Executive Summary
- Munir confirms a professional checking obligation that applies whatever introduced an error. A lawyer cannot avoid responsibility by attributing false authorities to a junior colleague, an old precedent or an AI system. The tribunal declined a duplicate referral in one matter and referred the supervising solicitor in the other. Neither outcome constituted a disciplinary conviction. (Munir, [19], [37], [56].)
- Citation checking has three cumulative components: the authority must exist, be locatable using its citation and support the attributed proposition. The current UTIAC1 form expressly requires certification of these matters. Its new wording followed the pleadings considered in Munir; the earlier conduct engaged existing professional duties. (Munir, [9], [29], [39]–[40], [59]; UTIAC1 (07.26), section 11.)
- Delegating work leaves the responsible lawyer accountable for appropriate supervision. Munir's criticism concerned unchecked work, uncertain authorship and an inability to identify other affected files. It does not prohibit junior drafting or establish automatic misconduct whenever a subordinate makes a mistake. (Munir, [37]–[38], [42]–[56]; CILEX and others v Mazur and others [2026] EWCA Civ 369 Rev 1, [187](v)–(vii).)
- An upload can breach client confidentiality without making information publicly accessible. Loss of privilege requires an additional, document-specific assessment. A product name, payment plan or description as an open or closed system cannot replace examination of the actual terms and data handling. (SRA Code of Conduct for Solicitors, RELs, RFLs and RSLs, paragraph 6.3; Candey Ltd v Bosheh [2022] EWCA Civ 1103, [122]; SRA, Misuse of AI warning notice, 17 August 2026, Client confidentiality.)
- Personal data breach reporting has statutory thresholds. Controllers generally notify the data protection regulator within 72 hours of awareness where feasible, unless risk to individuals is unlikely. Communication to affected individuals has a higher risk threshold and specified exceptions. Munir's broad reporting language does not remove those conditions. (UK GDPR, Articles 33–34; Munir, [21], [60].)
- Effective remediation includes correcting the submission, preserving reliable evidence of what happened and assessing other affected work. Regulatory reporting must respect the client's privilege. Later authorities reinforce the need to verify statutory text and explanations of an error, as well as case citations. (Munir, [47]–[56]; Cork v Smith [2026] EWHC 1199 (Ch), [71]–[78], [94]–[95]; Carter-Ruck Solicitors v SRA [2026] EWHC 2416 (KB), [2].)
The two referral decisions and their procedural limits
Munir is a professional-conduct decision arising from two different proceedings. The anonymised appellant UK sought permission to appeal from the First-tier Tribunal. Fiza Munir sought permission for judicial review of immigration decisions. The panel heard the matters on 15 October and 5 November 2025 and promulgated its decision on 17 November 2025. The official repository published it on 19 February 2026, which explains the 2026 neutral citation. (Munir, heading and [10]–[11], [22]–[29]; Upper Tribunal official publication record.)
The tribunal exercised its Hamid jurisdiction, the procedure used to examine lawyers' conduct before it. Its statutory position as a superior court of record and its specified incidental powers support that jurisdiction. Section 25 does not confer every High Court power for every purpose. Here the tribunal sought explanations and considered professional referrals arising from the proceedings before it. (Tribunals, Courts and Enforcement Act 2007, sections 3(5), 25(1)(a), 25(2)(c); Munir, [2]–[4].)
In UK, Tahir Mohammed accepted responsibility for citing a nonexistent case using the citation of an unrelated equal-pay judgment. He was an Immigration Advice Authority adviser and also held a solicitor's practising certificate. On 14 October 2025, he reported himself to the IAA and the Solicitors Regulation Authority. The panel therefore made no additional referral, while stating that it would otherwise have referred him. Its decision avoided duplication; it did not absolve the checking failure. (Munir, [11]–[19].)
Munir's solicitors filed judicial review proceedings on 26 June 2025, after refusal of her Graduate Route application and administrative review. The tribunal refused permission on 20 August 2025. It separately required an explanation of inaccurate authorities in the grounds. The professional-conduct judgment expressly omits the reasons for refusing permission. It therefore establishes neither that the citation errors caused that refusal nor that properly drafted grounds would have succeeded. (Munir, [22]–[29].)
