{"schema_version":"0.10.0","id":"LR-2026-0435","record_version":1,"title":"Solicitor faces probe after putting client documents into ChatGPT","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":45.6,"score_breakdown":{"source_authority":12.1,"independent_corroboration":7.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":3.0,"completeness":2.24,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"preliminary","reason":"Publisher not yet named · subject to change","original_document":null,"reports_total":1,"reports_independent":0,"reports_derivative":0,"developing":false,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"preliminary","reason":"Publisher not yet named · subject to change"}]},"sources_hash":"a071b882db91c98656a35cb41986a9dbd1cbdeffe15319294e25556a42814cd9"},"system":{"model_name":"ChatGPT","model_version":null,"developer":"unknown","harness":null,"tools_granted":[],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":null,"safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-02-24","incident_class":"privacy_leakage","failure_class":null,"agent_involved":null,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"unknown","summary":"A solicitor at a Manchester immigration firm, Tahir Mehmood Mohammed, told the Upper Tribunal that he had put client emails about Home Office decisions into ChatGPT to improve them, and had uploaded Home Office decision letters to summarise them for clients. A fake case name also appeared in one of his applications for permission to appeal, and he could not say how. He accepted that he should have checked it. He said he now realises this is a data breach and will tell the clients, the IAA and the SRA. The tribunal said it would have referred him to both regulators had he not already self-reported. The Upper Tribunal's ruling, published after a November decision, warned lawyers against putting client documents into public AI tools.","tags":[],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":null,"failure_class_detail":null,"responsible_party":null,"adversarial_actor":null,"input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":null},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"moderate","severity_because":"Test: data of others touched with a bounded scope stated. Client emails and Home Office decision letters of the solicitor's clients were uploaded; no record count is stated.","harm_class":[],"affected_description":null,"protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://www.legalfutures.co.uk/latest-news/solicitor-faces-probe-after-putting-client-documents-into-chatgpt","publisher":"Legal Futures","date":"2026-02-24","type":"press","title":"Solicitor faces probe after putting client documents into ChatGPT - Legal Futures","archived_url":null,"attachment":"first_report"}],"per_field_confidence":{"system.model_name":"C","event.incident_class":"D","impact.severity":"D","impact.severity_because":"D","event.summary":"C","system.autonomy_level":"D","system.deployment_context":"D","event.trigger":"D","event.detection_method":"D","context.country":"D","system.developer":"D","event.date_disclosed":"D","context.denominator_available":"D"},"field_citations":{"system.model_name":[{"source_index":0,"quote":"Whilst he was clear that ChatGPT was not used to create grounds of appeal, Mr Mohammed said he had put client emails he had drafted explaining Home Office decisions into ChatGPT to try to improve them, and also uploaded Home Office decision letters to summarise them for clients."}],"event.incident_class":[{"source_index":0,"quote":"The Upper Tribunal has warned lawyers against putting client documents into ChatGPT and other open-source AI tools after a solicitor admitted doing so."}],"impact.severity":[{"source_index":0,"quote":"Whilst he was clear that ChatGPT was not used to create grounds of appeal, Mr Mohammed said he had put client emails he had drafted explaining Home Office decisions into ChatGPT to try to improve them, and also uploaded Home Office decision letters to summarise them for clients."}],"impact.severity_because":[{"source_index":0,"quote":"Whilst he was clear that ChatGPT was not used to create grounds of appeal, Mr Mohammed said he had put client emails he had drafted explaining Home Office decisions into ChatGPT to try to improve them, and also uploaded Home Office decision letters to summarise them for clients."}],"event.summary":[{"source_index":0,"quote":"The Upper Tribunal has warned lawyers against putting client documents into ChatGPT and other open-source AI tools after a solicitor admitted doing so."},{"source_index":0,"quote":"Whilst he was clear that ChatGPT was not used to create grounds of appeal, Mr Mohammed said he had put client emails he had drafted explaining Home Office decisions into ChatGPT to try to improve them, and also uploaded Home Office decision letters to summarise them for clients."},{"source_index":0,"quote":"The first case concerned Tahir Mehmood Mohammed, who is a solicitor but also regulated by the Immigration Advice Authority (IAA) at Manchester firm TMF Immigration Lawyers."},{"source_index":0,"quote":"Mr Mohammed was unable to say how the fake case name, which was attached to the citation of an unrelated employment law case, appeared in his application for permission to appeal."},{"source_index":0,"quote":"He accepted that he should have checked it."},{"source_index":0,"quote":"He informed us that he now realises that this is a data breach and will inform the clients that he has done this, as well as the IAA and the SRA [Solicitors Regulation Authority]."},{"source_index":0,"quote":"The tribunal said it would have referred Mr Mohammed to both the IAA and the SRA had he not already self-reported."},{"source_index":0,"quote":"The decision from November has only just been published."}]},"notes_on_gaps":"The sources do not state the model version, the developer, the date the upload occurred, the date of detection, the number of clients or records exposed, or any cost. The November decision's year is not stated. The article date (2026-02-24) is the source date, not a stated disclosure date, so no date_disclosed is given. The agent fields are left out because ChatGPT was used as a tool by a person, not as an autonomous agent, so no failure_class applies. Responsible party 'deployer' and severity 'moderate' are my judgements from the solicitor's own use and the client data touched. Root cause and detection method are not stated clearly enough to record. The second case (City Laws, Waheed Malik) is a separate matter and its controls are excluded. No remediation by the implicated party is stated, so remediations is empty. The I7 'missing' outcome is my inference from the admission that checking was not done. [case created by the backfill: read by claude-haiku-5-5, backfill-2026-11-01.2, 2026-11-01; not yet reviewed] [2026-11-01: evidence level set: Preliminary (Publisher not yet named · subject to change)]"},"context":{"industry":null,"org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"caught","text":"The tribunal said it would have referred him to the IAA and the SRA had he not already self-reported.","quote":"The tribunal said it would have referred Mr Mohammed to both the IAA and the SRA had he not already self-reported.","source_index":0,"grade":"C"},{"step":"done","text":"He said he would inform the clients, the IAA and the SRA of the data breach.","quote":"He informed us that he now realises that this is a data breach and will inform the clients that he has done this, as well as the IAA and the SRA [Solicitors Regulation Authority].","source_index":0,"grade":"C"}],"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://www.legalfutures.co.uk/latest-news/solicitor-faces-probe-after-putting-client-documents-into-chatgpt"]},"analysis":{"sections":{"timeline":[{"text":"The tribunal saw a considerable increase in citations of fictitious authorities.","quote":"Despite all of this, the Upper Tribunal has seen a considerable increase in the latter half of 2025 in the citation of fictitious authorities in both statutory appeals and applications for judicial review.","source_index":0,"when":"latter half of 2025"},{"text":"The solicitor said he would inform the clients, the IAA and the SRA.","quote":"He informed us that he now realises that this is a data breach and will inform the clients that he has done this, as well as the IAA and the SRA [Solicitors Regulation Authority].","source_index":0,"when":null}]},"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://www.legalfutures.co.uk/latest-news/solicitor-faces-probe-after-putting-client-documents-into-chatgpt"]}}