Cases › leaked private data › LR-2026-0435
Solicitor faces probe after putting client documents into ChatGPT
Preliminary Why: Publisher not yet named · subject to change
Status: action reported, no fix
No source states: loss or records, agent tool, could do, deployer, industry.
Severity moderate: Test: data of others touched with a bounded scope stated. Client emails and Home Office decision letters of the solicitor's clients were uploaded; no record count is stated.
A solicitor at a Manchester immigration firm, Tahir Mehmood Mohammed, told the Upper Tribunal that he had put client emails about Home Office decisions into ChatGPT to improve them, and had uploaded Home Office decision letters to summarise them for clients. A fake case name also appeared in one of his applications for permission to appeal, and he could not say how. He accepted that he should have checked it. He said he now realises this is a data breach and will tell the clients, the IAA and the SRA. The tribunal said it would have referred him to both regulators had he not already self-reported. The Upper Tribunal's ruling, published after a November decision, warned lawyers against putting client documents into public AI tools.
What happened
What was done
Risks
Sorted by rule from the case's fields; not yet read from the sources.
Controls
Not yet read for controls. Controls that mitigate the primary risk:
ApplicationData minimisation · Sensitive-data checks on outbound data · Human approval for high-impact actions · Output filtering and redaction · People told they are dealing with AI · Risk assessment per deployment
Infrastructure / targetSimilar incidents
Evidence
No source states: what the AI was doing, what went wrong, what it reached or did, when it happened, when it was found, how many records were exposed, the direct loss, a count of the other parties affected, any court case, the cause, what set it off.
Show the full account: 2 items from the primary sources
What happened, in order
- latter half of 2025 The tribunal saw a considerable increase in citations of fictitious authorities.
Not dated in the sources:
- The solicitor said he would inform the clients, the IAA and the SRA.
Show every field, with its source and grade
The AI system
What happened
Impact
Notes on gaps
The November decision's year is not stated. The second case (City Laws, Waheed Malik) is a separate matter and its controls are excluded. No remediation by the implicated party is stated, so remediations is empty.
LR-2026-0435 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON