AI Adoption for UK Professional Services Firms: An Operating Model, Not a Tool Choice

Where Does AI Adoption Stand in UK Professional Services?

High in the national table, and shallow. In the ONS's June 2026 survey, about 46% of businesses in professional, scientific and technical activities reported using at least one AI technology, the third-highest of the 13 industries in its breakdown. About 6 in 10 of those adopters reported a single technology.

The figures come from Artificial intelligence in UK businesses: 2023 to 2026, published by the ONS on 20 July 2026 from its Business Insights and Conditions Survey. The survey is voluntary and its data are labelled official statistics in development, so read them as the best published measure rather than a census.

The category is also wider than "professional services" in the everyday sense. It holds solicitors, barristers, accountants, tax advisers, management consultants, architects, engineers and quantity surveyors, alongside research, advertising, design and veterinary practices. The survey leaves out finance and insurance altogether.

What does "shallow" mean in the figures?

The ONS's phrase is "relatively shallow". Its figures for businesses with 10 or more employees give the phrase its shape:

• About 1.6 AI technologies per adopting business, against about 1.4 in late 2023. The ONS's comment is that this "would imply relatively limited transformative impacts to date for most AI-adopting firms".
• Only 10% of AI-using businesses report using it extensively. 15% of businesses report that more than half of their employees use AI as part of their daily work.
• Only 11% report that more than half of their workforce has received AI-related training.

The survey has a limit that the ONS names itself: its headline measure "treats all reported uses as equivalent", so light use and embedded, production-level adoption both count as using AI.

How are professional firms getting their AI?

Among professional, scientific and technical businesses that reported using AI, or were unsure whether they did, 49.6% reported buying external software or ready-to-use services, 40.6% reported using free-to-use software, and 14.5% reported developing it in-house. Firms could give more than one answer.

What is holding firms back?

Across UK businesses, regulation is not among the barriers reported most often. 41% of businesses with 10 or more employees reported no barriers to adoption in the previous 3 months. Among the businesses that did report barriers, a lack of expertise was one of the most cited, and the ONS notes that "employee concerns, regulatory issues and product availability are less frequently reported barriers".

Those figures cover every surveyed industry, not professional firms alone, and they do not rule regulation out for any one firm. A regulated practice may still find its own rules the hardest part.

Earlier ONS analysis found the most commonly reported obstacles were difficulty identifying business use cases, cost, and a lack of expertise. Hold on to the first of those. It returns below.

Read as a practitioner, those figures say one thing to me: AI is in use, and among businesses with 10 or more employees about 1 in 10 of those using it reports using it extensively. A tool in use is not yet a system the firm runs.

What Do UK Regulators Actually Expect of a Firm Using AI?

The same thing in four accents: the duties a firm already carries apply in full, and accountability stays with the firm. The SRA, the FCA, the ICAEW and the ICO each work from outcomes or principles, and each says so in its own words.

Two are regulators of a profession, one of a market and one of a body of law, and their reach differs: the SRA regulates solicitors and law firms in England and Wales, while the FCA and the ICO are UK-wide.

The SRA: freedom to use AI, with accountability that does not move

On 17 August 2026 the Solicitors Regulation Authority published a warning notice, Misuse of AI. It sets out the permission early: "Our outcomes-focused approach means that firms have the freedom to use AI tools and adopt new ways of working, provided they ensure that they meet our standards."

Then the line that matters most: "AI has no separate legal personality; solicitors and regulated individuals who use AI in the course of delivering legal services remain accountable for their work and outputs, regardless of how that work has been prepared."

Two further passages turn that into something a firm has to build. Firms "must also have effective governance structures, systems and controls in place to manage any risks, including those arising from use of AI". And client information "should only be entered into AI systems where appropriate contractual, technical and organisational safeguards are in place to protect confidentiality".

The notice exists because of misuse the SRA has seen: unverified AI output reaching court documents, and confidential client information entered into public AI tools. The same notice says that "Many solicitors and law firms use AI safely and responsibly". The standard has not changed. The tools have.

One detail deserves a second look from any firm treating a paid licence as its whole answer. The SRA says that both paid-for and free-to-use AI tools "may not provide the contractual, and technical safeguards needed to maintain client confidentiality". The test is the safeguards, not the price.

The FCA: no extra regulations for AI

The Financial Conduct Authority's page AI and the FCA: our approach, last updated on 2 October 2026, is brief on the point: "We do not plan to introduce extra regulations for AI." It will rely instead on existing frameworks, "which mitigate many of the risks associated with AI".

It describes its approach as "principles-based and focused on outcomes", and gives the Consumer Duty and the Senior Managers and Certification Regime as examples of frameworks already in place. Of the second it says: "Our rules emphasise accountability for senior managers and are relevant to the safe use of AI."

For an FCA-authorised advice firm, my reading is that AI changes how a piece of work is produced, not who answers for it.

The ICAEW: judgement about reliance on technology

The Institute of Chartered Accountants in England and Wales revised its Code of Ethics with effect from 1 July 2025. Its own explanation of the technology changes describes them as "principles-based" and as applying "to all technologies".

