# Techsperience
> Techsperience is a managed-IT firm for private-practice law firms across London and the Home Counties. We were founded in 1999, we work with firms of 20 to 150 staff, and we sell the strategic planning that comes after the helpdesk.
Index of pages: https://techsperience.co.uk/llms.txt. Canonical site: https://techsperience.co.uk/.
## Key facts
- Company: Techsperience Limited, registered in England and Wales, company number 03741699.
- Address: The Old Truman Brewery, 91 Brick Lane, London E1 6QL.
- Phone: +44 20 7770 6120. Email: info@techsperience.co.uk. Helpdesk hours: Monday to Friday, 8:30am – 6:00pm.
- Founded: 1999 (27 years).
- Clients: UK private-practice law firms, 20–150 staff, in London, Surrey, Kent, Essex, Hertfordshire, Berkshire, Buckinghamshire.
- Pricing: £100–£150 per user, per month, excluding VAT. Project work quoted separately.
## Techsperience ONE — the service
Techsperience ONE is our single managed-IT package for private-practice law firms in London and the Home Counties. It includes the daily IT operations every firm needs, a continuous Technology Alignment review against more than 150 standards, and a quarterly vCIO partnership at the partners' table. Cyber Essentials certification is included at no additional cost, and the project work that comes out of the roadmap is ours to deliver too.
The four layers: (1) daily IT operations — helpdesk, Microsoft 365 management, device management, Windows update management, software control, email security, anti-malware and a 24×7 Security Operations Centre; (2) a continuous Technology Alignment review of the firm's environment against more than 150 standards, with gaps reported openly to the partners; (3) quarterly vCIO sessions with the partners covering budget, roadmap and risk on one page; (4) delivery of the projects that come out of the roadmap. Layers one to three are included in the monthly per-user fee; project delivery is quoted per project and offered only to firms Techsperience supports. Cyber Essentials certification is included at no additional cost, and there is an ISO 27001 pathway for firms that need it.
How an engagement starts: a ten-minute call to see whether the firm and Techsperience are well-matched, then an in-person meeting at the firm's office, then a proposal. No free pre-sales audit; the free self-assessments on the site are the alternative.
## What Techsperience does not do
Project-only engagements for firms it does not support; free pre-sales audits; hardware reselling as the primary offer; new clients outside the legal sector. A few longstanding non-legal clients predate the move to a legal-only focus and are still supported.
## Sister brands
- Clearmatter (https://clearmatter.co.uk): Lightweight matter-management software for small law firms.
- Operate Legal (https://operate.legal): A free, ad-free operations field manual for the people running small law firms.
## Free tools
- The Website AI Visibility Check (https://techsperience.co.uk/ai-visibility-check): enter a website address and get a score for how well AI search engines can find, read and identify it.
- The Law Firm AI Readiness Check (https://techsperience.co.uk/ai-readiness-check): 30 questions across six weighted areas, returning a readiness score and prioritised actions.
- The Law Firm AI Threat Check (https://techsperience.co.uk/ai-threat-check): 20 questions across five weighted areas on how well a firm would withstand AI-assisted fraud, impersonation and phishing, returning a score and prioritised actions.
- The Law Firm IT Health Check (https://techsperience.co.uk/it-health-check): 30 questions across 10 sections, scoring a firm as Controlled, Mostly managed, Exposed or Fragile.
## Articles
17 articles, newest first. Each is also available at its own URL.
---
### Search in the AI era: how a law firm gets named in the answer
URL: https://techsperience.co.uk/resources/ai-search-law-firms
Published: 2026-09-05
Author: Ben, Principal, Techsperience
Topic: Technology
> Prospective clients increasingly ask ChatGPT, Perplexity or Google’s AI for a solicitor instead of scrolling ten blue links. Here’s how those engines decide which firms to name, and what your website has to do to be one of them.
Search has changed shape. For twenty years the question was where your firm ranked on a page of ten links. Increasingly there is no page: someone types "recommend a conveyancing solicitor in Guildford" into ChatGPT, Perplexity or the AI box at the top of Google, and gets an answer that names two or three firms. Either you are one of them or you are not in the conversation.
This article is about how those engines decide which firms to name, why most law firm websites give them very little to go on, and what to do about it. It is written for the person who owns the firm's marketing decisions, not for a developer, though there is a list at the end you can hand to one.
## The list became an answer
A conventional search engine returns a ranked list and leaves the choice to the reader. An AI engine returns an answer and has already made the choice. That difference matters more than any ranking factor.
When Google shows an AI Overview, the firms it names are the ones it could read well enough to summarise. When ChatGPT is asked for a solicitor, it searches the web with its own crawler, reads the pages it finds, and composes a reply that cites the sources it understood. Perplexity does the same and shows its sources by default. Microsoft Copilot draws on Bing. None of them shows ten results and lets the reader scroll.