Zubair Rasheed was the firm's compliance officer for legal practice, or COLP. His name appeared on the claim form and its statement of truth. He acknowledged inadequate checking of grounds drafted by his brother. The panel accepted his previously unblemished fifteen-year record and genuine regret. It nevertheless referred him to the SRA because of the false citations, supervision failures and concerns about his evidence. The regulator retained the decision about further action. (Munir, [30]–[36], [42]–[56].)
This procedural distinction determines how the case should be used. A referral identifies concerns warranting investigation. Any disciplinary finding, contempt conviction or personal costs order requires its own decision and applicable conditions. Munir itself ended with one additional referral and no determination of those further liabilities. (Munir, [19], [56]–[60].)
What checking an authority requires
A submission can mislead even when the cited case name resembles a genuine authority. In Munir, some references corresponded to actual Upper Tribunal decisions but supplied High Court or Court of Appeal citations. The grounds also attributed propositions that the decisions did not establish. Treating every reference as a wholly invented case would obscure these distinct failures. (Munir, [29], [39]–[40].)
Rasheed argued that real authorities supported the underlying propositions. The panel rejected that response because the submitted references sent the judge searching for the wrong decisions. A later replacement authority can help repair an argument; it cannot make the original attribution accurate. That distinction also protects the opponent's ability to understand and answer the case actually advanced. (Munir, [37], [39]–[40].)
The current judicial review form converts these functions into an express certification. Section 11 of UTIAC1 requires the representative to confirm that an authority exists, can be found through its citation and supports its attributed proposition. All three conditions must be satisfied. Finding a case with the same name meets only part of that task. A correct quotation also needs its surrounding reasoning, exceptions and procedural setting. (UTIAC1 (07.26), section 11; Munir, [9], [59].)
HMCTS records the addition of the certification on 6 November 2025. Both sets of grounds in Munir preceded it. The panel's findings therefore rest on the professional obligations applicable to the earlier conduct, rather than a retrospective application of the amended form. The current form also contains a separate warning about false statements made without honest belief. That warning does not turn every mistaken citation into established contempt. (HMCTS, Apply for a judicial review in an immigration or asylum case, update of 6 November 2025; Munir, [9], [25]–[27]; UTIAC1 (07.26), section 11.)
Source authentication must extend to the legal reasoning. An accurate extract can still concern a different statutory version, a different issue or an argument rejected by the court. The professional must identify the rule, determine its applicability and justify the inference drawn from it. Licentium's discussion of quotation accuracy and completeness examines the related problem in statutory research. (Munir, [29], [39]–[40]; R (Ayinde) v London Borough of Haringey; Al-Haroun v Qatar National Bank QPSC [2025] EWHC 1383 (Admin), [7]–[9], [87].)
What the evidence establishes about AI use
The checking failure does not depend on proving which technology generated the error. In UK, Mohammed initially denied using an AI model to draft the grounds. He later accepted that he could not explain the false authority and suggested inadvertent use of Google AI Mode. The tribunal described that account as his best guess and recorded his conclusion that AI involvement was probable. (Munir, [12]–[17].)
The product chronology limits that explanation. The grounds were dated 17 March 2025. Google announced its AI Mode experiment on 5 March 2025 and its UK rollout on 28 July 2025. The later UK rollout does not establish the representative's access, location or search interface in March. It does mean that the description of ordinary UK AI Mode use cannot simply be accepted as a proved historical mechanism. (Munir, [12], [16]; Google, Expanding AI Overviews and introducing AI Mode, 5 March 2025; Google Search Introducing AI Mode in the UK, 28 July 2025.)
The judges themselves obtained inconsistent invented judicial panels when querying Google AI about the false case. Their experiment demonstrated the system's ability to generate a plausible false answer at that time. It did not reproduce the historical search that produced the filed reference. This evidential limit supplies no defence to the admitted failure to verify the authority. (Munir, [16]–[18].)
The second matter has a different record. Rasheed initially attributed the problem to an old precedent, blogs and personal notes; paragraph 52 records his acceptance of AI-generated false citations. The panel's decisive finding concerned responsibility for unchecked work, whatever its source. An investigation should preserve those distinctions instead of using a plausible technical explanation as proof of authorship. (Munir, [32], [37], [52]–[54].)
