The Solicitors Regulation Authority made clear in August 2026 that using AI does not reduce, remove or replace a solicitor's responsibility. Yet most conveyancing practices evaluating AI tools still begin by asking which vendor to choose, which model to deploy, which features to enable. That question comes last. The obligations that govern AI use are duties a firm already holds, and getting those clear is what determines whether the firm can demonstrate compliance when asked.
Data protection law requires a practice not merely to comply but to demonstrate that compliance. When a regulator or the Information Commissioner asks what an AI tool touched last month and whether it stayed within approved bounds, a collection of vendor assurances and training records will not answer the question. Most AI failures in professional practice are not failures of lawfulness but failures of demonstrability.
Five obligations that define the environment
Ed Molyneux, co-founder and CTO of Moverly and original author of the Property Data Trust Framework, sets out five duties that translate into architectural requirements for any compliant AI deployment in a conveyancing practice.
The first is accountability. A firm can hold a sound lawful basis, act in good faith and still breach this obligation because it cannot show what the AI touched or confirm it stayed within approved parameters. Accountability is not satisfied by doing the right thing. It requires a traceable record of what was done.
The second is security. For a practice holding confidential client files, this means knowing who accessed what, controlling which systems client data may reach, and being able to detect when it flows somewhere unauthorised. An AI tool is simply another system into which data can move. The question is whether that movement is controlled and visible.
The third is a lawful basis. Molyneux flags a common misunderstanding: a firm needs a lawful basis to process client personal data, typically the performance of the retainer or legitimate interests, but that determination is made once, for a defined purpose, and recorded. It is not recreated each time a fee-earner opens a tool. Treating every AI interaction as a fresh lawful-basis event wastes effort and distracts from obligations that carry real risk.
The fourth is processor governance. Where a third party processes personal data on behalf of the firm, a written agreement must be in place. That requirement becomes a design constraint: client data may flow only to processors the firm has assessed and contracted with. An AI vendor is a processor, so which tools may receive client data cannot be left to individual discretion under deadline pressure. It must be a controlled, enforced list.
The fifth is professional duty. The SRA stated in its August 2026 warning notice that reliance on an AI output would not be a suitable defence. A tool may support a fee-earner's assessment but may not silently replace it. The firm remains responsible for supervising how staff use these tools, which it cannot do if it cannot see what they are doing.
What the duties imply
Read together, the five obligations stop being a compliance checklist and become a specification for the environment in which AI must run.
Accountability implies a record of what AI use actually touched. Security implies controlled, visible data flows tied to identity. Lawful basis implies a decision made once and applied consistently, not delegated to the fee-earner at the point of use. Processor governance implies technical enforcement that data reaches only approved vendors. Professional duty implies AI positioned as support, with a human in the loop and a supervisor able to review the work.
None of these requirements is satisfied by a better prompt, a revised policy document or another training session. They are properties of the environment: how people authenticate, what the tool is permitted to access, and whether every interaction leaves an auditable trace.
Molyneux's framework is his interpretation of combined SRA and GDPR requirements, not a formal regulatory checklist, and his claim that most professional AI failures stem from demonstrability rather than lawfulness is inference rather than published SRA enforcement data. But the logic is sound, and the timing is material. Practices that deployed AI tools without building audit trails, access logs or processor controls now carry regulatory exposure that professional indemnity cover may not address.