There is no page two in an answer. There is barely a page one. The engine picks a handful of firms, and it picks them for reasons that have less to do with backlinks and keywords than with whether it could read the site, work out who was behind it, and find a sentence worth quoting.
## How an engine decides who to name
Strip away the vendor names and every AI engine is answering four questions about your website, in this order.
**Can I get in?** Every engine runs a crawler, and every crawler checks robots.txt before fetching a page. OpenAI's GPTBot and OAI-SearchBot, Anthropic's ClaudeBot, PerplexityBot, Google-Extended. A surprising number of law firm sites block some or all of them. Sometimes that was a decision. More often it arrived with a WordPress security plugin or a theme update in 2023, when blocking AI crawlers was briefly fashionable, and nobody has looked since. A blocked crawler does not see a worse version of the site. It sees nothing.
**Can I read it?** Crawlers fetch HTML. Most do not run JavaScript, or run it grudgingly. If your site is built on a modern page builder that sends an empty shell and paints the words in afterwards, the crawler receives the shell. The firm's carefully written practice-area pages are invisible. You can test this yourself: open a page, choose "view source" rather than "inspect", and search for a sentence from the page. If it is not there, an AI engine cannot see it either.
**Can I tell who you are?** This is where most firms lose. An engine reading a page written for humans has to infer that it belongs to a law firm, that the firm has a name, an address, a phone number, an area it serves. It will try. But the reliable way is structured data: a block of JSON-LD in the page that says, in a vocabulary every engine reads, that this site is published by a LegalService called Such-and-Such LLP at this address, serving these counties, and that the same entity appears on Companies House, LinkedIn and Google. Engines weigh corroboration heavily. A firm that exists in three places it trusts, all agreeing, is a firm it will name. A firm that exists only on its own website is a firm it will hedge about.
**Is there a sentence I can use?** The engine is composing an answer to a question. It needs a sentence from your site that answers it. "A boutique practice delivering bespoke solutions for discerning clients" answers nothing. "Such-and-Such is a firm of solicitors in Guildford acting for owner-managed businesses on commercial property, employment and disputes" answers several questions at once, and it is the sentence that gets quoted. The same goes for FAQs: a page that asks "how much does a commercial lease review cost?" and answers it in two plain sentences will be cited in reply to that question. A page that avoids the subject will not.
## Why law firm websites are particularly bad at this
Law firm sites are, as a category, written to impress a human who is already on the page. That was a reasonable brief when a site's job was to convert visitors Google had already sent. It is the wrong brief now, and the failure modes are consistent:
- **The opening line is a slogan.** "Excellence. Integrity. Results." A model cannot do anything with it.
- **Practice areas are described in the abstract.** "Our corporate team advises on a broad range of matters." Which matters? For whom? Where? The engine wants the specifics a partner would give in the first minute of a call.
- **Location is implied, not stated.** The office address is in the footer image. The counties served are nowhere. An engine asked for a solicitor in Kent cannot connect you to Kent.
- **The site was built for looks.** Animations, page builders, client-side rendering. Beautiful to a person, blank to a crawler.
- **Structured data is absent or wrong.** Either there is none, or a plugin emitted a generic WebSite node with no organisation attached, or the address in the schema disagrees with the one on the contact page.
- **robots.txt was never read by anyone at the firm.** It is the one file that decides whether any of the above matters, and nobody owns it.
None of this is a criticism of the firms. It is the natural result of websites being a marketing purchase, made once, and then left alone while the ground moved.
## What to do this quarter
The good news is that most of the fixes are cheap, and the order is clear because each one is worthless without the one before it.
1. **Find out where you stand.** We publish a free [Website AI Visibility Check](/ai-visibility-check). Enter your homepage address and it reads the page the way a crawler does, along with your robots.txt, sitemap and llms.txt, and scores the four questions above. Every finding comes with the fix. It takes ten seconds and does not ask for an email, though you can have the result as a PDF if you want to forward it.
2. **Open the door.** Fix robots.txt so the search crawlers you want are allowed in. If the firm has a considered position on model training, express it by blocking the training crawlers specifically rather than everything with "bot" in the name. Check no page you care about carries a noindex tag left over from a redesign.
3. **Get the words into the page.** If the check reports that only a few dozen words reach the crawler, that is the conversation to have with your web agency, and it is the single biggest change available. Server-side rendering or a static build; the visual design need not change.
4. **Say who you are, to machines.** JSON-LD for the organisation, with name, address, telephone, description, logo, the areas you serve, and sameAs links to Companies House, LinkedIn and your Google Business Profile. Then a WebPage node per page and a BreadcrumbList. Your agency can do this in an afternoon; the check will tell you when it is right.
