Written by: Wiktor Stefański, Head of People & Operations, Digital Colliers
The SRA published its AI guidance in November 2023. Nearly three years later, if your insurer asks which drafts on the Henderson matter touched a generative tool, most firms cannot answer inside a week. Some cannot answer at all. That gap between having a policy and having a log is where the next round of professional indemnity questions is going to live.
A policy tells the world what you intend to do. A log tells the world what actually happened on a specific matter, at a specific time, by a specific fee earner. Insurers, regulators, and increasingly clients want the second one. The good news is that the data you need already exists inside your firm. It just isn't joined up yet.
The four data sources you actually need
A useful matter-level AI log is not one system. It is four streams, stitched to a matter ID. If any one is missing, the log has holes an underwriter will find.
- DMS events. Every document open, save, version, and export in iManage, NetDocuments, or SharePoint, with user and timestamp.
- Prompt and tool logs. The raw call records from Copilot, Harvey, a bespoke RAG stack, or whatever your fee earners actually type into. Prompt in, output out, model version, user, matter.
- Time entries. The narratives your fee earners write. This is where the ABA's 2024 opinion bites, since lawyers cannot bill hours that AI actually saved. Your time data has to be reconcilable against your tool logs.
- Reviewer approvals. Who signed off on the AI-assisted draft before it went out. A partner name, a timestamp, and ideally a diff of what changed between the AI output and the sent version.
None of this is exotic. All of it is already being written to disk somewhere. The work is the join, not the collection.
Why a policy without a log fails the insurer question
Renewal questionnaires are getting sharper. The pattern I keep seeing is that brokers no longer accept "we have an AI use policy" as a complete answer. They want evidence the policy is observed. That means samples. Show me the log for three random matters closed last quarter.
If you cannot produce that, two things happen. Premiums go up because the underwriter prices the uncertainty. And any future claim involving an AI-adjacent error becomes harder to defend, because you cannot demonstrate the standard of care you claimed to apply. The Stanford tracker maintained by Damien Charlotin logged court cases involving AI-fabricated citations rising from 87 to more than 1,300 across eleven months in 2024. Every one of those is a data point an insurer can reach for.
There is a billing dimension too. Clio's data has long shown that only about three of a lawyer's eight working hours get billed on an average day. If AI is quietly compressing the drafting hour, and your time narratives don't reflect that, you have both a regulatory problem under the ABA opinion and a client-trust problem the first time someone audits their bill against your tool logs.
What a minimum viable system looks like
You do not need a platform. You need a pipeline. Six months of work by two engineers and a records manager gets most mid-size firms to a defensible position.
- One matter ID, everywhere. Push it into DMS metadata, into your AI tool's user context, into time entry narratives. If the ID isn't on the record, the record is invisible to the log.
- A nightly join. Pull the four streams into one warehouse table keyed on matter and user. Parquet on S3 works. So does Postgres. Pick what your team already runs.
- A per-matter report. One page. Fee earner, tool, prompt count, documents touched, reviewer sign-offs, time entries. Generate it on demand for any open or closed matter.
- Retention that matches your PII policy. Seven years for most UK firms. Encrypt the prompt bodies at rest, since they will contain client confidential material.
The deadline is closer than it looks
EU AI Act Article 50 transparency obligations apply from 2 August 2026. If you act for clients with EU exposure, or you use tools whose vendors fall in scope, the log you build for the SRA is the same log you will need for Article 50 evidence. Firms that start now have roughly a build cycle and a testing cycle before that date. Firms that wait until Q1 2026 will be buying whatever is on the shelf, at whatever price the market decides.
Three years after the SRA guidance, the excuse of novelty is spent. The question is no longer whether you need a matter-level AI log. It is whether yours will be ready when someone asks to see it.