations. California court disclosure, England and Wales professional guidance and EU AI Act classification should not be compressed into a single global 'AI compliant' badge. Track the applicable user, forum, role, intended purpose and effective date.

The compliance conclusion

California has converted several familiar professional-risk themes into express statutory rules. The UK position still rests mainly on technology-neutral professional duties, court powers and regulatory guidance, while the EU adds a separate risk-classification and product-governance analysis.

It is reasonable to see a broader regulatory direction towards demonstrable human responsibility, source traceability, confidentiality and review. That is an inference across the cited regimes, not a universal legal rule. For suppliers, the most durable response is evidence: show who retained authority, what information entered the system, which sources were checked, what changed and who approved the result.