5. **Rewrite the first sentence of every important page.** What the firm is, for whom, where. Then a short FAQ of real client questions, answered in plain sentences, marked up as FAQPage. This is the part that needs a partner's time rather than a developer's, and it is the part that gets quoted.
6. **Publish the small files.** An XML sitemap declared in robots.txt. An llms.txt at the root: a plain-markdown index of your most important pages with a line on each, written for a model to read. An RSS feed if you publish articles. A canonical link on every page.
7. **Be corroborated.** Claim and complete the Google Business Profile. Keep the LinkedIn company page current and consistent with the site. Collect genuine reviews. Make sure your name, address and phone number are identical everywhere they appear. Engines confirm you against these sources before they name you.
## What not to do
**Do not stuff.** Adding "best solicitor London" forty times worked on nothing in 2015 and works on less now. Engines are language models; they recognise copy written for them and discount it.
**Do not generate filler.** Publishing thirty AI-written articles on subjects your firm does not practise makes the entity harder to identify, not easier. One well-written page per real practice area, in the voice of the partner who does the work, beats any volume of generic content.
**Do not block out of fear.** There is a legitimate debate about model training and copyright, and a firm is entitled to a position on it. But a blanket block put in place without that debate is a marketing decision made by a plugin. Have the conversation, then set the file accordingly.
## Whose job this is
At most firms the website belongs to marketing, the server belongs to a web agency, robots.txt belongs to nobody, and the IT provider has never seen any of it. That gap is why the cheapest fixes on the list above go undone for years.
We think this sits on the same agenda as the rest of the firm's technology. Whether the engines your prospective clients ask can find you is a question about crawler access, rendering, structured data and file hygiene, and it has consequences for the firm's growth that a partner should hear about in the same conversation as security, compliance and cost. That is the conversation our quarterly vCIO sessions are for, and it is why we built the check.
Run it on your own site first. Then run it on the three firms you lose work to, and see who the engines are choosing.
Being found is one half of AI in a law firm. Being ready to use it safely inside the firm is the other, and our [AI Readiness Check](/ai-readiness-check) covers that half in about six minutes.
#### Frequently asked questions
**What is AI-EO, or AI engine optimisation?**
AI-EO is the practice of making a website easy for AI search engines such as ChatGPT, Perplexity, Claude and Google AI Overviews to read, understand and cite. It overlaps with SEO but weighs different things: whether crawlers are allowed in, whether content is in the HTML rather than rendered by JavaScript, whether structured data identifies the organisation, and whether pages state plainly what the business is and answer real questions.
**Should a law firm block AI crawlers to protect its content?**
It is a trade-off, and it should be a deliberate one. Blocking training crawlers such as GPTBot keeps your articles out of future model training; it also removes you from ChatGPT search results, which use the same or related crawlers. Many firms discover the block was put in by a plugin or template and never chosen at all. Decide it on purpose, and if you want to be found, allow the search crawlers.
**Does a law firm need structured data to appear in AI search results?**
Not strictly, but it is the most reliable way to be identified correctly. JSON-LD tells an engine that the site belongs to a named organisation at a specific address serving specific areas, and sameAs links to Companies House, LinkedIn and Google let it confirm that against sources it already trusts. Without it the engine has to guess, and it guesses conservatively.
**How is AI search different from Google search for a law firm?**
Google search returns a ranked list and the user chooses. An AI engine returns an answer and has already chosen, typically naming two or three firms. There is no page two. The engine picks firms it can read, can identify with confidence, and whose pages contain a sentence it can quote in answer to the question. Ranking factors such as backlinks still matter, but readability and entity clarity matter more than they ever did for Google.
**How can a law firm check how it looks to AI search engines?**
Techsperience publishes a free Website AI Visibility Check. Enter a page address and it fetches the page, robots.txt, sitemap and llms.txt the way a crawler would, then scores four areas and lists every finding with the fix. It takes about ten seconds and does not ask for an email.
---
### An AI acceptable use policy your firm can adapt
URL: https://techsperience.co.uk/resources/ai-acceptable-use-policy-template
Published: 2026-08-18
Author: Kate, Compliance & Cybersecurity, Techsperience
Topic: Compliance
> The AI acceptable use policy we give our own clients, published in full. Take it, change the bits that do not fit, and put it in front of your people.
This is the AI acceptable use policy we give our own clients, published in full
on this page — free to read, copy or print, with nothing hidden behind a form.
A policy nobody can read is not much use to anyone.
Take it, change the parts that do not fit your firm, and put it in front of your
people. It is a starting point, not a finished document.
This is a practical operational template, not legal, regulatory or
data-protection advice. Your firm's obligations depend on its circumstances,
clients, systems and intended use of AI. Read it before you adopt it, and take
advice where the stakes justify it.
