On 17 August 2026 the Solicitors Regulation Authority issued a warning notice on the misuse of artificial intelligence. Behind it sat 42 reports of potential AI misuse received in the twelve months to July 2026, with several investigations still open. The concerns grouped themselves into three familiar categories: fabricated legal citations, inadequate supervision, and client information finding its way into public AI tools.
What is striking about that list is how unremarkable it is. These are not exotic technological failures. They are the same failures the profession has always been prone to, unchecked assumptions, thin supervision, careless handling of confidential material, arriving faster and with more confidence than before.
Contract review is where most businesses meet legal AI first. It is an obvious candidate: high volume, repetitive, expensive, and slow. Used properly, AI genuinely does compress the time between receiving a 60-page framework agreement and understanding what is actually in it. But the gap between “understanding what is in it” and “knowing whether to sign it” is where the difficulties live. Below are the failure points we see most often, and what a sensible process looks like around them.
It reads the words. It does not read the deal.
An AI model analyses the document in front of it. It does not know that your last three contracts with this counterparty were varied by email, that there is a side letter sitting in someone’s inbox, or that the commercial director has already promised something the drafting does not reflect.
This matters more under English law than people assume. The interpretation of a commercial contract is not a purely textual exercise. The Supreme Court’s approach in Rainy Sky SA v Kookmin Bank [2011] UKSC 50, Arnold v Britton [2015] UKSC 36 and Wood v Capita Insurance Services Ltd [2017] UKSC 24 requires the court to consider language and commercial context together, iteratively, in light of the facts and circumstances known to both parties at the time. A tool with no visibility of that background is working with only part of the material a court would have.
The practical consequence: an AI review can tell you what a clause says. It cannot reliably tell you how a judge would read that clause against the history of your relationship.
Confident invention
The most publicised risk is also the most easily demonstrated. In Ayinde v London Borough of Haringey and Al-Haroun v Qatar National Bank QPSC [2025] EWHC 1383 (Admin), a Divisional Court dealt with two matters in which non-existent authorities had been placed before the court. Wasted costs orders had already been made at an earlier hearing, andreferrals to both the Bar Standards Board and the SRA followed. The court noted the obvious point: generative AI produces responses that are coherent, plausible and sometimes entirely wrong, including citations to sources that do not exist.
It is not only lawyers who are exposed. In Harber v HMRC [2023] UKFTT 1007 (TC), an unrepresented taxpayer relied on nine tribunal decisions that turned out to have been generated rather than found.
In contract review the same failure mode appears in quieter forms: a cross-reference to a clause number that is not in the document, a summary that quietly reverses which party bears a risk, a confident assertion that a term is “market standard” with nothing behind it. These errors are harder to spot than a fake case name, because there is nothing to look up.
It is better at what is there than at what is missing
Ask an AI tool to review a services agreement and it will work diligently through the clauses in front of it. The problem is that most contract disasters are caused by absence, not by presence.
No cap on liability. No exclusion of indirect loss. No termination for convenience. No change-of-control provision, so a competitor acquires your supplier and inherits the relationship. No data processing terms where personal data plainly flows. No express provision on who owns the intellectual property in bespoke work, leaving you to argue about implied licences later.
Absence is a judgment call about what this deal ought to contain, which depends on the commercial risk being run. That is precisely the kind of question a model trained on documents rather than on your business is least equipped to answer.
Mandatory law does not care how well the clause is drafted
A clause can be immaculately drafted and wholly unenforceable. English law overrides party autonomy in a long list of places, and a generic AI review will rarely apply those overrides to your facts:
• Unfair Contract Terms Act 1977 – exclusions and limitations on written standard terms must satisfy the reasonableness test in section 11, to which the Schedule 2 guidelines are routinely applied by analogy.
• Consumer Rights Act 2015 – Part 2 renders unfair terms in consumer contracts non-binding, and the statutory rights on goods, services and digital content cannot be contracted away.
• The penalty rule – as reformulated in Cavendish Square Holding BV v Talal El Makdessi and ParkingEye Ltd v Beavis [2015] UKSC 67, a secondary obligation that is out of all proportion to the innocent party’s legitimate interest is unenforceable.
• Business Contract Terms (Assignment of Receivables) Regulations 2018 – many anti-assignment clauses in business contracts are simply ineffective against the assignment of receivables.
• Late Payment of Commercial Debts (Interest) Act 1998 – a payment term that ousts statutory interest without providing a substantial remedy will not stand.
• Landlord and Tenant Act 1954, section 38A – a purported exclusion of security of tenure is void without the correct notice and declaration procedure.
• Restraint of trade – post-termination restrictions that go beyond the protection of a legitimate business interest are void, however neatly drafted.