Supervision and lawful delegation
Rasheed's responsibility followed from his conduct of the case and supervision of its preparation. The person initially described as a trainee lawyer was later described as a very junior caseworker, rather than a trainee solicitor. The tribunal questioned his suitability for drafting judicial review grounds and the failure to review his work before filing. Kinship did not supply evidence of competence or replace professional supervision. (Munir, [36]–[38], [42]–[45].)
The panel also examined the reliability of the firm's records. Rasheed could not identify who completed the claim form using his name. A spreadsheet he produced lacked the relevant case entry, and his explanations of deletion dates changed. He could not reliably identify the other matters on which his brother had worked. These findings supported concern about the extent of the problem, rather than a proved numerical finding of further defective cases. (Munir, [47]–[54].)
The same facts explain why the mitigation failed. The panel accepted regret and an otherwise unblemished record. It found that the material offered to explain the family difficulties did not substantiate the relevant period of failed supervision. Uncertain accounts of other work and the purported precedent weakened the assurance that the problem was isolated. The referral rested on that combined assessment. (Munir, [45], [52]–[56].)
The SRA's individual Code makes supervisors accountable for work carried out through them and requires effective supervision and competent staff. The firm also needs functioning supervision systems and evidence of compliance. A COLP's additional responsibility concerns reasonable steps to secure compliance and required reporting. These duties overlap but attach to distinct roles. (SRA individual Code, paragraphs 3.5–3.6; SRA Code of Conduct for Firms, paragraphs 2.1–2.3, 4.3–4.4, 9.1.)
Munir states that a supervisor's failure is likely to be more culpable because it also harms junior development. The qualification matters. The SRA's supervision guidance recognises that negligence does not invariably establish inadequate supervision. Appropriate arrangements depend on the work, risk, experience and available supervisory capacity. Munir's findings justify its particular referral; they do not create an automatic penalty multiplier for every supervisor. (Munir, [38], [58]; SRA, Effective supervision, updated 12 June 2026, Purpose of this guidance, Key themes and Enforcement.)
Current appellate law also permits genuine delegation. In CILEX and others v Mazur and others, the Court of Appeal held that an unauthorised person can perform litigation tasks for an authorised individual. The authorised individual must retain responsibility and appropriate direction, management, supervision and control. Merely naming a solicitor cannot establish those conditions. This later ruling concerns the lawfulness of delegation; it does not reverse Munir's findings about the supervision actually provided. ([2026] EWCA Civ 369 Rev 1, [187](v)–(vii), [198].)
Immigration judicial review adds a forum-specific requirement. The appointed representative must have authority to conduct High Court litigation; rights of audience are addressed separately. IAA accreditation for immigration advice cannot simply be treated as equivalent to those entitlements. (Tribunal Procedure (Upper Tribunal) Rules 2008, SI 2008/2698, rule 11(5A)–(5B).)
Duties applying to immigration advisers
IAA regulation supplies professional obligations independently of SRA regulation. The 2024 Code prohibits knowingly or recklessly misleading specified recipients, including courts and tribunals. It separately requires competent advice, current knowledge and confidentiality. A failure of competence therefore requires examination even when deliberate deception has not been established. The mental-state element in the misleading provision must still be proved when that provision is alleged. (IAA Code of Standards 2024, codes 1.2, 4.2–4.5.)
The tribunal expressly applied Ayinde's approach to false material to IAA advisers. Its suggestion that the IAA consider specific AI guidance was conditional. The operative duties did not depend on the prior publication of a dedicated AI notice. Mohammed's dual professional status also explains why his reports went to two regulators; it does not mean every immigration adviser is subject to the SRA Code. (Munir, [13]–[20].)
The SRA's warning notice of 17 August 2026 provides current guidance on AI use. It addresses verification, supervision and confidentiality through existing professional duties. Its publication after the conduct in Munir should be kept distinct from the commencement of the underlying Codes. Neither the judgment nor that notice requires a universal prohibition on professional use of AI. The tribunal expressly recognised benefits when trained professionals use appropriate legal tools. (Munir, [18]; SRA, Misuse of AI warning notice, Status and Use of AI in legal services.)