Two notes before you use it. Where the policy says **Techsperience**, substitute
your own IT provider if you have one, or the internal role that will do that
review. And if you want to know which parts of it matter most for your firm
right now, the [Law Firm AI Readiness Check](/ai-readiness-check) scores exactly
these areas in about six minutes.
---
## Purpose
Artificial intelligence tools can improve productivity, assist with research,
generate content, summarise information, support coding and automate repetitive
tasks. They also introduce risks: data leakage, incorrect outputs, insecure
automation, intellectual property exposure, regulatory breaches and uncontrolled
system access.
This policy defines how AI may be used safely within the firm. The aim
is not to block AI use, but to ensure it is used in a controlled, secure and
responsible way.
## Scope
This policy applies to all employees, contractors, temporary workers,
third-party users and any person using firm systems or data.
It applies to web-based AI tools, Microsoft 365 Copilot and similar business AI
assistants, browser extensions, SaaS applications with built-in AI features, AI
coding tools, chatbots, automation platforms, locally installed AI tools,
custom-built AI integrations, and APIs connected to AI models.
## What counts as an AI tool
For this policy, an AI tool means any system that can generate, summarise,
classify, interpret, predict, automate or make recommendations using machine
learning or artificial intelligence.
Examples include ChatGPT, Microsoft Copilot, Google Gemini, Claude, Perplexity,
AI meeting-note tools, transcription services, coding assistants, image
generators, automation tools, and AI features embedded in applications you
already own.
That last category matters more than people expect. Most firms acquire their
first AI tool without deciding to, because a supplier switched a feature on.
## Core principles
**Data protection first.** Sensitive, confidential, personal, internal or client
data must not be entered into unapproved AI systems.
**Human accountability.** AI may assist decision-making, but responsibility
remains with the person using it.
**Verify before use.** AI outputs must be checked for accuracy before being
relied upon or shared.
**Least privilege.** AI tools must only have access to the minimum data and
systems required.
**Isolation before integration.** AI systems must be tested in isolated
environments before being connected to business systems.
**No shadow AI.** AI tools must not be introduced, connected or deployed without
visibility and approval where required.
## Approved and unapproved tools
An AI tool may be used where it has been reviewed and approved. Approval means
someone can answer all of the following:
- Who provides the tool?
- Where is data processed?
- Is data stored, and for how long?
- Is data used to train the provider's models?
- What security controls are available?
- Can access be managed centrally?
- Can usage be audited?
- Can data be deleted?
- Is there a commercial or enterprise agreement in place?
If those questions cannot be answered, the tool is not approved — regardless of
how useful it is.
**Unapproved tools** must not be used with client data, personal data,
confidential firm data, internal documents, credentials, source code
containing business logic, financial information, HR information, security
information, data exported from firm systems, or the contents of mailboxes.
They may be used for general, non-sensitive tasks: brainstorming, rewriting
non-confidential text, or learning general concepts.
## Information that must never go into an unapproved AI tool
### Across the firm
- Personal data, and special category personal data
- Passwords, API keys, MFA codes, access tokens or other secrets
- IT and infrastructure information — network diagrams, system configurations,
security tooling, monitoring and backup arrangements
- Vulnerability reports, penetration test results or security incident details
- Internal financial data, payroll or HR records
- Board papers, partnership agreements, or anything commercially sensitive
- Internal email threads containing any of the above
- Anything classified as confidential or restricted
### Specific to a law firm
- Matter files, or any document taken from a live matter
- Client identities linked to the nature of their instruction
- Anything covered by legal professional privilege — counsel's opinions, advice
notes, privileged correspondence
- Draft pleadings, witness statements and court bundles
- Client money records, ledgers and completion statements
- AML and KYC documentation, including source-of-funds evidence
- Conflict-check data, and information barrier arrangements
- Medical records and expert reports in personal injury, clinical negligence or
family matters
- Wills, lasting powers of attorney, trust deeds and estate information
- Undertakings given or received
- Anything covered by a client's outside counsel guidelines or panel terms,
particularly where those terms say something about AI
**The simple version:** if the information would not be safe to post publicly,
it must not go into an unapproved AI tool.
