Cross-examining AI: Liability for AI harms and SRA’s warning notice on AI

WEBVTT
00:00:08.080 --> 00:00:17.839
Hello and welcome to the fourth episode of Cross Examining AI, HSF Kramer's podcast on disputes and AI, where we unpack the key developments that are shaping litigation.
00:00:18.000 --> 00:00:23.920
I'm Camilla McPherson, a knowledge lawyer in our dispute resolution practice with a particular interest in AI.
00:00:24.079 --> 00:00:34.640
And today I'm joined by banking litigation partner Emma Dees and Will Glassy, a partner in our commercial litigation practice with a focus on professional negligence and professional disciplinary claims.
00:00:34.960 --> 00:00:35.920
Welcome to you both.
00:00:36.159 --> 00:00:41.840
Emma's going to start by giving us an overview of the UK JT statement on liability for AI harms.
00:00:41.920 --> 00:00:54.000
After that, Will's going to be taking us through the SRA's recent warning notice on AI and talking about the first case from the Solicitors Disciplinary Tribunal where a lawyer has been struck off for misuse of AI.
00:00:54.399 --> 00:01:05.760
Emma, following a public consultation earlier in the year, the UK Jurisdiction Task Force recently published the final version of its legal statement on liability for AI harms under English law.
00:01:06.000 --> 00:01:10.000
Can you start by reminding us what the UKJT is and what it aims to do?
00:01:10.319 --> 00:01:20.319
So the UKJT is an industry-led body that in essence promotes the use of English law as the jurisdiction of choice for technology and digital innovation.
00:01:20.560 --> 00:01:27.280
It has previously published legal statements on crypto assets, smart contracts, and digital securities.
00:01:27.680 --> 00:01:29.680
These statements don't create new law.
00:01:29.840 --> 00:01:34.799
They're intended to be authoritative statements on how existing law applies to new areas.
00:01:35.359 --> 00:01:37.680
So what's the focus of this latest statement?
00:01:38.480 --> 00:01:42.640
It basically grapples with one of the most difficult questions in the AI space.
00:01:42.879 --> 00:01:51.920
And that's whether and in what circumstances those who have not set out to deliberately cause harm may be liable for harms resulting from the use of AI.
00:01:52.640 --> 00:01:58.959
So the focus of the statement is on tortious liability, and within that, most attention is given to negligence.
00:01:59.280 --> 00:02:07.120
The UK JT says that contract is likely to be the foundation for many and maybe most commercial relationships arising from AI.
00:02:07.280 --> 00:02:11.520
But where there is a contract, the starting point will be what that contract says.
00:02:11.840 --> 00:02:15.360
The greater legal complexity is therefore likely to lie in tort.
00:02:16.560 --> 00:02:19.120
What would you say is the overall message of the statement?
00:02:20.319 --> 00:02:29.759
So the UKJT's key message is that English law is flexible and has frequently accommodated novel and disruptive technological developments.
00:02:30.000 --> 00:02:40.319
So the point there is that the law has shown it can provide certainty and predictability in the face of technological innovation and it's therefore broadly well equipped to deal with the question of AI liability.
00:02:41.199 --> 00:02:48.560
Okay, thinking first about negligence, how does the UKJT say that the duty of care analysis works in an AI context?
00:02:49.439 --> 00:02:54.159
Essentially, the UK JT say it's a matter of applying established legal principles.
00:02:54.719 --> 00:03:01.199
So this means establishing foreseeability, proximity, and whether it's fair, just and reasonable to impose a duty.
00:03:01.840 --> 00:03:06.080
In many AI scenarios, that analysis may be pretty straightforward.
00:03:06.479 --> 00:03:09.919
Where it gets complicated is likely to be further up the supply chain.
00:03:10.560 --> 00:03:17.919
For example, do foundation model developers owe a duty of care directly to end users with whom they have no contractual relationship?
00:03:18.639 --> 00:03:23.439
The statement doesn't rule it out, but this may be one of those areas where for now we just have to wait and see.
00:03:24.319 --> 00:03:28.000
What does the statement have to say about professionals using AI?
00:03:29.120 --> 00:03:31.280
The statement's particularly interesting in this area.