Three of the changes bear directly on how an accountant uses AI, although the Code speaks of technology rather than naming it. Professional accountants must maintain a continuing awareness and understanding of technology-related developments relevant to their work. They must exercise professional judgement about whether reliance on the output of technology is reasonable. And they must take active steps to protect confidential information throughout the data governance cycle.

The ICO: the law does not use the word

The Information Commissioner's Office is the UK's data protection regulator, and data protection law applies to a firm that handles personal data whatever its profession. Its guidance on AI and data protection includes a useful fact: "Data protection law does not use the term ‘AI’, so none of your legal obligations depend on exactly how it is defined."

It asks for a risk-based approach: assessing the risks to individuals that may arise when you use AI, and "implementing appropriate and proportionate technical and organisational measures to mitigate these risks". It is equally plain about the limit: those requirements "may mean you have to stop a planned AI project if you cannot sufficiently mitigate those risks".

The page currently carries a notice that the guidance is under review following the Data (Use and Access) Act, so check the live version before relying on any detail.

Four bodies, one position

Set the four beside each other and, on my reading, the shape is the same: principles to follow and outcomes to meet, rather than a tool prescribed for the firm. That is not indifference to the tool. The SRA expects a firm to understand the safeguards a tool provides, the ICAEW asks whether reliance on its output is reasonable, and the ICO asks for the risks to be assessed.

All 4 bodies also point at duties the firm already carries. Between them, the 4 name competence, supervision, confidentiality, good outcomes for customers and accountability.

I would add that each statement presumes something about the firm. That someone knows which AI tools are in use. That someone has decided what client material may go into each. That work produced with AI is supervised as work. And that a named person answers for the output.

That set of presumptions is an operating model. The four bodies have described it without using the phrase.

What Is an AI Operating Model for a Professional Services Firm?

An AI operating model is the system a firm runs rather than the tools its people use: shared context and routines that survive any individual, the firm's judgement written down in a form a system can carry, and named owners who decide what runs without a human. Three kinds of work build it: reorganise, codify and govern.

Each verb meets one of the gaps above.

• Reorganise is aimed at shallow use. Workflows are redesigned around shared context, scheduled routines and reusable tools, so that a gain no longer lives in one person's account.
• Codify is what gives supervision something to work with. The firm's method, standards and checks are written down in plain text, so a reviewer can test AI-assisted work against a standard that exists outside one person's head.
• Govern is the part the SRA and the FCA name outright, as governance and accountability. In my framework it means named decision rights, a gate for sensitive material, a sign-off, and measurement before any return is claimed.

None of the three is a technology choice. The architecture underneath is a separate question, and I have mapped it in From the Web to the Workshop as 3 stages: AI in a browser tab, configured projects on a provider's platform, and an operating system the firm runs and owns.

The ONS figures cannot say which stage a firm is at: they record whether a technology is in use, and one technology can be used lightly or deeply. My hypothesis is that a good deal of the use they count is a browser tab, and it is only a hypothesis, because the survey does not test it. Either way, the step that changes the picture is not a better model. It is moving one recurring job up one stage, and then the next.

Which Work Should AI Carry, and Which Stays With People?

No recurring workflow is ruled out, and every one has an entry price. In an expert-led firm the work falls into 3 zones: automate friction at the back of expertise, augment judgement in the middle, and engineer trust at the front, where work reaches the client. The zone sets the standard of setup, never the eligibility.

That map is set out in full in Engineer Trust. It sits comfortably beside the SRA's 2023 Risk Outlook report on AI, which advises firms to use AI systems to speed up and automate routine tasks in support of human judgement, not in place of it.

The 3 zones turn that advice into a working rule:

• Zone 1, automate friction: necessary work that does not need senior judgement to produce.
• Zone 2, augment judgement: internal thinking that benefits from structured challenge, with a named professional owning the conclusion.
• Zone 3, engineer trust: work that reaches the client and carries the relationship, which asks for the heaviest setup and a senior reviewer for every output before it reaches a client.

For a regulated firm, the design intent is that the accountability question is answered workflow by workflow, in advance, instead of case by case under time pressure.

What Should a Firm's First AI Policy Contain?

One page, 3 lines. The tier line says which materials may go into which class of tool. The judgement line says what the firm automates freely, where AI assists under a named owner, and what it never delegates. The accountability line names who owns the system and keeps the page current.

I call that page the firm's AI doctrine, and it sits in front of whatever longer policy exists. The reason for one page is practical: a rule nobody has read governs nothing.

The SRA's 2023 report makes the case for writing it even in a firm that has adopted nothing: "Even if you have not adopted AI as part of your business, staff might still want to use ChatGPT or similar systems. You will need clear rules covering this."

The tier line is where the regulators' wording lands

Set the SRA's August 2026 notice beside a doctrine's tier line and they are after the same control. The SRA asks firms to satisfy themselves that client data "remains within a secure environment, is not accessed by unauthorised third parties, is not used to train AI models except where explicitly authorised and appropriate to do so, and is not retained longer than necessary".

