Founding clients · 2026 Free 2026 guide: private AI in law — deployment, costs, evaluation and a 90-day plan. Read it → Ask about a founding place
// independent compliance assurance · private AI for law firms

Find the gaps before a reviewer does.

Two things keep UK firms awake in 2026, and we do both. The independent AML file review regulation 21 expects — twenty files, seven control areas, a named former MLCO signing every finding. And the AI problem: what your staff are actually using, what it does to privilege, and how to run a model inside your own perimeter when the client base will not tolerate anything else.

Send three files — free → Contact us →
No vendor payments, ever
S/01the AI practice

Three ways we deal with the AI your firm is already using.

Most firms arrive with the same three questions: what is actually in use, how do we run something private for confidential work, and how does anyone senior evidence oversight of a model they did not build. Those are three engagements — and none of them require you to believe a vendor benchmark.

The AI practice, explained →
private ai

Private AI deployment

Legal AI that runs inside your perimeter: models you control, retrieval over your own precedents with the permissions you already enforce, and an evaluation record built on your matters rather than a demo.

  • Readiness assessment · $3,000 – $4,000
  • Pilot on your own matters · $12,000 – $18,000
  • Full private deployment · from $23,000 – $45,000
  • Managed private model · $1,900 – $3,500 / month
Talk to us — scope and a fixed quote in writing, usually the same day.
training

AI training

Four sessions for the people who use AI, the people who supervise it and the people who answer for it. Scenario drills from findings in our own reviews, because behaviour changes when people practise the decision.

  • Fee-earner essentials, half day · $2,300 – $2,900
  • Role-based programme · $5,700 – $7,000
  • COLP / MLRO oversight · $1,500 – $2,000
  • Board & partner briefing · $1,200 – $1,600
Leaves a training record you can put in the insurer file.
audit

AI audit

The independent check on your AI control environment, mirroring what you already do for AML: what is in use, whether outputs are right and evidenced, and whether the governance actually works.

  • Shadow-AI use audit · $3,000 – $4,000
  • Output quality audit · $2,300 – $3,000
  • Annual governance audit · $4,500 – $6,000
  • Vendor diligence pack · $3,700 – $4,500
Findings reported by pattern and tool, never by name.
S/02why firms commission this

Most firms arrange an independent review after the event that needed reviewing.

Regulation 21 expects every firm to hold an independent audit of its AML controls — proportionate to the practice, and independent of the function being reviewed. Your COLP answers for its existence personally. Meanwhile the AI question has stopped being optional: the SRA's August 2026 warning notice on AI misuse is about supervision and evidence, and enterprise clients now ask about both in the same questionnaire.

The obligation

“When was your last independent AML file review?”

The question your insurer, your regulator or your largest client will eventually ask. The answer should be a dated report with a named reviewer on it — not a policy last touched in 2019 and a wish.

The blind spot
AI

Your fee-earners are using AI tools now — including ones they adopted without telling you. Each needs an assessment and a written rule, or it stays your name on the consequences. SRA warning notice · Aug 2026

The timing

Earlier is cheaper, calmer and fixable.

An adverse finding, a complaint, an SRA visit — reviews commissioned before those events read differently to everyone in the room.

The accountability

A named human signs the work.

The credibility bar isn't a nicer website. It is a senior reviewer you can speak to before you start, and an estimated range you can plan against.

The honest outcome

Findings — or proof of none.

If the review finds nothing, you keep written evidence of a clean independent review. Worth having on file either way.

S/03compliance services

Three engagements. Fixed quotes, agreed before anyone starts.

Each one ends as an artefact you can file — which is, in practice, the point of commissioning one. Tell us your firm's shape and we will send a scope and a fixed number in writing, usually the same day. No day rates, no scope creep, no surprises on the invoice.

Talk to us about scope & cost →
Founding places open
Core engagement

AML file review

Independent review of a sampled file set against the Money Laundering Regulations 2017, led by a former MLCO — the check regulation 21 expects and most firms postpone.

$3,700 – $4,500estimated range · 20 files · 5–10 working days
  • Seven AML control areas, checked per file to page level
  • Firm-level gap matrix — where weaknesses cluster
  • Risk rating with the reasoning, stated plainly
  • Remediation plan with named owners & dates
  • Board summary + methodology appendix
Contact us →
Fastest route in

DPIA & AI policy pack

Assess and govern the AI tools already in use across the firm — including the ones adopted quietly. Fixed fee, one week, and it usually surfaces the AML issues too.