## Permitted use
- Drafting non-sensitive emails
- Improving grammar or tone
- Creating outlines
- Generating ideas
- Summarising public information
- Explaining general concepts
- Producing first drafts of policies or templates
- Generating sample text using fictional data
- Assisting with non-sensitive code examples
- Producing marketing ideas containing no confidential information
## Restricted use — approval required
- AI tools processing internal firm data
- AI tools processing client or matter data
- AI tools connected to email, document management, practice or case management,
time recording and billing, finance, HR, or any other system holding client
information
- AI tools producing external client correspondence, or anything that leaves the
firm on its letterhead
- AI tools making recommendations that affect clients, staff, the firm's
finances, legal matters or security
- AI tools used for recruitment, HR, disciplinary or performance decisions
- AI tools generating or executing scripts
- AI tools embedded in a live business process rather than used ad hoc
- AI tools automating actions without human review
## Prohibited use
The following are prohibited unless explicitly approved in writing by senior
management following a risk assessment:
- Uploading client or personal data to unapproved AI tools
- Connecting AI tools directly to live firm systems without approval
- Allowing AI to make final decisions without human review
- Allowing AI to send external communications automatically
- Allowing AI to create, modify, delete or move business data without oversight
- Allowing AI to change security settings, or to reach administrative areas of
any system
- Allowing AI to access the systems that keep the firm secure, backed up or
logged in, without review
- Running AI-generated scripts on live systems
- Using AI to bypass firm security controls
- Using AI to monitor staff without approval
- Using AI to generate misleading, deceptive, harmful, discriminatory or unlawful
content
- Using AI for legal, medical, financial or regulatory advice without qualified
review
## Test in isolation before connecting anything
Any AI tool, integration or automation must be tried in isolation before it
touches live systems or real client information.
An isolated environment is one with no access to live matter files, client data,
the firm's document or case management system, mailboxes, the accounts or client
money systems, HR records, administrative logins, or the systems that keep the
firm secure and backed up.
In practice that usually means one of the following:
- A separate test tenant or trial account
- A closed matter with names and identifying details removed
- Entirely invented data
- A demonstration environment provided by the supplier
Testing should establish that the tool reaches only the information you intended,
sends nothing outside the firm, takes no action without being asked, keeps
nothing it does not need, produces output a person can check, and can be turned
off quickly.
## Containment boundaries
A containment boundary is the limit of what an AI system can access, process,
influence or change. Examples:
- A specific sandbox tenant
- A defined dataset
- A single test mailbox
- A single file library, separate from the live one
- A read-only knowledge base
- A restricted user account
- A defined workflow with manual approval gates
AI systems must not cross those boundaries without approval. Crossings to watch
for include moving data from a secure environment into an unapproved AI tool,
connecting a test workflow to live email, connecting AI to a client system
without authorisation, granting access to every SharePoint site when one library
is needed, using an administrator login, running AI-generated scripts on
machines people work on, processing several clients' matters in one shared
workspace, or letting AI reach the systems that keep the firm secure, backed up
or logged in without review.
**Default position:** AI may observe only what it has explicitly been permitted
to observe, and may act only where a human has approved the action.
## Treat imported code, scripts and prompts as untrusted
All AI-generated code, externally sourced scripts, community templates, GitHub
examples, Stack Overflow snippets, automation recipes, browser extensions and
prompt packs are untrusted until reviewed.
Before use, establish what the code does, what it connects to, what data it
reads or writes, whether it sends data externally, whether it downloads further
code, whether it contains hidden endpoints, whether it needs elevated
permissions, whether it stores credentials, whether it logs sensitive data,
whether it changes security settings, and whether it can be rolled back.
Prohibited in all cases:
- Copying and running scripts straight onto live systems
- Running unknown scripts as administrator
- Running AI-generated code without review
- Allowing AI to generate and execute code automatically
- Using scripts containing hardcoded credentials or contacting unknown domains
- Using scripts that disable security controls, or alter firewall, identity,
backup or endpoint protection settings without approval
## Human review and accountability
AI outputs must be reviewed by a competent human before being relied upon. That
applies to emails, reports, policies, contracts, technical advice, code,
scripts, security recommendations, client communications, financial analysis,
HR content, compliance documentation, and any decision affecting people or
clients.
The reviewer is responsible for checking accuracy, completeness, bias, tone,
confidentiality, legal and regulatory implications, appropriateness for the
audience, and whether the output contains invented facts or unsupported claims.
The last of those is the one that catches people out. Confident, well-formatted
and wrong is the characteristic failure mode.
## Risk categories
| Category | Examples | Requirement |
| --- | --- | --- |
| **Low** | General brainstorming, drafting non-sensitive text, rewriting public content, fictional examples, summarising public information | User discretion, plus output review |
| **Medium** | Internal non-sensitive information, internal process documents, anonymised analysis, anything tested away from live systems, internal workflows with human review | Manager approval, and IT review where firm systems or data are involved |
| **High** | Client or matter data, personal data, firm systems, decisions affecting clients or staff, anything connected to a live system, workflows that act on their own | Formal AI Usage Request, risk assessment, and approval before use |
| **Prohibited or exceptional** | AI with administrator access, access to the systems that keep the firm secure, final decisions about people, external communications sent automatically, unsupervised changes to live systems, regulated data processed without controls | Not permitted unless formally approved by senior leadership after risk assessment |
## Approval process
An AI Usage Request must be completed before introducing a new AI tool,
connecting AI to firm systems, processing internal or client data with AI,
using AI for automation, running AI-generated scripts against firm systems,
putting AI into day-to-day use, or changing the scope of a tool already in use.