An AI tool will often flag that a clause is aggressive. It is much less likely to tell you that the clause is unenforceable, or that removing it would improve your position.
Confidentiality, privilege and your own NDA
The SRA’s warning notice makes the point bluntly: putting client correspondence into an open AI tool is, in substance, placing that information in the public domain. The same logic applies to a draft acquisition agreement, a settlement term sheet, or a supplier contract containing pricing your competitors would like to see.
Three distinct exposures arise, and they are frequently conflated:
Data protection. If the contract contains personal data, and most employment, services and customer agreements do, you need a lawful basis, and you need Article 28 UK GDPR processor terms with the AI provider. If processing occurs outside the UK, you need a transfer mechanism such as the ICO’s International Data Transfer Agreement or the UK Addendum, supported by a transfer risk assessment.
Privilege. Legal advice privilege depends on confidentiality being maintained. Pasting privileged material into a consumer-grade tool whose terms permit the provider to use inputs is, at best, an unnecessary argument waiting to happen.
Your own contractual promises. Most non-disclosure agreements restrict onward disclosure to identified categories of recipient. A public AI service is a third party. Feeding the counterparty’s confidential draft into it may breach the very agreement you are reviewing.
A model trained largely on American documents
Ask a general-purpose model to improve an indemnity and there is a fair chance you will be offered “indemnify, defend and hold harmless”, an exclusion of “consequential damages”, a warranty of merchantability, or a covenant of “best efforts”. None of these are terms of art in England and Wales.
English law recoverability is governed by the remoteness principles in Hadley v Baxendale (1854) 9 Exch 341 and its successors, not by American categories of damage. Endeavours obligations have their own domestic case law, with meaningful distinctions between best, all reasonable and reasonable endeavours. Liquidated damages operate within the framework considered in Triple Point Technology Inc v PTT Public Company Ltd [2021] UKSC 29. Imported drafting does not merely look odd; it creates genuine uncertainty about what was agreed.
Automation bias, and where liability actually sits
The most under-discussed risk is behavioural. When a tool produces a clean, well-organised report, review tends to become confirmation. The second reviewer reads the summary rather than the contract. Over a few months, “AI-assisted” quietly becomes “AI-decided”.
The SRA Code of Conduct requires competent service and effective supervision, and the warning notice is explicit that AI use does not dilute personal accountability. In negligence terms nothing has changed either: if a limitation clause was missed, the claim is against the adviser, not the software. Professional indemnity insurers are increasingly asking how firms verify AI output, and a policy of “we assume it is right” is not a good answer.
There is also a live regulatory dimension if you push automation further than review. Section 80 of the Data (Use and Access) Act 2025 came into force on 5 February 2026, replacing Article 22 UK GDPR with a permission-with-safeguards model for significant automated decisions, but the safeguards, including genuine human intervention and a right to contest, are mandatory. Businesses trading into the EU should also note that, following the Digital Omnibus on AI, the AI Act’s high-risk obligations for Annex III systems have been deferred to December 2027, while the Article 50 transparency requirements are already running.
What a defensible process looks like
None of this is an argument against using AI for contract review. It is an argument against using it unsupervised.
The firms and in-house teams getting real value from it tend to do five things. They use a closed environment where inputs are not used to train the model. They define narrow tasks, clause extraction, playbook comparison, internal consistency checks, first-pass triage, and keep the final judgment with a person. They verify every citation and every cross-reference. They keep a record of what the tool produced and what the human changed. And they draw a hard line: no confidential or privileged material into a public tool, ever.
How we approach it
At 360 Business Law, we combine our proprietary AI contract review technology with direct access to our global team of qualified lawyers.
Our AI carries out the initial review, identifying and extracting the provisions that matter, assessing them against your agreed commercial and legal positions, and explaining clearly what the contract says and where potential issues arise.
Where legal advice or further analysis is required, a qualified lawyer can then be instructed in any relevant jurisdiction in which we operate. We will provide a fixed-cost estimate for the work, based on a competitive hourly rate, before proceeding.
Our lawyers then do what the technology cannot: apply the relevant law and mandatory legal or regulatory requirements; consider the provisions in the context of your business, commercial objectives and previous dealings; identify important protections or provisions that are missing from the contract; assess the practical legal and commercial risks; and advise you were to negotiate, what to challenge and what changes should be sought.
This combination is deliberate: AI delivers speed and efficiency for the mechanical analysis; experienced lawyers provide judgement where it matters. The result is an integrated contract review service supported by one legal team, wherever in the world your contract takes you.
If you would like us to review a contract or would like assistance developing a practical AI policy and governance framework for the use of AI within your own contracting processes, please get in touch.
This article is general information about the law of England and Wales as at August 2026. It is not legal advice and should not be relied upon as such. Please take advice on your specific circumstances.