00:03:31.520 --> 00:03:40.159
It says that a professional's duty of reasonable skill and care extends to their use of AI, and that the standard required is likely to evolve as time goes on.
00:03:40.479 --> 00:03:51.039
So a professional could be found negligent for things like using AI inappropriately, using an unsuitable model, failing to verify outputs, or failing to be transparent with clients about AI use.
00:03:51.439 --> 00:03:53.360
But the UK JT goes further.
00:03:53.680 --> 00:03:57.360
It says a professional could be liable for failing to use AI at all.
00:03:58.080 --> 00:04:00.240
Lawyers are particularly interested in this, of course.
00:04:00.400 --> 00:04:08.719
And in fact, one of the examples in the statement is of a solicitor failing to advise their client that it may wish to consider some form of AI-assisted tool in document review.
00:04:09.439 --> 00:04:10.400
What about causation?
00:04:10.560 --> 00:04:12.960
Does AI create any particular difficulties here?
00:04:13.599 --> 00:04:18.959
The UKJT say that the standard but for test should generally work in the AI context.
00:04:19.040 --> 00:04:23.279
And for many claims, the analysis will be, again, pretty straightforward.
00:04:23.680 --> 00:04:28.639
But again, the statement acknowledges that this gets trickier as you move further up the supply chain.
00:04:29.199 --> 00:04:40.720
If you're trying to establish that a foundational model developer was negligent, you face the black box problem of perhaps not really understanding the workings of the model or how or why it did what it did.
00:04:41.040 --> 00:04:48.319
As agentic AI takes off, this may become even more difficult, although expert evidence may be able to help unravel the complexities.
00:04:48.959 --> 00:04:55.519
We're still at the very beginning of this part of the AI journey, and I think we should anticipate parties looking to push the boundaries of what might be possible.
00:04:55.920 --> 00:04:56.959
Yeah, I agree with that.
00:04:57.360 --> 00:04:59.199
What else does the statement have to say?
00:05:00.079 --> 00:05:01.920
Much, much more than we can cover today.
00:05:02.160 --> 00:05:03.360
It's a big document.
00:05:03.600 --> 00:05:09.439
But to pick up a couple of things, there's an in-depth section on liability for false statements by AI chatbots.
00:05:09.680 --> 00:05:15.680
It also considers a question of whether a developer can be liable when a bad actor deliberately misuses their AI.
00:05:16.000 --> 00:05:30.160
Finally, there's a nod to the possibility of contributory negligence as a route to reducing damages, with the UK JT taking the view that a non-commercial user of AI would generally be less likely to be found contributory negligent than a commercial user.
00:05:30.480 --> 00:05:33.519
Although, again, this is all going to depend on the factual context.
00:05:34.240 --> 00:05:35.519
Okay, so there's a lot in there.
00:05:35.680 --> 00:05:36.720
What isn't covered?
00:05:37.279 --> 00:05:40.480
Well, as I said at the beginning, the statement isn't about contract.
00:05:40.560 --> 00:05:42.240
It's focusing on tort.
00:05:42.800 --> 00:05:53.279
So economic torts, competition claims, and the interaction between AI and IP rights, data protection, and the use of AI by public authorities are all out of scope as well.
00:05:53.680 --> 00:05:54.000
Brilliant.
00:05:54.160 --> 00:05:58.000
Thanks so much, Emma, for that overview of what is a pretty weighty document.
00:05:58.399 --> 00:05:59.839
Now it's over to you, Will.
00:06:00.000 --> 00:06:03.759
We've talked before on the podcast about the dangers of AI hallucinations.
00:06:03.839 --> 00:06:10.240
And I understand that the SRA has now published a warning notice focusing on this and client confidentiality issues.
00:06:10.639 --> 00:06:12.000
That's right, Camilla.
00:06:12.319 --> 00:06:18.319
The SRA has received, it says, 42 reports of potential AI misuse.
00:06:18.879 --> 00:06:22.240
That's in the 12 months to July of this year.
00:06:22.480 --> 00:06:25.199
And a number of their investigations are ongoing.
00:06:25.439 --> 00:06:31.920
They cover inaccurate legal citations, supervision failures, and confidentiality breaches.