No high-risk AI use may proceed without approval.
## Reporting concerns and incidents
Report immediately if:
- Sensitive data has been entered into an AI tool
- Client data has been uploaded to an AI system
- An AI tool has been connected to the wrong system
- AI has produced harmful, misleading or inappropriate content
- AI has taken an unauthorised action
- AI-generated code has caused unexpected behaviour
- Anyone is unsure whether a particular use is safe
That last one matters. Most firms find out about a problem because somebody
asked a question, and people only ask when asking is welcome.
Reports go to your manager, your internal IT contact, or your IT provider.
## Policy review
Review this policy at least annually, and sooner where new AI tools are
introduced, regulations change, business systems change, a security incident
occurs, client requirements change, or your provider recommends it.
AI products change what they do with your data on their own schedule, not
yours. A policy written this year describes a product that may not exist in the
same form next year.
---
## Using this well
A policy is the first control, not the whole of it. It tells people where the
line is; it does not stop anyone crossing it. The firms that handle AI well pair
the written position with three practical things: someone named who owns the
decision, permissions tight enough that a tool cannot surface what it should
not, and a route for people to ask questions without feeling stupid.
If you want to know where your firm currently stands across all of that, the
[Law Firm AI Readiness Check](/ai-readiness-check) scores it in about six
minutes, free, with no email required to see the result.
Want to see how this works in practice?
We give this policy to the firms whose technology we run, and help them put
it into practice — approving tools, drawing the boundaries, and reviewing it
as the technology and the firm change.
Those firms also get access to our AI portal, where the policy stops being a
document and becomes something you can see working across the firm. It is
available to clients only — get in touch if you would like a look at it.
020 7770 6120
info@techsperience.co.uk
Book a 10-minute call
#### Frequently asked questions
**Can we use this policy as it is?**
You can, but you should not. Read it through and change what does not match how your firm works — the approval routes, the named contacts, and the risk categories in particular. A policy that describes someone else’s firm is worse than no policy, because it gives false comfort and nobody follows it.
**Does having an AI policy satisfy the SRA?**
The SRA does not mandate a specific AI policy. It expects firms to protect client confidentiality, supervise work properly and manage risk — obligations that apply whether or not AI is involved. A written policy is evidence that you have thought about it, which is useful when a client or regulator asks. It is not a substitute for actually controlling what happens.
**Our staff are already using ChatGPT. Is it too late for a policy?**
No, and that is the normal starting position. Almost every firm has more AI in use than it thinks. A policy that acknowledges existing use and sets boundaries is far more effective than one written as though nobody has started yet — people ignore rules that pretend not to describe reality.
**Do we need a different policy for Microsoft 365 Copilot?**
Not a separate policy, but Copilot deserves particular attention within it. Copilot inherits each user’s existing permissions, so it surfaces whatever that person could already have found. That makes permissions and access reviews the controlling factor, which is why they appear in the policy and in our AI Readiness Check as critical items.
**Who should own this policy?**
One named person with the authority to approve or refuse a tool. Splitting it between IT, risk and the partnership usually means nobody owns it. The policy is only as good as the person who can say no.
---
### AI Productivity in Law Firms
URL: https://techsperience.co.uk/resources/ai-productivity-law-firms
Published: 2026-04-20
Author: Lisa, AI & Productivity, Techsperience
Topic: Technology
> How AI can improve productivity in a law firm — and the security guard rails legal practices need to adopt it safely.
## How Can AI Improve Productivity in a Law Firm?
Artificial intelligence is rapidly transforming how law firms work. Modern AI tools can help legal teams **reduce administrative workload by 20–40%**, automate repetitive tasks, and improve document drafting and research.
For a typical **50-person law firm**, properly implemented AI tools can save **hundreds of hours per year** by assisting with document preparation, summarising case materials, organising meeting notes, and improving internal knowledge management.
However, AI must be implemented carefully within a **secure and compliant IT environment**. Law firms must ensure client confidentiality is protected and staff understand how to use AI tools safely.
With the right strategy, AI can significantly improve productivity while maintaining the high standards of data protection required in the legal profession.
## The 5 Areas Where AI Delivers the Biggest Productivity Gains
Artificial intelligence can assist law firms in several practical areas. When implemented correctly, these tools can dramatically reduce administrative workloads.
### 1. Legal Document Drafting
AI-powered tools can assist lawyers with drafting contracts, letters, and legal documents by suggesting content, improving structure, and helping refine language.
