Image: Pexels, used under the Pexels License.
TL;DR: On October 9, 2026 the Courts and Tribunals Judiciary of England and Wales published a "Position Statement on the Judicial use of Artificial Intelligence (AI)", signed by Sir Colin Birss, the Lead Judge for Artificial Intelligence. The approach is "cautious but positive". Only approved AI tools may be used, and they must have UK data residency, enterprise data protection and disabled web access. AI must not determine the outcome of a case, every AI output must be reviewed, verified and approved by the judge, and every new use case goes through one steering group. The same five rules make a short, defensible AI policy for a small law firm, and we turn them into a template below.
Event date: October 9, 2026 (statement published on judiciary.uk). First reported: October 11, 2026 at 23:01 UTC (Legal Futures), then October 12, 2026 (Law Society Gazette).
What the judiciary published
The statement is a short page on judiciary.uk. In its own words it "sets out how AI is used, how it is governed, what safeguards are in place, and how the approach is kept under review." It sits alongside, and does not replace, the AI guidance for judicial office holders, whose latest update is October 2025. That guidance was "first issued in December 2023 and updated in April and October 2025."
The opening paragraph sets the tone: "Our approach will be cautious but positive. AI will be adopted to support but not replace judicial decision-making and be subject to strict safeguards and robust testing." The statement adds that AI use "must always support the administration of justice, safeguard judicial independence, and maintain public confidence."
It is written for the people who run AI adoption inside the court system. The scope paragraph says it "guides senior judiciary working with the Judicial Office", His Majesty's Courts and Tribunals Service (HMCTS) and the Ministry of Justice on training, pilots, governance, communications and transparency.

Screenshot: Position Statement on the Judicial use of Artificial Intelligence (AI), Courts and Tribunals Judiciary (judiciary.uk), October 9, 2026.
The statement is signed by Sir Colin Birss, who signs as Lead Judge for Artificial Intelligence. Legal Futures reported that he is "currently the president of the Business and Property Division" and "becomes Master of the Rolls next month."
The statement at a glance
Everything in this table comes from the statement itself. Paragraph numbers follow the page.
| Topic | What the statement says | Where |
|---|---|---|
| Who decides | Judicial decisions are taken by a judicial office holder; AI "must not displace reasoning, evaluation of evidence or the exercise of judicial discretion" | Core principle 2 |
| Human review | "Every AI output used in judicial work must be reviewed, verified and approved by the responsible judicial office holder" | Core principle 4 |
| Accountability | "The judicial office holder remains fully accountable." | Core principle 4 |
| Pilots so far | Lower risk use cases, secure tools, controlled settings, before wider deployment | Paragraph 6 |
| Pilot functions | Summarisation, transcription, redaction, accessible language, admin and leadership tasks, chronology-building, document analysis | Paragraph 7 |
| Approved tools | Only approved tools; not listed "due to the pace of change" | Paragraph 9 |
| Minimum features | UK data residency, enterprise data protection, disabled web access | Paragraph 9 |
| Outcomes | "AI tools must not determine the outcome of a case" | Paragraph 10 |
| New tools | Approval, evaluation and ongoing review before any wider deployment | Paragraph 11 |
| New use cases | Raised with judicial leadership, then assessed by a steering group chaired by the Lead AI Judge | Paragraphs 12 and 13 |
| Training | Judicial College, in-person and online, plus a library of guidance and recordings | Paragraph 14 |
| Review | Steering group changes approved uses after new pilots, evaluations, incidents or emerging risks | Paragraph 15 |
The pilots are the part most firms will recognise. The statement says they tested "the reliability of AI tools and their outputs, the degree of human checking required, the handling of sensitive material, and the safeguards necessary for operational use", and that lessons from them shaped the statement.
Approved tools: the three minimum features
Paragraph 9 is the most concrete line in the document: "Only approved AI tools may be used for judicial purposes. Due to the pace of change, these tools will not be listed here." As Legal Futures summarised it, "Their features must include UK data residency, enterprise data protection, and disabled web access."

Screenshot: "Tools" and "Governance and approval" sections of the Position Statement on the Judicial use of AI, Courts and Tribunals Judiciary (judiciary.uk).