In a working doctrine that becomes 4 plain levels:

• Public and non-confidential work goes into ordinary, firm-approved tools.
• Client and commercially sensitive material goes into an approved business-tier tool, with a data-processing agreement in place and the training-use and retention settings checked on the actual account.
• The most sensitive material stays inside a walled-off or local environment.
• A short never-list names what does not go near a general AI tool at all.

In my judgement, for a great many expert firms the second level carries most of the load: it is what makes the bulk of client work usable, subject always to what the firm's own client contracts and professional obligations require. A doctrine that pushes everything to the strictest level is not cautious. It is unused, and unused rules are how work drifts to personal accounts.

Where Should a UK Firm Start?

With what is already happening, not with a tool selection. Find the AI use that exists, write the one-page doctrine, map the recurring work into its zones, capture a baseline for the first job, and then move one job at a time. The order matters more than the speed.

1. Find the use that already exists. Ask, without blame, what people are using and for which tasks. The gap between the ONS's figure for people in work and its figure for businesses is the reason to ask before assuming the answer is "nothing".

2. Write the doctrine. It is designed for one working session with the managing partner and the right two colleagues. Decide the tier line first, because it is the one people need today.

3. Map the work before choosing tools. Place each recurring workflow in its zone. This also addresses one of the obstacles the ONS's earlier analysis found most often: difficulty identifying business use cases.

4. Capture a baseline before anything changes. Choose a job the firm repeats often and record how it runs today. That baseline is the one measurement that stops being observable once the system is in place. What to measure in the first 30 days covers the rest.

5. Move that job up one stage. Give it shared context and a named reviewer, and let the next job wait until this one passes the Handover Test: the team can run it without the person who built it.

Notice what is not on the list: a model comparison. In my view, which assistant the firm licenses matters less than whether the context, the standards and the routines belong to the firm. When a vendor's claim does need reading, 3 questions do the triage.

How Do You Choose Outside Help?

Ask 4 questions before any work starts: whose accounts the system will run from, whether the firm's method ends up as text the firm can read and move, what gets measured before a return is claimed, and at which tier client material will sit. An adviser building something the firm will own should be able to answer all 4 plainly.

• Whose accounts will it run from? A routine that still runs from the installer's login is not the firm's yet.
• Will our method be written down in a form we can read and move? Codified judgement in plain text stays readable and portable when the platform beneath it changes. A configuration that only the adviser understands may not.
• What will you measure before claiming a return? A baseline first, then an adoption signal. Be wary of an hours-saved figure produced from recall.
• At which tier will our client material sit? The answer should name the agreement, the settings and the person who checked them.

This is the work I do, and I run my own practice on the same kind of system. If your firm is deciding where to start, see how the engagements work and send a note about the workflow you would most like to change. The thinking continues in The AI Operating System, my fortnightly LinkedIn newsletter.

Frequently Asked Questions

Are UK professional services firms allowed to use generative AI on client work?

For law firms the SRA regulates, the published position is yes, within the duties that already apply. The SRA says firms "have the freedom to use AI tools and adopt new ways of working, provided they ensure that they meet our standards". The FCA does not plan extra regulations for AI, and the ICAEW's Code asks accountants to judge whether reliance on the output of technology is reasonable.

Other professions should read their own body's guidance, and a client contract can be stricter than any regulator.

Do we have to tell clients when we use AI?

For solicitors, the SRA's 2023 Risk Outlook report advises firms to tell clients when AI will be used on their case and how it will operate, and leaves the method to the firm. Its words: "How you do this is a decision for your firm to make, based on your specific circumstances."

The position may differ for other professions, so check your own body's guidance and your engagement terms.

Is a free AI tool acceptable for client work?

The question to ask is about safeguards, not price. The SRA's August 2026 notice says that both paid-for and free-to-use AI tools "may not provide the contractual, and technical safeguards needed to maintain client confidentiality".

In the ONS's June 2026 figures, 40.6% of professional, scientific and technical businesses that reported using AI, or were unsure whether they did, reported using free-to-use software. A doctrine's tier line is where a firm settles which tool is approved for which material.

Does a small firm need an AI operating model?

Yes, in proportion. For a small firm it can be one named owner, one page of doctrine and one recurring job moved properly, rather than a programme. The duties in this article do not shrink with headcount: the SRA describes its notice as "relevant to all firms and individuals we regulate".

What is the difference between an AI policy and an AI operating model?

A policy says what is allowed. An operating model is how the work actually runs. A firm can hold a careful policy and still have every gain locked in individual accounts, with nothing shared, codified or supervised as a system.

The policy belongs inside the operating model, as part of how it is governed. It does not replace it.

Dr Bruno Oliveira — PhD · Associate Professor, University of Bath. Founder of GustoMind.ai. Builds and installs AI operating systems for expert-led firms, running the same system daily in his own work.