The sample report
The full audit report, run on a fictional law firm. The firm is invented so that no client is exposed; every statement about a vendor’s terms is real and dated.
26 September 2026
26 September 2026
What the audit found at Sample Firm LLP.
Sample Firm LLP, a fictional London law firm, 18 people. The scan found 14 AI systems in use, 12 of them never approved by anyone. The register below lists each one and the client data that passed through it. The PDF adds the five findings that matter most, the thirty-day roadmap and the coverage statement.
Every AI tool in the firm, and what passed through each.
Register of AI systems in use
| System | Client data passing through | Approved |
|---|---|---|
| ChatGPT, personal accounts | Matter summaries, draft letters, attendance notes | Not approved |
| Otter.ai, personal accounts | Client call transcripts, including family matters | Not approved |
| DeepL Translator, free | A will and correspondence with a French notaire | Not approved |
| AI sidebar, browser extension | Every page viewed, including the case management system | Not approved |
| Grammarly, free extension | Everything typed in the browser, including Outlook and Clio | Not approved |
| Microsoft Copilot, personal accounts | Draft client emails, lease extracts | Not approved |
| Read.ai meeting notes | Meeting summaries emailed to every attendee | Not approved |
| Docusign AI, default settings | Signed engagement letters, transfer deeds | Not approved |
| Apple Writing Tools with ChatGPT | Client emails rewritten on the phone | Not approved |
| Claude, personal account | Research questions containing client facts | Not approved |
| JAX in Xero | Office account ledgers | Not approved |
| Canva Magic Studio, free | Newsletters; no client data found | Not approved |
| Microsoft 365 Copilot Chat, firm sign-in | Documents inside the firm’s tenancy | Approved |
| Clio Duo, firm licence | Matters, documents and billing inside Clio | Approved |
Sample Firm LLP, a fictional London law firm. Illustrative: the firm is invented. Vendor terms checked on 16 September 2026.
How the sample was made.
- Sample Firm LLP is invented: its people, its findings and its numbers. It exists so you can see the full report before telling us anything about your own firm.
- Every statement about a vendor’s terms is real, taken from the vendor’s own published pages and checked on 16 September 2026.
- A client report is produced the same way: a discovery questionnaire, then a scan of connected apps, browser extensions, twelve months of card statements, mailbox vendor invitations, meeting tools, AI built into existing software, and phones.
- Each system is scored against UK GDPR, the DPA 2018 and ICO guidance, as at the assessment date. Legal conclusions in a client report are reviewed by an independent solicitor or data protection officer.
The same register, for your firm.
Twenty minutes on a call gives you a one-page snapshot of the likely leakage points. The audit produces the full register in two weeks, at a fixed price.