Each feature closes a specific gap:
- UK data residency. Prompts, uploads and outputs are stored in the UK. That is a data location question you can ask any vendor and check in a contract or data processing addendum.
- Enterprise data protection. The tool runs under business terms rather than consumer terms. The October 2025 guidance explains why that matters: "Any information that you input into a public AI chatbot should be seen as being published to all the world."
- Disabled web access. The tool answers from what you give it, not from a live web search. That shrinks two risks at once: material leaving through a search query, and unverified web content entering the output.
The statement does not name a product, so there is no list to copy. What you can copy is the test.
Five rules a law firm can copy from the statement
The statement governs judges, not solicitors or barristers. But its structure is exactly what a small firm's AI policy needs, and each rule below maps to a paragraph you can cite to a partner or a client who asks where the rule came from.
Rule 1: approved tools only, with a written minimum spec
Keep a short list of approved tools and require the same three features the judiciary requires: data residency you can name, enterprise terms, and web access switched off for client work. Anything not on the list is not used for client matters, including free tiers on personal phones. The October 2025 guidance makes the same point for judges: "Use work devices (rather than personal devices) to access AI tools."
Rule 2: AI never makes the call
Write it in one sentence: AI output can inform advice, drafting or case strategy, but a named fee earner makes the decision. This mirrors paragraph 10, "AI tools must not determine the outcome of a case or displace judicial reasoning, analysis or discretion."
Rule 3: every output is reviewed, verified and approved by a named person
The statement's three verbs are a good checklist. Reviewed means someone read it. Verified means someone checked the facts, citations and quotations against the source. Approved means someone with authority signed it off and stays accountable. Our AI citation hallucination sanctions tracker shows what happens when the second step is skipped.

Image: Pexels, used under the Pexels License.
Rule 4: one route for new tools and new uses
The judiciary sends every new use case, product or pilot to a single steering group that assesses "legal, ethical, operational, security and data protection issues before they can proceed." A five-person firm does not need a committee, but it does need one named owner who says yes or no, and a rule that nobody starts a new use on client data without that yes. This is the cheapest control against shadow AI.
Rule 5: start with low-risk tasks, train, and review on triggers
The judiciary piloted lower risk tasks first, trains through the Judicial College, and will change approved uses when "new pilots, evaluations, incidents or emerging risks make this necessary." For a firm, that means a starter list of low-risk tasks (summaries of documents you hold, transcription, first-draft chronologies), a short training session before anyone gets access, and a review whenever there is an incident or a new tool.
Copy-paste template: AI tool and use approval policy
Adapt the bracketed parts. Every line maps to a rule above.
[FIRM NAME] AI TOOL AND USE POLICY
Based on the structure of the UK judiciary's Position Statement on the
Judicial use of AI (October 9, 2026). Owner: [NAME]. Reviewed: [DATE].
1. APPROVED TOOLS
Only tools on the approved list may be used for client or firm work.
Approved list (tool, plan, approved by, date):
- ______________________
Minimum features for approval:
[ ] Data stored in [UK / named region], confirmed in contract or DPA
[ ] Business or enterprise terms; inputs not used for model training
[ ] Web access disabled for client matters
[ ] Accessed on firm devices and firm accounts only
2. DECISIONS
AI output may inform work. It does not decide advice, strategy,
settlement positions or what is filed. A named fee earner decides.
3. REVIEW BEFORE USE
Every AI output used in client work is:
[ ] Reviewed: read in full by the fee earner
[ ] Verified: facts, quotations and every citation checked
against the original source
[ ] Approved: signed off by [supervising lawyer], who is accountable
4. NEW TOOLS AND NEW USES
No new tool, plan, plug-in or use on client data starts without
written approval from [OWNER]. The owner checks: legal, ethical,
operational, security and data protection issues.
Requests go to: [EMAIL / FORM]
5. STARTER USES (low risk, approved now)
[ ] Summarising documents already on the matter file
[ ] Transcription of recorded meetings with consent
[ ] First-draft chronologies from documents we hold
Not approved without a new request: legal research answers,
drafting for filing, anything using a public chatbot.