00:06:32.160 --> 00:06:38.319
And against that backdrop, the SRA has identified two key areas of concern.
00:06:38.560 --> 00:06:44.639
The first is false or incorrect information being submitted to the court or included in other documents.
00:06:44.800 --> 00:06:53.920
So that's the hallucination risk, where AI generates fictitious cases, fictitious references, or factual assertions with no basis.
00:06:54.240 --> 00:07:04.560
The second is maintaining client confidentiality, and in particular, the risks of entering client data into AI tools that lack the necessary safeguards.
00:07:04.879 --> 00:07:07.759
So what are the key risks from the regulator's point of view?
00:07:08.160 --> 00:07:17.680
The way the SRA sees it is that from a client's perspective, relying on fabricated authorities can lead to fundamentally flawed advice.
00:07:17.839 --> 00:07:26.240
And from a court's perspective, all this causes delay as well as undermining the integrity of the process more widely.
00:07:26.399 --> 00:07:31.199
And then there's the damage done to public trust and confidence in the legal profession.
00:07:31.519 --> 00:07:33.519
Okay, so that's the hallucination side.
00:07:33.600 --> 00:07:36.079
What are they saying about client confidentiality?
00:07:36.480 --> 00:07:47.439
In short, they say that using public AI tools with confidential client information, quote, will likely breach client confidentiality.
00:07:47.519 --> 00:07:52.399
And as a result, legal professional privilege may be permanently waived.
00:07:52.800 --> 00:08:04.800
And this reflects an immigration decision in the upper tribunal earlier in the year, where a lawyer said that he had entered client letters and home office decision letters into open source AI.
00:08:05.040 --> 00:08:13.279
The tribunal commented that this could breach client confidentiality and could therefore lead to a loss of legal professional privilege.
00:08:13.680 --> 00:08:17.600
So, what does the SRA say solicitors and firms should actually be doing?
00:08:18.079 --> 00:08:26.720
The key message from the SRA is that it's the regulated individual using the AI or supervising that user who is responsible.
00:08:26.959 --> 00:08:31.040
In practical terms, the SRA recommends four things.
00:08:31.279 --> 00:08:38.000
First, firms have effective governance structures and systems to manage the risks arising from AI.
00:08:38.159 --> 00:08:44.240
Then, secondly, solicitors should ensure that all case law authorities they submit are genuine and relevant.
00:08:44.559 --> 00:08:50.000
Third is the importance of effective supervision of junior and non-authorised colleagues.
00:08:50.159 --> 00:08:58.320
And fourthly, client information is only to be entered into AI systems with appropriate safeguards to protect confidentiality.
00:08:58.639 --> 00:09:11.120
That last point may be particularly important for in-house solicitors, because AI tools developed by a commercial enterprise may not have been designed with the safeguards required for legal work.
00:09:11.519 --> 00:09:11.840
All right.
00:09:14.639 --> 00:09:16.559
Do you think it goes far enough?
00:09:17.440 --> 00:09:25.679
It goes, it's a welcome step, but it really only addresses two risks at the moment: hallucinations and confidentiality breaches.
00:09:25.919 --> 00:09:30.320
And these are already well understood by much of the profession.
00:09:30.879 --> 00:09:35.759
As AI becomes more sophisticated, the range of risks will widen as well.
00:09:36.000 --> 00:09:46.879
And notably, the SRA hasn't said yet that it's going to amend its handbook, that is, the principles or the code of conduct to regulate AI directly.
00:09:47.200 --> 00:09:55.200
For now, the SRA's warning notice suggests that they are comfortable that the existing regulatory framework is sufficient.
00:09:55.360 --> 00:10:10.240
So, for example, the long-standing confidentiality obligation under paragraph 6.3 of the Code for Individuals, or the existing obligations concerning duties to the court under section two of the code for individuals, those haven't changed.
00:10:10.320 --> 00:10:14.480
The new warning notice doesn't seek to amend or supplement those.
00:10:14.639 --> 00:10:25.519
It remains to be seen, though, whether the SRA will continue to adopt that position or whether they'll seek to introduce AI-specific rules under the Code of Conduct.