This can significantly reduce the time spent on repetitive drafting tasks.
### 2. Case Research and Document Summaries
Legal teams often spend hours reviewing case materials and lengthy documents. AI tools can summarise large volumes of information and highlight key points, helping lawyers quickly identify relevant details.
### 3. Email and Client Communication
AI assistants can help draft emails, summarise conversations, and organise client communications, allowing lawyers to respond more quickly while maintaining professional standards.
### 4. Meeting Notes and Action Tracking
AI meeting tools can automatically generate meeting summaries, extract action points, and organise follow-up tasks. This removes the need for manual note-taking during internal meetings or client calls.
### 5. Internal Knowledge Management
Law firms generate significant internal knowledge over time. AI tools can help organise documents and create searchable knowledge bases that allow lawyers to quickly find relevant precedents or information.
## Common AI Tools Used by UK Law Firms
Several AI solutions are becoming increasingly popular in legal environments. Many of these tools integrate directly with systems that law firms already use.
Examples include:
- **Microsoft Copilot for Microsoft 365**
- AI-powered legal research platforms
- Document automation tools
- AI meeting transcription tools
- Knowledge management assistants
For many firms, AI adoption begins with tools integrated into **Microsoft 365 environments**, where AI can assist with Word documents, emails, and meeting summaries.
## Security Risks of Using AI in Law Firms
While AI offers significant benefits, it also introduces potential risks if used incorrectly.
Key concerns include:
### Confidential Client Data
Using unapproved AI tools may expose sensitive client information if data is uploaded without appropriate safeguards.
### Lack of AI Governance
Without clear policies, staff may begin using AI tools without understanding security risks or compliance requirements.
Because law firms handle sensitive client information, AI tools should always be implemented within a secure and compliant environment. Firms should ensure their cybersecurity controls are strong enough to protect confidential data before introducing new technologies. You can learn more in our guide on [what the SRA actually expects from a law firm’s cybersecurity](/resources/sra-cybersecurity-expectations).
### Shadow AI Usage
Employees sometimes experiment with AI tools independently, which can lead to inconsistent practices or data exposure.
### Data Protection and Compliance
Law firms must ensure AI tools comply with data protection regulations and internal security policies.
Because of these risks, firms should always implement AI within a **secure and governed environment**.
## A Practical 5-Step AI Adoption Framework for Law Firms
Adopting AI successfully requires a structured approach. Many firms follow a phased implementation strategy.
### Step 1: Identify Repetitive Tasks
Review internal workflows to identify tasks that consume large amounts of time, such as document drafting or meeting notes.
### Step 2: Evaluate Approved AI Tools
Choose tools that integrate securely with existing systems such as Microsoft 365 and comply with data protection standards.
Many firms introduce AI tools as part of a broader technology strategy that includes cybersecurity, cloud services, and ongoing IT support. To understand how these services are typically packaged and priced, see our guide on [how much managed IT services cost for law firms in London](/resources/managed-it-cost-law-firms).
### Step 3: Develop an AI Usage Policy
Create clear policies that define how AI tools can be used within the firm and how client data must be protected.
### Step 4: Train Staff
Provide training so employees understand both the benefits and the risks of AI tools.
### Step 5: Monitor Results
Track productivity improvements and identify additional areas where AI may provide value.
## What an AI Roadmap Looks Like for a Growing Law Firm
Many law firms adopt AI gradually rather than implementing multiple tools at once.
A typical roadmap might look like this:
| Timeline | Activity |
|----------|----------|
| Month 1–2 | Identify workflows and test AI tools |
| Month 3–4 | Implement AI tools and train staff |
| Month 5–6 | Integrate AI into daily workflows |
| Ongoing | Review productivity improvements |
This phased approach allows firms to adopt AI safely while ensuring staff are comfortable using new technology.
## Example: How AI Helped a London Law Firm Save Time
A **40-person London law firm** recently explored how AI tools could improve productivity across the practice.
The firm introduced several AI capabilities including:
- AI-powered document drafting assistance
- automated meeting summaries
- improved internal document search
Within a few months the firm reported **saving more than 10 hours per week** across its legal teams, allowing staff to focus more on client work rather than administrative tasks.
## Why Law Firms Work With Techsperience on AI Strategy
Techsperience provides managed IT services and technology guidance for **law firms across London and the South East**, supporting practices with **20–150 employees**.
The team helps legal firms adopt modern technologies while maintaining strong cybersecurity and compliance standards.
Key areas of expertise include:
- secure Microsoft 365 environments
- cybersecurity aligned with legal sector requirements
- AI adoption and governance guidance
- IT strategy and technology planning
- quarterly vCIO reviews to support business growth
By combining legal sector knowledge with technology expertise, Techsperience helps law firms implement AI tools safely and effectively.