6. TRAINING AND REVIEW
[ ] Training completed before access is granted
[ ] Policy reviewed every [6] months and after any incident,
new tool, or change in court or regulator guidance
[ ] Incident route: report to [OWNER] the same day
If you need a broader starting point that covers non-legal staff, our AI acceptable use policy template has the general version, and the CEO AI tool approval checklist covers vendor questions in more depth.
What the October 2025 guidance already says about lawyers
The position statement is about how the judiciary adopts AI. The guidance it complements is where judges are told how to treat what lawyers and litigants put in front of them, and it is the part most likely to come up in a hearing.

Screenshot: Artificial Intelligence (AI) Guidance for Judicial Office Holders, 31 October 2025, page 4, Courts and Tribunals Judiciary.
Four lines are worth putting in front of every fee earner:
- "All legal representatives are responsible for the material they put before the court/tribunal".
- "Provided AI is used responsibly, there is no reason why a legal representative ought to refer to its use, but this is dependent upon context."
- Judges may need to ask lawyers to "confirm that they have independently verified the accuracy of any research or case citations that have been generated with the assistance of an AI chatbot".
- Judges are warned about "white text", described as "hidden prompts or concealed text inserted into a document so as to be visible to the computer or system but not to the human reader."
The confidentiality section is blunt: "Do not enter any information into a public AI chatbot that is not already in the public domain." And turning chat history off does not fix it: "Even with history turned off, though, it should be assumed that data entered is being disclosed." If that is the standard for judges, it is a hard position for a firm to defend a lower one for client data.
What we do not know
- Which tools are approved. The statement deliberately does not list them, so there is no public product list to benchmark against.
- How "disabled web access" is checked. The statement names the feature but not how compliance is tested or logged.
- Whether disclosure rules for lawyers will change. The statement does not touch the position on lawyers referring to AI use. Any change would come through guidance, practice directions or the regulators.
- What the steering group will publish. It reviews the statement over time, but there is no stated schedule for updates or for reporting on pilots.
What people are saying
We found no Reddit or Hacker News thread about the statement itself as of October 12, 2026. The closest public discussion is an r/uklaw thread from October 8, the day before the statement, titled "How are we using AI?". It is about firm practice rather than the statement, but the comments land on the same three controls.
On confidentiality, one commenter wrote: "I don't feel comfortable putting large volumes of confidential and personal client data into a model". Another replied that this is not a concern with a "closed loop AI i.e. it doesn't interact with the open internet and preserves confidentiality", which is close to the judiciary's disabled web access and enterprise data protection test.
On checking, a third said: "The amount of checking I have to do when I use ai just increases my workload." That is the cost behind "reviewed, verified and approved", and it is why Rule 5 starts with tasks that are cheap to check.
Image: Unsplash.
Our take
The useful part of this statement is how little it says. There is no product list, no risk scoring matrix and no maturity model. There are three minimum features, one rule about who decides, three verbs for human review, and one route for anything new. That is a policy a small firm can actually run.
The three features are also a sharper vendor test than most firms use today. "Is it secure?" gets a yes from every sales team. "Where is our data stored, are we on business terms, and can web access be switched off for client matters?" gets an answer you can check in the contract.
The weak spot is the same for judges and firms: verification is where the time goes, and the statement does not say how much checking is enough. Write down what "verified" means for each starter task (for example, every citation opened at the source) rather than leaving it to individual judgement.
Embedded media
The statement page links only to the judiciary's general X account, and a search on October 12, 2026 found no post, video or webcast about this statement, so there is no embed in this article rather than one about a different story.
How we checked this
We read the position statement on judiciary.uk, the October 2025 guidance for judicial office holders (PDF, read with pdftotext), and the reports from Legal Futures and the Law Society Gazette, plus three comments in one r/uklaw thread: 7 sources, checked on October 12, 2026. Every quotation and date in this article maps to a row with a verbatim quote in our source log. Last reviewed: October 12, 2026.
Related Reading
- AI governance for law firms: privilege and compliance
- AI citation hallucination court sanctions tracker
- AI acceptable use policy template for small teams
- Shadow AI policy for small teams
- CEO AI tool approval checklist
- UK AI regulation in 2026: what applies after Brexit
- UK Law Commission: software and AI as products
- AI governance for general counsel and legal teams