$1,200 – $1,500estimated range · one week · one decision
  • Completed DPIA for each AI tool in use
  • Acceptable-use policy written for fee-earners
  • Vendor assessment questionnaire
  • Transparency & privacy notice wording
  • One-page staff guide
Contact us →
Ahead of scrutiny

AI governance readiness

A scored gap analysis against ISO/IEC 42001, and the artefact enterprise buyers ask for first: a complete AI system register. We prepare; accredited bodies certify.

$4,500 – $6,000estimated range · gap analysis · then roadmap
  • Annex A controls, scored and prioritised
  • AI system inventory & register
  • Risk assessment: likelihood, impact, treatment
  • Roadmap with effort and cost estimates
  • Optional full readiness pack
Contact us →
Recurring · AML

Annual audit + quarterly spot checks

Keeps the file in a state you can evidence on any given Tuesday. 30 days' notice to cancel.

$650 – $1,150 / month
Recurring · AI governance

AI governance retainer

Register upkeep, new-tool assessments, annual policy refresh as your AI use changes.

$1,250 – $2,500 / month
S/04the method

How a file set becomes a signed report — and how we would defend the method at Q&A.

Purpose-built pipeline for file-set analysis: the tooling performs the first pass at volume, a named specialist performs the QC and the sign-off. We will walk your compliance team through the ruleset and its limitations before you commission anything. That conversation is free, because our methodology is inspectable.

STEP 01

Secure intake

Encrypted transfer — never email attachments. Named-reviewer access, logged throughout, deleted on completion.

client + probative
STEP 02

Structured extraction

Every file parsed to the same fields: CDD, ID&V, SoF/SoW, PEP, risk rating, monitoring, retention.

tooling
STEP 03

Ruleset pass

MLR 2017 gap-check ruleset. Each observation carries rule, evidence pointer and confidence — nothing unnamed.

tooling
STEP 04

Human review & QC

The associate confirms, rejects or escalates every finding. Rejections stay visible in the trail.

former MLCO
STEP 05

Signed deliverable

Gap matrix, remediation plan, board summary — filed as evidence of independent review.

signed off
finding · aml-cdd-04 · anatomy SYNTHETIC
Severity · High #0142-e

Client identification incomplete

FindingOnboarding closed without evidence the client's identity was verified.
RuleMLR 2017 reg 28 — verification of identity
Evidencefile-0142.pdf, p.3 — ID record present, verification record absent
ConfidenceHigh
Human decisionConfirmed — reviewer satisfied the rule applies to this relationship.
the anatomy of an auditable finding

Every finding carries five fields. No exceptions, no black boxes.

This is the exact structure that ships in your report. Hover a field to see it light up on the specimen at left — a reviewer of the reviewer should be able to check any finding in two minutes.

  1. FIELD 01

    The finding

    A named, plain-English statement a human can act on — with a severity attached, never a shrug.

  2. FIELD 02

    The rule applied

    The regulation is cited, not paraphrased: MLR 2017, reg 28. If the rule does not apply, the finding dies here.

  3. FIELD 03

    The exact evidence

    File, page, what was present and what was missing — so the finding can be checked without re-reading the file.

  4. FIELD 04

    The confidence rating

    High, medium or low, stated for every automated observation. Uncertainty is information, not embarrassment.

  5. FIELD 05

    The human decision

    Confirmed, rejected or escalated by the specialist. Rejections stay in the trail — so you can watch the tooling being overruled.

A typical 20-file engagement, day by day

free proposal tooling + QC optional cover
D0 check
D1 findings + fixed proposalsame day
D2–D8 secure intake → extraction → ruleset pass → human QC
D10 signed report + walkthrough
quarterly spot checks · annual auditretainer
day 012345678910ongoing
Payment: 50% booking · 50% delivery Start: usually within five working days Free check: ~48 hours Files: deleted on completion, per the DPA
An opened file of redacted documents under soft daylight
Specimen working file — synthetic, redacted, marked
We do not ask you to trust a black box. We ask you to read the rule, open the page and check our arithmetic.
AI-assisted · Human-reviewed · Not legal advice

Every deliverable states its own limits: the sample basis, the ruleset version, the tools used and the findings the tooling got wrong. An audit that cannot discuss its weaknesses has not found them yet.

S/05the deliverable

Judge the deliverable, not the pitch.