Confidentiality and the actual AI service
The tribunal's confidentiality observations require attention, but their scope differs from its referral holdings. Mohammed admitted uploading Home Office decisions for summaries and using ChatGPT to improve client emails. The panel had already announced that it would make no duplicate referral before questioning him about those uses. Paragraph 21 then described uploads as public disclosure, breach of confidence and waiver of privilege; paragraph 60 repeated a categorical warning. (Munir, [15]–[16], [19], [21], [60].)
Those observations were not a determination of a contested privilege claim over identified documents. The panel did not apply a document-by-document privilege test or decide the operation of particular service terms. Its warning remains a material statement from a reported tribunal decision. Applying it to another upload nevertheless requires the legal conditions for confidentiality and privilege to be established. (Munir, [15]–[21], [60]; Candey, [122].)
A solicitor must protect current and former clients' affairs unless disclosure is legally required or permitted, or the client consents. Unauthorised disclosure to a service provider can engage that duty even if no member of the public sees the information. Conversely, a service's availability to the public does not establish that every user's inputs become publicly available. Those are different factual questions. (SRA individual Code, paragraph 6.3.)
The current SRA notice asks firms to examine contractual, technical and organisational safeguards. It addresses access, retention and training, and warns that paid services can also be unsuitable. A defensible procurement decision therefore concerns the particular service, account, enabled features and permitted uses. The judgment's reference to Microsoft Copilot cannot operate as approval of every service bearing that name. (SRA, Misuse of AI warning notice, Client confidentiality; Munir, [21].)
OpenAI states that data from its covered business services is excluded from model training by default. Microsoft's enterprise documentation distinguishes protected prompts and responses from web-search queries and directs users to examine agents' terms. These are provider descriptions of specified services and features. Exclusion from training does not itself establish absence of storage, human access or a disclosure risk. (OpenAI, Enterprise privacy, updated 8 January 2026, Our commitments; Microsoft, Enterprise data protection in Microsoft Copilot and Microsoft Copilot Chat, Enterprise data protection for prompts and responses, Privacy and security of web queries, and Agents in Microsoft Copilot.)
The strongest argument for the tribunal's language is precautionary: loss of control can expose highly sensitive client material. That supports restricting uploads until the service has been assessed. It does not establish a universal factual equivalence between sending data to a provider and publishing it to the world. The recommended control is to approve a defined configuration and authorised use, with access and retention restrictions that match the information involved. (SRA, Misuse of AI warning notice, Client confidentiality; UK GDPR, Articles 5(1)(c), 5(1)(f), 28, 32.)
Privilege requires its own legal analysis
Legal professional privilege protects qualifying material against compelled disclosure. Legal advice privilege generally requires a confidential lawyer-client communication for the dominant purpose of obtaining or giving legal advice. Litigation privilege can extend to communications involving third parties where the requirements concerning adversarial litigation and dominant purpose are met. Neither category follows merely from describing a file as confidential. (R (Jet2.com Ltd) v Civil Aviation Authority [2020] EWCA Civ 35, [42], [96]; Director of the Serious Fraud Office v Eurasian Natural Resources Corporation Ltd [2018] EWCA Civ 2006, [64].)
The identity of the adviser matters for legal advice privilege. The Supreme Court declined to extend that common-law privilege generally to professional advisers outside the legal profession. IAA regulation alone therefore does not confer that privilege on every advisory exchange. Litigation privilege remains a separate possibility under its own conditions. Mohammed himself was a solicitor, so treating him as a non-lawyer adviser would misstate this case. (R (Prudential plc) v Special Commissioner of Income Tax [2013] UKSC 1, [17]–[19], [29], [51]–[52]; Munir, [15].)
A Home Office refusal letter does not acquire privilege simply because it reaches a solicitor or is uploaded with legal instructions. Existing documents require separate assessment from privileged covering communications. A lawyer's explanation of the decision can engage legal advice privilege, subject to the normal requirements. The tribunal's reference to client letters and decision letters therefore covered categories that need different analysis. (Jet2.com, [107]; Sports Direct International plc v Financial Reporting Council [2020] EWCA Civ 177, [52]–[55]; Munir, [16], [21].)