00:10:25.919 --> 00:10:40.240
You mentioned that the responsibility is firmly on the lawyer to get things right when they're using AI, and that's a neat segue into your next topic because a lawyer has recently been struck off for misuse of AI, and I believe that's in part another hallucination case.
00:10:40.480 --> 00:10:50.000
Now, we've seen a lot of court judgments about hallucinations that show that the court has a wide range of powers available to ensure that lawyers comply with their duties to the court.
00:10:50.159 --> 00:10:56.799
The things like public admonition, wasted cost orders, striking out a case, and even contempt proceedings.
00:10:57.120 --> 00:11:02.639
Seems to me reading of these judgments that referral to the regulator is also pretty standard practice.
00:11:02.799 --> 00:11:07.759
In some cases, the referral coming from the court, and in some cases the lawyer referring themselves.
00:11:07.919 --> 00:11:13.440
I guess we now might have some insight into how the solicitor's disciplinary tribunal might respond.
00:11:13.840 --> 00:11:14.320
Yes.
00:11:14.559 --> 00:11:26.399
Some of these cases will be trivial and won't call for SRA involvement, but there is a good example of a particularly egregious case in the SRA's prosecution of Mr.
00:11:26.559 --> 00:11:33.679
Kuma in the Solicitor's Disciplinary Tribunal, which came to a trial and judgment in the tribunal in August of this year.
00:11:33.919 --> 00:11:40.240
The respondent was a registered foreign lawyer who was facing two allegations of misconduct.
00:11:40.480 --> 00:11:49.519
The first related to a crime which he'd been convicted for in 2024 for knowingly employing someone without the right to work in the UK.
00:11:49.759 --> 00:11:52.639
The second, though, related to his use of AI.
00:11:52.879 --> 00:12:12.720
In defending his conduct of the immigration charge, but not in the court, not in the criminal court, but before the SRA itself, he had filed documents with the SRA containing what the SRA said and the tribunal found were misleading references to legal authorities, basically AI hallucinations.
00:12:13.200 --> 00:12:15.919
Was this a one-off mistake or did it go further than that?
00:12:16.320 --> 00:12:17.840
Oh, it went much further.
00:12:18.320 --> 00:12:29.279
After the SRA had identified the problem, the respondent sent an email admitting that he'd used AI in his first submissions and purporting to correct the errors.
00:12:29.519 --> 00:12:36.320
The problem was that that email itself was drafted using AI and contained further false material.
00:12:36.480 --> 00:12:44.240
So having been put on notice of the AI errors, the respondent repeated that mistake rather than taking steps to rectify it.
00:12:44.559 --> 00:12:50.000
Now I think this is the first time a lawyer's use of AI in legal proceedings has come before the tribunal.
00:12:50.159 --> 00:12:51.679
How did it approach the case?
00:12:52.000 --> 00:13:06.080
The solicitor's disciplinary tribunal drew heavily on the decision in Ayundai and Harangay, the landmark judgment of Dame Victoria Sharp, who was then the president of the King's Bench Division on the use of AI.
00:13:06.240 --> 00:13:17.200
And in Ayundai, she made it clear that lawyers who use AI for legal research have a professional duty to check for accuracy against authoritative sources.
00:13:17.440 --> 00:13:38.960
The tribunal noted that the president in that case also pointed out that there are serious implications for the administration of justice and public confidence in the justice system if AI is misused, and that every individual providing legal services needs to understand and comply with their professional and ethical obligations when they're using AI.
00:13:39.279 --> 00:13:42.480
And are there any broader points you think are worth pulling out?
00:13:42.799 --> 00:13:44.080
Yes, a couple.
00:13:44.480 --> 00:13:56.720
First, the tribunal confirmed that there's no distinction in principle between misleading material sent to a regulator, a disciplinary tribunal, or a court, the same professional duties apply.
00:13:56.960 --> 00:14:07.519
Secondly, the tribunal said that this is ultimately about a lawyer's fundamental duty in litigation and to the court as to the accuracy of materials produced to the court.
00:14:07.840 --> 00:14:12.399
AI was the medium through which the erroneous material was produced in this case.
