AI Policy: Responsible AI

This AI Policy sets out our approach to the development and deployment of artificial intelligence in Writford. It provides transparency about our practices and principles relating to AI, including compliance with applicable laws, responsible use, data handling, and safeguards.

Research Tool, Not Legal Advice

Writford is a research and drafting assistant. Its output is AI-generated and must be verified by a qualified solicitor before use.

Your Data is Never Used for Training

We contractually prohibit all AI model providers from training on your data. Your queries are processed, then discarded.

Transparency

Every AI response includes source citations. We label source authority levels so you can assess reliability.

Human Oversight Required

All AI output requires solicitor review. We do not make legal decisions or give legal advice.

1. Purpose and Scope

Writford provides AI-powered legal research and document drafting assistance for UK solicitors (England & Wales). The service is designed to accelerate legal research and produce draft documents. It does not replace professional legal judgment, provide legal advice, or make legal decisions.

2. AI Infrastructure

All AI features run on AWS in the UK region. We use a tiered set of commercial-grade large language models for different workloads (fast general-purpose responses, standard chat and document analysis, and deeper multi-step legal reasoning). Specific model identifiers and versions are internal to our deployment and may change as our providers release updates.

Inference takes place exclusively within the UK region. We do not route AI traffic to OpenAI, Google or any other model provider outside AWS.

3. Data Handling Principles

No training on your data: AWS is contractually prohibited from using your queries or content to train any foundation model.
How uploaded documents are handled: Digital PDFs, Word documents and plain-text files are parsed inside your browser, and only the extracted text reaches our servers. Scanned PDFs and images of paper are sent to our backend and processed by an AWS optical-character-recognition service in the UK region, then discarded. We do not retain the original file. Files selected via the Google Drive, OneDrive, or Outlook add-in connectors are handled identically — original file bytes are never written to long-term storage. See Sections 6–6C of our Privacy Policy for the full mechanism for each source.
No model-side retention: AI inference is stateless. AWS does not retain your prompt or the response beyond the request. Conversation history is stored only in our own database, in your account, and is governed by the retention rules in Section 11 of our Privacy Policy; you may delete any conversation at any time.
PII detection and anonymisation: Every chat message passes through an automated personal-data redaction filter before reaching the AI model. The filter detects common personal identifiers (names, UK National Insurance numbers, UK NHS numbers, email addresses, phone numbers, payment card numbers, addresses, IP addresses and similar) and replaces them with type placeholders before the model sees the message. If PII is detected, a notice is shown in the chat. This is a defence-in-depth measure; you should still apply data minimisation and avoid including unnecessary client identifiers in queries.
Matter data is not sent to AI: Matter management data (matter names, references, client and party names, descriptions, time entries, key dates, conflict records and collaboration details) is stored in our database and is not transmitted to any AI model. Only chat conversations are sent to the AI for processing.

Matter management and AI boundary: Matter metadata (names, references, dates, time entries, conflict records) is stored server-side in our UK-region managed database and never leaves that database for AI processing. The automatic PII detection and redaction described above applies to chat content only, not to matter data, because matter data is not processed by AI models. If you choose to copy matter information into a chat message, it will then be subject to the same PII detection and AI processing as any other chat message.

4. Accuracy and Limitations

Important: AI models can make mistakes. They may occasionally cite incorrect sources, misinterpret legislation, or produce inaccurate legal analysis. All AI output must be independently verified by a qualified solicitor before being relied upon or shared with clients.

Source citations: Every research response includes clickable citations to authoritative UK legal sources (legislation.gov.uk, National Archives Case Law, SRA guidance).
Source quality scoring: Sources are scored by authority level (legislation scores highest, followed by case law, then regulatory guidance, then web sources).
Strict citation rules: Our AI models are instructed to cite ONLY from provided sources and to explicitly state when sources are insufficient rather than generating unsupported claims.
Jurisdiction focus: Writford’s system prompts and source-retrieval pipeline are oriented toward English and Welsh law. Scottish and Northern Irish law may differ. Users should verify jurisdiction-specific points.
No hallucination guarantees: While we implement multiple safeguards, we cannot guarantee zero hallucinations. Professional verification is always required.

5. Safeguards

Prompt injection protection: We detect and block attempts to manipulate AI behaviour through injection patterns.
Input sanitisation: All user input is sanitised before processing.
Rate limiting: Per-user rate limits prevent abuse.
Audit logging: All AI interactions are logged for security and compliance purposes (metadata only, not query content).
DRAFT watermark: All exported documents include a “DRAFT: For Solicitor Review Only” watermark.
Disclaimer on every response: Every AI response ends with “AI-generated. Verify before relying on this.”