Disclosure also needs examination of its scope. In Candey, the Court of Appeal recognised that disclosure for a limited purpose can preserve confidentiality against wider use. The relevant information need not enter the public domain merely because a recipient has seen it. Applied by analogy, a tightly restricted processing arrangement is legally different from unrestricted public dissemination. That analogy does not certify a particular AI arrangement as privileged; its force depends on the actual restrictions and permitted access. (Candey, [122].)
Equally, a confidentiality term cannot create privilege where the original communication never qualified. Using a secure research tool within a lawyer's work also differs from a person independently asking an AI service for advice. In an extrajudicial speech on 22 April 2026, the Chancellor of the High Court recognised that distinction and questioned whether secure use by a lawyer should affect client privilege. He also cautioned that confidentiality cannot be assumed. The speech is a judicial contribution to the debate, without the precedential force of a judgment. (Prudential, [29], [51]–[52]; Sir Colin Birss, Legal professional privilege in the Age of AI, [22]–[26].)
The correct approach to Munir is therefore conditional. Identify the protected communication, the holder of the privilege, the reason for disclosure and the recipient's permitted use. If disclosure destroys the necessary confidentiality or effects a waiver, protection can be lost. Where confidentiality and a legally effective limitation remain, the fact of AI processing alone does not establish a general waiver. (Jet2.com, [42], [96]; Candey, [122].)
Personal data and reporting thresholds
An AI upload involving personal data must be assessed under data protection law alongside professional duties. Processing through another organisation can be lawful when the applicable conditions are met. Where the provider acts as a processor, Article 28 requires appropriate arrangements and written processing terms in a binding contract or other domestic legal act. Firms must also address lawfulness, data minimisation, security and any applicable conditions for sensitive data or international transfers. Client agreement alone does not displace those requirements. (UK GDPR, Articles 5–6, 9, 28, 32, 44A.)
A personal data breach involves a security breach leading to accidental or unlawful destruction, loss or alteration of personal data, or unauthorised disclosure of or access to it. An upload is not automatically a breach merely because it involves a third-party system. If the disclosure or use exceeds the lawful and authorised arrangement, a breach assessment becomes necessary. A firm's selection of a confidential service does not itself settle every data protection obligation. (UK GDPR, Article 4(1), point (12).)
Article 33 requires a controller to notify the regulator without undue delay and, where feasible, within 72 hours of awareness. The exception applies where a breach is unlikely to result in risk to individuals' rights and freedoms. A processor must notify its controller without undue delay. The controller must document the breach, its effects and remedial action even where regulator notification is unnecessary. The statutory test therefore requires an assessed incident and risk, rather than a label attached to the tool. (UK GDPR, Article 33(1)–(2), (5).)
Communication to affected individuals has a different threshold: the breach must be likely to result in high risk. The controller must communicate the breach without undue delay. Article 34 provides exceptions for appropriate protective measures applied to the affected data, particularly those making it unintelligible to unauthorised people, or for later measures ensuring the high risk is no longer likely to arise. Where individual communication would involve disproportionate effort, an equally effective public communication or similar measure is required. These conditions prevent the 72-hour regulator rule from being misapplied as a universal deadline for notifying clients. (UK GDPR, Article 34(1)–(3).)
Munir advised consultation with the Information Commissioner's Office in paragraph 21 and used broader referral language in paragraph 60. Sensible consultation can precede certainty about notification. Mandatory reporting remains governed by the statute. The professional obligation to explain material mistakes to clients can also operate independently of Article 34's threshold. (Munir, [16], [21], [60]; UK GDPR, Articles 33–34; SRA individual Code, paragraph 7.11.)
Regulatory response costs and corrective action
Professional referral does not require proof of contempt. Ayinde treats referral as likely appropriate where unchecked false citations are placed before the court. It separately distinguishes negligence from the mental state required for contempt. Its response factors include the explanation, remedial steps, expense and effect on the proceedings. An honest mistake can therefore warrant investigation while falling short of contempt. (Ayinde, [24], [26], [29].)