00:14:12.559 --> 00:14:20.799
But the same issue could arise in using search engines or where work was produced by someone else for whom the lawyer had ultimate responsibility.
00:14:21.120 --> 00:14:27.120
And did it make a difference that the respondent in this case was a registered foreign lawyer rather than a solicitor?
00:14:27.519 --> 00:14:36.480
No, it didn't make any difference that he was an RFL, and it didn't make a difference that he wasn't in practice by the time he was referred to the tribunal.
00:14:36.639 --> 00:14:45.440
The tribunal said he had been a regulated individual when he provided the services, and he was obliged to comply with the standards of his profession.
00:14:45.840 --> 00:14:47.600
All right, let's talk about the sanction.
00:14:47.759 --> 00:14:49.759
The strike-off order was at the top end.
00:14:49.840 --> 00:14:52.240
How did the tribunal reach that decision?
00:14:52.720 --> 00:14:56.879
The tribunal were unsparing in their criticism of Mr.
00:14:57.039 --> 00:14:57.679
Kumar.
00:14:58.399 --> 00:15:08.000
On the AI allegations, the tribunal found very high culpability, stressing that a lawyer is always responsible for the accuracy of their output.
00:15:08.159 --> 00:15:17.600
And in this case, the respondent had used AI without giving proper thought to the consequences and failed to take proper steps to ensure its accuracy.
00:15:17.840 --> 00:15:22.960
The repetition of the misconduct after being put on notice was given substantial weight.
00:15:23.279 --> 00:15:32.399
Harm was assessed as high, with the tribunal describing it as a cardinal duty of a solicitor not to mislead a court or a tribunal.
00:15:32.799 --> 00:15:40.960
And crucially, I understand that the tribunal said the AI misconduct alone would have been enough for a strike-off without the separate immigration issue.
00:15:41.360 --> 00:15:41.840
That's right.
00:15:42.000 --> 00:15:48.240
The tribunal was clear that it would have imposed the same sanction, the strike-off, for either allegation alone.
00:15:48.399 --> 00:15:54.080
So the AI-related misconduct was serious, uh, sufficiently serious to warrant the strike-off.
00:15:54.720 --> 00:15:57.679
And that's a significant marker for the profession.
00:15:58.080 --> 00:16:01.360
What would you say are the key takeaways for the profession going forward?
00:16:01.759 --> 00:16:05.840
Okay, well, we'd emphasise three things coming out of the tribunal's judgment.
00:16:06.080 --> 00:16:14.799
First is the cardinal nature, and that's the tribunal's own expression, of a lawyer's duty in litigation and to the court.
00:16:15.039 --> 00:16:26.399
Secondly, the tribunal gave substantial weight to the repeated nature of the misconduct, essentially doubling down on AI-generated errors after being put on notice.
00:16:26.559 --> 00:16:30.080
It's the repetition which made it particularly egregious.
00:16:30.320 --> 00:16:42.240
The respondent had lacked insight into what he'd done wrong in the first place when it came to corresponding with the SRA about that and repeating his use of AI hallucinations.
00:16:42.720 --> 00:16:51.600
Thirdly and finally, the tribunal expressly referred to publicly available SRA guidance on conduct in disputes.
00:16:51.840 --> 00:17:01.919
The bottom line is that lawyers should now be very much on notice of the risks of AI-generated legal research, and ignorance is unlikely to be a defence.
00:17:02.240 --> 00:17:03.279
Thanks so much, Will.
00:17:03.360 --> 00:17:10.240
It'd be interesting to see if we get more decisions like this as time goes on and the tribunal works through these various referrals.
00:17:10.480 --> 00:17:12.880
That's all for this episode of Cross-Examining AI.
00:17:12.960 --> 00:17:17.759
I'd like to thank Emma and Will for joining me, and I hope listeners have found the discussion helpful.
00:17:17.920 --> 00:17:22.000
There are links to more information on all of the topics covered in the show notes.
00:17:22.160 --> 00:17:27.359
Do please subscribe to the podcast and get in touch if you have ideas for topics you'd like us to cover in the future.
00:17:27.519 --> 00:17:29.119
Thank you and goodbye.