6. Human Oversight

Writford is designed to require human oversight at every stage:

The solicitor decides what to research or draft
The solicitor reviews all AI output
The solicitor verifies all citations against primary sources
The solicitor decides whether to use, modify, or discard the output
The solicitor bears professional responsibility for any work product shared with clients or submitted to courts

We do not make legal decisions, give legal advice, or determine the outcome of any legal matter. Writford is a tool. The solicitor is always in control.

7. Compliance

Our AI practices are designed to align with:

UK GDPR and Data Protection Act 2018
SRA Standards and Regulations (including Principles 2 and 7)
SRA Code of Conduct for Solicitors (paragraph 3.3: competence in use of technology)
Emerging UK AI regulatory framework

8. Changes to This Policy

We may update this policy as our AI practices evolve. Material changes will be communicated to users via email. The latest version is always available at this URL.

Contact

Questions about our AI practices: info@writford.co.uk

2. AI Infrastructure

Inference takes place exclusively within the UK region. We do not route AI traffic to OpenAI, Google or any other model provider outside AWS.

3. Data Handling Principles

No training on your data: AWS is contractually prohibited from using your queries or content to train any foundation model.

How uploaded documents are handled: Digital PDFs, Word documents and plain-text files are parsed inside your browser, and only the extracted text reaches our servers. Scanned PDFs and images of paper are sent to our backend and processed by an AWS optical-character-recognition service in the UK region, then discarded. We do not retain the original file. Files selected via the Google Drive, OneDrive, or Outlook add-in connectors are handled identically — original file bytes are never written to long-term storage. See Sections 6–6C of our Privacy Policy for the full mechanism for each source.

No model-side retention: AI inference is stateless. AWS does not retain your prompt or the response beyond the request. Conversation history is stored only in our own database, in your account, and is governed by the retention rules in Section 11 of our Privacy Policy; you may delete any conversation at any time.

PII detection and anonymisation: Every chat message passes through an automated personal-data redaction filter before reaching the AI model. The filter detects common personal identifiers (names, UK National Insurance numbers, UK NHS numbers, email addresses, phone numbers, payment card numbers, addresses, IP addresses and similar) and replaces them with type placeholders before the model sees the message. If PII is detected, a notice is shown in the chat. This is a defence-in-depth measure; you should still apply data minimisation and avoid including unnecessary client identifiers in queries.

Matter data is not sent to AI: Matter management data (matter names, references, client and party names, descriptions, time entries, key dates, conflict records and collaboration details) is stored in our database and is not transmitted to any AI model. Only chat conversations are sent to the AI for processing.

4. Accuracy and Limitations

Source citations: Every research response includes clickable citations to authoritative UK legal sources (legislation.gov.uk, National Archives Case Law, SRA guidance).

Source quality scoring: Sources are scored by authority level (legislation scores highest, followed by case law, then regulatory guidance, then web sources).

Strict citation rules: Our AI models are instructed to cite ONLY from provided sources and to explicitly state when sources are insufficient rather than generating unsupported claims.

Jurisdiction focus: Writford’s system prompts and source-retrieval pipeline are oriented toward English and Welsh law. Scottish and Northern Irish law may differ. Users should verify jurisdiction-specific points.

No hallucination guarantees: While we implement multiple safeguards, we cannot guarantee zero hallucinations. Professional verification is always required.

5. Safeguards

Prompt injection protection: We detect and block attempts to manipulate AI behaviour through injection patterns.

Input sanitisation: All user input is sanitised before processing.

Rate limiting: Per-user rate limits prevent abuse.

Audit logging: All AI interactions are logged for security and compliance purposes (metadata only, not query content).

DRAFT watermark: All exported documents include a “DRAFT: For Solicitor Review Only” watermark.

Disclaimer on every response: Every AI response ends with “AI-generated. Verify before relying on this.”

6. Human Oversight

Writford is designed to require human oversight at every stage:

The solicitor decides what to research or draft

The solicitor reviews all AI output

The solicitor verifies all citations against primary sources

The solicitor decides whether to use, modify, or discard the output

The solicitor bears professional responsibility for any work product shared with clients or submitted to courts

We do not make legal decisions, give legal advice, or determine the outcome of any legal matter. Writford is a tool. The solicitor is always in control.