Upper Tribunal costs orders require their own statutory basis. In Upper Tribunal judicial review, rule 10 permits costs orders; wasted costs are governed by section 29 of the 2007 Act. The latter requires the statutory connection between costs and improper, unreasonable or negligent conduct. The tribunal must allow representations before making an order. Its rules impose different limits in proceedings arriving from another tribunal, so the judicial review route cannot simply be applied to every immigration appeal. (Tribunals, Courts and Enforcement Act 2007, section 29(1)–(5); Upper Tribunal Rules, rule 10(1), (3)(a), (3)(c), (7).)
Munir describes possible additional judicial review costs caused by wasted time; it does not itself make a quantified costs award. Nor does its referral establish compensation for the client's underlying immigration outcome. Those limits preserve the distinction between identified defective work, wasted expenditure and any claimed loss of an otherwise successful case. (Munir, [29], [37], [56].)
The SRA's reporting rules concern facts reasonably believed capable of amounting to a serious breach and matters warranting regulatory investigation. IAA reporting provisions separately address indications of serious misconduct. Neither scheme should be rewritten as an automatic requirement to report every typographical error. The scale of the failure, client exposure and reliability of the response matter. (SRA individual Code, paragraphs 7.7–7.8; IAA Code of Standards 2024, codes 2.3–2.4.)
Reporting must also respect client privilege. In Carter-Ruck Solicitors v SRA, the High Court held that a notice under section 44B of the Solicitors Act 1974 cannot compel client-privileged material without waiver. The SRA's guidance records an ongoing appeal. That decision concerns the specified production power, rather than a general exemption from reporting misconduct. A firm should separate reportable facts from protected communications and address any consent or lawful disclosure route. ([2026] EWHC 2416 (KB), [2]; SRA, Reporting and notification obligations, updated 23 October 2026, Legal Professional Privilege.)
Corrective explanations need the same factual discipline as the original filing. Cork concerned fabricated statutory wording and a later misleading account of the error. The court examined the roles of supervisors and the junior lawyer separately. It accepted completed notifications as sufficient to avoid its own duplicate referral, while requiring the judgment to reach the regulator. Generating an account of what probably happened cannot replace examination of the actual working records. (Cork, [71]–[78], [89]–[95].)
Controls that address the failures identified in Munir
A practice responding to Munir should assign responsibility for each stage of a filing. The record should identify the drafter, source checker, supervising lawyer and person authorised to approve and submit it. The supervisor should be able to retrieve the approved version and the basis for its legal propositions. These are recommended methods of meeting the duties identified in the decision, rather than a prescribed form of record imposed by the judgment. (Munir, [36]–[38], [47]–[54]; SRA firm Code, paragraphs 2.1–2.3, 4.4.)
The checker should open the underlying judgment or provision, confirm the identifier and read the relevant passage in context. The review should record the applicable date, authority level, material exceptions and any later treatment affecting the proposition. A second review must test the rule's application to the facts. Repeating the first draft's conclusion, or asking a model whether it is confident, does not perform those functions. (Munir, [29], [39]–[40]; Ayinde, [7]–[9], [87].)
Work allocation should match the junior's competence and the supervisor's available time. A supervisor's absence needs a replacement review arrangement or an adjustment to the work accepted. Staff also need to recognise AI features embedded in search and office software. A written ban that ignores the tools actually available does not address the failure described in Munir. (Munir, [42]–[46], [58]; IAA Code of Standards 2024, code 5.6; SRA, Effective supervision, Key themes.)
When an error appears, the firm should stop further use of the affected precedent, preserve the relevant evidence securely and check linked matters. Deleting the source before establishing its use can obstruct that investigation. Preservation should be limited to what the investigation and legal obligations require, with controlled access and a defined retention review. That addresses the evidential failure identified by the tribunal without creating an unrestricted archive of client prompts. (Munir, [47]–[54]; UK GDPR, Articles 5(1)(c), 5(1)(e), 5(1)(f).)
The firm should then correct the court record through the applicable procedure, tell affected clients what has happened and assess each reporting obligation separately. Its explanation should distinguish established facts, recollection and inference. It should identify what has actually been corrected and the remaining files requiring review. The regulator can then assess the conduct on an accurate record, while the court and client receive work that a responsible professional has checked. (Munir, [19], [53]–[58]; SRA individual Code, paragraph 7.11; SRA firm Code, paragraph 9.1.)