We publish a complete synthetic AML audit report — fictional, clearly marked — so the decision is informed before it is made. Flip through specimen pages of the real structure below.

aml-audit-report · synthetic-example · v2.3
AML File Review — Summary ReportProbative Co · synthetic example · not a real firm
OVERALL ASSURANCELIMITED
CRITICAL · 210%
HIGH · 630%
MEDIUM · 945%
LOW · 315%
FileControlSevDecision
file-0142AML-CDD-04 · verificationHighconfirmed
file-0087AML-SOF-11 · source of fundsMedconfirmed
file-0203AML-PEP-03 · screeningHighescalated
file-0119AML-CDD-02 · EDD triggerMedconfirmed
file-0058AML-RET-07 · retentionLowrejected
file-0166AML-MON-05 · ongoing reviewHighconfirmed
Close verification backlog on existing relationshipsowner · MLRO · evidence: verification record absent on 6 files
due D+30
Adopt proportionate SoF/SoW thresholds by risk bandowner · Compliance partner · rule · MLR reg 28, and reg 33 where EDD applies
due D+45
Re-screen PEP-flagged relationships on register cadenceowner · Onboarding lead · escalated findings attached
due D+60
Migrate retention schedule into the DMS with legal-hold tagsowner · IT · replaces folder-based retention
due D+90
one-page board summary
LIMITEDassurance · 20 files · reviewed under MLR 2017
  • Weakness clusters in verification records and proportionate SoF evidence — systemic, and fixable inside a quarter.
  • No evidence of deliberate non-compliance. The findings are gaps in record-keeping and cadence.
  • Remediation plan agreed with named owners; next independent review scheduled in 12 months.
✍ signed · [Associate], former MLCO · INDEPENDENCE STATEMENT ATTACHED
SYNTHETIC · HUMAN SIGN-OFF
what ships

The same structure you would receive.

Overall assurance rating with the reasoning stated plainly. Findings by severity, the file-level matrix and the firm-level control matrix. A remediation plan that survives Monday morning — owners and dates. Every deliverable written to be filed as evidence, independence statement included.

  • →Per-file findings across all seven AML control areas
  • →Firm-level gap matrix — weaknesses by cluster, not anecdote
  • →Remediation plan: named owners, target dates, effort called honestly
  • →Board summary: one page your partnership can actually absorb
  • →Methodology appendix: ruleset, limitations, sample rationale
Request the full example report →
0 h
typical turnaround on the free 3-file check
0 tools found
undeclared AI tools across nine firms in our 2026 audits
0 %
of findings carry a stated rule, evidence pointer and human decision
0
certifications we issue — we prepare; accredited bodies sign off
S/06the AI tools index

We review the tools your fee-earners are already using.

Eighteen legal AI tools scored on the questions that end up in an incident report: where the data rests, whether privilege survives normal use, whether you can evidence what the tool did, and what the seat cost becomes in year two. Independent, unpaid, and published with its method — including the fact that no tool has earned our top tier yet.

Open the index ↗
Firm copilotsTier B · 78

Harvey — powerful, but where do your matters go?

Serious enterprise controls and a mature security posture, with an evidential trail on outputs that is still yours to build.

Reviewed Sep 2026read the review ↗
DraftingTier C · 64

Spellbook — the Word add-in trade-off, priced out

Brilliant in-document ergonomics and a thin audit trail. What that means for a firm that has to show its work.

Reviewed Sep 2026read the review ↗
Intake & AML2 reviewed

Onboarding automation, tested against reg 28

Two intake tools scored on the question that matters: does a human verification record survive the workflow?

Method publishedsee the category ↗
S/07free resources & the guide

Take the artefacts first. No demo call required.

Checklists, templates and the specimen audit report — plus the 2026 guide to running AI inside your own perimeter, which is the document we wished existed when firms started asking us about private models.

All free resources →
2026 edition · 14 sections

Private AI in law: the deployment guide

Three deployment archetypes, what private actually costs to run, retrieval that respects ethical walls, evaluating a model on your own matters, governance that survives an insurer's questions, a 90-day rollout plan and the ten failure modes we keep seeing.

Free · email delivery · Read it now →
Specimen deliverable

The full synthetic AML audit report

The complete structure: assurance rating, file matrix, control matrix, remediation plan and board page.

free · email
Template · open download

AI tool register

The first artefact enterprise buyers ask for, import-ready with one marked example row.

Download .csvfree · open
S/08insights

Field notes from the reading desk.

