33% of UK law firms in AspiraCloud’s early sector survey told us they’re unsure whether their current IT arrangements would satisfy the SRA if questioned.
That’s a third of respondents admitting they simply don’t know, not that they’ve checked and found gaps, but that the answer isn’t something anyone in the firm could confidently give.
That finding sits inside a wider research programme AspiraCloud is running across the UK legal sector, and it points to something practical rather than theoretical. Hybrid working has become standard practice at most firms, but the compliance thinking around it hasn’t always kept pace.
Why Hybrid Working Raises the Bar
The SRA doesn’t hold a separate rulebook for firms that work from home some of the time. Its expectations around confidentiality, competence, and supervision apply wherever the work happens.
That could be a partner’s office, a fee earner’s kitchen table, or a train carriage on the way to court. Hybrid working changes the practical picture in a few specific ways:
- Client data now sits in more places at once. Think office servers, home routers, personal laptops, cloud storage, and AI tools such as Copilot that can search across all of them.
- More devices touch sensitive information, and not all of them are managed or monitored by the firm.
- Supervision gets harder to see. A partner checking a junior colleague’s work in person can catch issues quickly. The same review, done remotely over email or a shared drive, is easier to skip or put off.
- Client conversations happen in more settings too, on trains, in cafes, and at home with family nearby, which increases the chance of something being overheard or seen on a screen.
Many firms built their IT and their policies around office-only working, back when everyone sat in the same building on the same network.
Hybrid working arrived fast, often faster than the policies meant to support it, and plenty of firms are still catching up in places. A firm that hasn’t looked at its systems and guidance since the shift to hybrid working is often working from assumptions that don’t quite match how the team operates day to day.
A Working Checklist: What Your IT Set-Up Should Be Able to Answer
Use this as a starting point for a conversation with your IT provider or with your own team if IT sits in-house.
- Does every device that touches client data have multi-factor authentication (MFA) turned on?
- Can staff only see the client files they’re working on?
- Do you know where client data sits when someone works from home?
- Do you know what client data an AI tool such as Copilot could surface if someone searched for it across your systems?
- Could a supervising partner review any piece of work, regardless of where it was done?
- Would hybrid staff be able to keep working securely if your office network went down?
- Could you produce a record of who accessed a client file and when, if asked?
- Is your hybrid working policy written down somewhere your whole team can find it?
If you answered “not sure” more than once, that tells you exactly where to start. The same is true for 33% of firms in our survey.
What This Means for Your Current Provider
Most firms we’ve spoken with already outsource some or all of their IT. The real question is whether your current provider is raising these points with you or waiting for you to ask.
A provider who understands legal practice should be bringing hybrid working and SRA expectations into their conversations with you as a matter of course, along with never considerations like Copilot governance. That means flagging gaps before they become a problem, rather than waiting for you to spot them yourself.
If your last conversation with your IT provider was about a printer or a slow laptop rather than compliance, that’s worth noticing.
Where an Informed Partner Helps
This is where a technology partner who understands legal practice earns their place. AspiraCloud brings direct experience of the sector to this kind of work:
- Worked alongside law firms and legal aid organisations across the UK, including presenting at Law Society events on legal technology and compliance
- Holds Microsoft’s Change Management and User Adoption competency, one of only two UK partners with that specialism
- Built a training and adoption approach specifically so that new policies and tools actually get used, rather than switched on and left
- Guides firms through Copilot and other AI rollouts, setting permissions and data boundaries correctly before anyone starts using them
- Understands that a workable hybrid working policy for a 30-person firm looks different to generic corporate guidance
Join the Conversation This October
AspiraCloud is bringing these findings, and the wider results from its legal sector research, to three roundtable events this October in London, Birmingham, and Manchester.
Each session brings managing partners and IT decision-makers together to discuss compliance, hybrid working, and data management in UK law firms, with AspiraCloud facilitating and the research setting the agenda.
Register your interest to secure a place at the event nearest you: [link to event sign-up]
FAQs
- What does the SRA expect from law firms around hybrid working?
The SRA doesn’t hold separate rules for hybrid working specifically. It expects firms to meet their existing obligations on confidentiality, competence, and supervision wherever the work takes place, whether that’s the office or a fee earner’s home. - Is my law firm’s IT compliant with SRA expectations?
There’s no single certificate that confirms this. The clearest way to know is to test your IT setup against practical questions around access, data handling, supervision, and audit trail, in the way covered in the checklist above. - What should a law firm’s hybrid working policy cover?
A proportionate policy typically covers device and access controls, guidance on where and how client data can be handled, a supervision process that works regardless of location, and a plan for keeping the firm running if systems go down. - How many UK law firms are confident their IT meets compliance expectations?
In AspiraCloud’s early sector survey, 33% of respondents told us they were uncertain whether their IT set-up would satisfy SRA scrutiny, particularly around hybrid working.