Written by the people doing the reviews — regulation unpacked, findings explained, tools interrogated. Nothing gated, nothing ghostwritten.

All insights →
AMLreg 28

Regulation 28 is not a photocopying exercise

The most common High-severity finding in our reviews: an ID copy on file and no evidence anyone verified it. What verification actually demands, and the twelve-minute count that sizes your exposure.

8 min · Sep 26read →
AI governance

The AI your staff installed — and the register that catches it

Most firms' real AI inventory lives in browser autocomplete and free-tier accounts. How to build the register enterprise buyers now ask for, before they ask.

6 min · Sep 26read →
Private AI

What the vendors' own model moves tell you

Legal AI's largest players started building proprietary models in 2026. What that signals for a firm choosing between public APIs, private tenancy and self-hosting.

9 min · Aug 26read →
the newsletter · the reg 21 brief

One email a month. What independent reviews actually find.

Anonymised patterns from live AML reviews and AI audits, the regulatory changes that matter to a 5–50 fee-earner firm, and new entries in the tools index. Written here, not by a content calendar.

See the archive and what you get →
No sales sequences. Unsubscribe in one click. Privacy notice.
S/09the practice

Named people, boxed evidence, and a list of things we will not do.

You will know who is on your engagement before it starts, and you can speak to them. Associates are independent specialists engaged by Probative Co for specific client engagements.

MD

Managing Director

Legal tech · AI governance

A decade building and deploying AI inside law firms — evaluation frameworks, document automation, intake, fee-earner training. Leads methodology, tooling and delivery.

AM

Associate — AML & Financial Crime

Former MLCO · 12 years

Legal-sector AML compliance across UK legal and professional-services firms. Leads audit methodology and technical review; signs off every finding before delivery.

PR

Associate — Privacy & Data Protection

CIPP/E

Leads DPIAs, AI risk assessments and data-governance work. Registered practice with the Information Commissioner's Office.

Insurance confirmed in writing — our professional indemnity and cyber liability position, with certificate wording and limits, comes to you in the procurement pack before any engagement starts.
Baseline controls, documented — encryption in transit and at rest, least-privilege access, retention and deletion schedule, written breach procedure.
Data protection, in writing — a written DPA with every client, retention & deletion schedule, documented breach procedure and a named person accountable for both.
Conflict check before every engagement — and an independence statement inside every report.

§ what we don't do Quoted here so nobody discovers it on invoice day.

  • We never certify. ISO/IEC 42001 certification comes from a UKAS-accredited body, independent of your consultant (ISO/IEC 17021-1).
  • We don't give legal advice. Compliance, technology and governance — none of this is a reserved legal activity.
  • We don't review firms we've advised. Independence is a recorded process per engagement, not a slogan.
  • We take no vendor payments. Not for tool reviews, not for referrals, not for hardware or models.
S/10questions

Asked by people who are personally accountable.

Q1Do you need to see privileged material?+
No more than is necessary, and we would rather not. We review AML and client-onboarding records — identification, verification, source of funds, risk assessment, retention. Privileged advice stays out of scope; we can work from a redacted set.
Q2Is this an AI tool reviewing our files?+
No. It is a professional review by a qualified specialist, with technology making it faster and more consistent. Every finding states the rule, the exact triggering evidence and a human decision — and rejected findings stay in the audit trail.
Q3Can you certify us to ISO/IEC 42001?+
No, and nobody who advises you should. Certification requires a UKAS-accredited body independent of your consultancy. We prepare the management system and the evidence pack; they certify.
Q4We already use a commercial AI tool. Is that enough?+
It depends on your client base. Enterprise terms reduce the disclosure surface; they do not remove the transfer. Firms with confidential or regulated clients usually need a private layer for the sensitive work and a governed policy for everything else. We will tell you plainly which you need — including when the answer is “a policy pack and nothing more”.
Q5What does the free check cost us, really?+
Three files and twenty minutes. We review them the way a reviewer would and you keep the findings either way — commission nothing and nothing else happens.
Q6How quickly can you start?+
Usually within five working days. The free 3-file check is typically turned around in 48 hours; AI audits and training within two to three weeks.
// start here

Send three files.
We'll tell you what a reviewer would flag.

  • No charge and no obligation — you keep the findings either way
  • Turned around in ~48 hours, encrypted transfer only
  • Most firms find at least one issue they did not know they had
Book the free 3-file check → Talk to us about cost Or write to — replies usually the same day.