## Start Planning Your Law Firm's AI Strategy
AI presents significant opportunities for improving productivity in legal practices, but successful adoption requires careful planning and strong security controls.
A technology review can help identify:
- workflows suitable for automation
- AI tools that fit the firm's environment
- governance policies required to protect client data
With the right strategy, law firms can safely use AI to improve efficiency while maintaining the highest standards of confidentiality and professionalism.
If you want a structured view of where your firm currently stands, our free [Law Firm AI Readiness Check](/ai-readiness-check) scores your governance, client data handling, security, supervision and adoption planning in about six minutes.
**Techsperience provides managed IT services for law firms across London and the South East**, supporting legal practices with **20–150 employees** with cybersecurity, compliance, and strategic IT planning. Our team specialises in helping firms meet SRA expectations while improving productivity and reducing technology risk.
#### Frequently asked questions
**How much can AI tools save a law firm?**
Modern AI tools can help legal teams reduce administrative workload by 20–40%. For a typical 50-person law firm, properly implemented AI tools can save hundreds of hours per year by assisting with document preparation, summarising case materials, organising meeting notes, and improving internal knowledge management.
**Where does AI deliver the biggest productivity gains for lawyers?**
Five main areas: legal document drafting, case research and document summaries, email and client communication, meeting notes and action tracking, and internal knowledge management. When implemented correctly, these tools can dramatically reduce administrative workloads.
**What security risks come with AI in law firms?**
Key concerns include exposing confidential client data through unapproved AI tools, lack of AI governance leading to inconsistent practices, shadow AI usage by staff experimenting independently, and ensuring AI tools comply with data protection regulations and internal security policies.
**How should a law firm adopt AI?**
A practical 5-step framework: identify repetitive tasks, evaluate approved AI tools that integrate securely with Microsoft 365 and meet data protection standards, develop an AI usage policy, train staff on benefits and risks, and monitor results to identify additional value.
---
### Budgeting for IT Support and Cybersecurity
URL: https://techsperience.co.uk/resources/law-firm-it-budget
Published: 2026-04-20
Author: Ben, Principal, Techsperience
Topic: Pricing
> How law firms should budget for IT support and cybersecurity, including typical costs, what to include, and the factors that drive pricing.
## How Should Law Firms Budget for IT Support and Cybersecurity?
Technology is now a core part of how law firms operate, supporting everything from document management to secure client communication. As a result, IT is no longer an unpredictable expense but a planned investment that supports security, productivity, and compliance.
For most law firms with 20–150 employees, IT budgets are typically structured on a per-user, per-month basis, with costs usually ranging from £100 to £150 per user per month depending on the level of support and cybersecurity required.
Understanding how to budget for IT allows law firms to maintain secure systems, avoid unexpected costs, and plan for future growth.
## What Should a Law Firm IT Budget Include?
A well-structured IT budget should cover more than just support. It should include all the components required to maintain a secure and reliable technology environment.
Typical areas include:
- IT support and helpdesk services
- cybersecurity tools and monitoring
- Microsoft 365 or cloud platforms
- backup and disaster recovery
- hardware lifecycle and device management
- strategic IT planning and reviews
Many law firms combine these into a single managed service for simplicity and predictability.
To understand typical pricing in more detail, see our guide on [how much managed IT services cost for law firms in London](/resources/managed-it-cost-law-firms).
## Typical IT Budget for Law Firms
Most law firms budget IT based on the number of users.
**Example monthly budgets:**
| Firm Size | Estimated Monthly IT Budget |
|-----------|----------------------------|
| 20 users | £2,000–£3,000 |
| 50 users | £5,000–£7,500 |
| 100 users | £10,000–£15,000 |
These figures typically include:
- IT support
- cybersecurity protection
- cloud management
- system monitoring
Budgets may increase where additional security or compliance requirements are needed.
## The 5 Key Factors That Influence IT Budgets
Several factors determine how much a law firm should allocate to IT.
### 1. Cybersecurity Requirements
Higher levels of cybersecurity increase costs but significantly reduce risk.
Protections such as endpoint detection, email security, and monitoring are essential for law firms handling sensitive data.
Learn more in our guide on [what the SRA actually expects from a law firm’s cybersecurity](/resources/sra-cybersecurity-expectations).
### 2. Cloud vs On-Premise Systems
Firms using modern cloud platforms often benefit from improved flexibility and scalability, while legacy on-premise systems may require additional maintenance.
### 3. Compliance and Regulatory Requirements
Law firms often align with frameworks such as:
- Cyber Essentials
- ISO27001
- GDPR
These requirements can influence both tools and processes within the IT environment.
### 4. Number of Users and Locations
More users and multiple offices increase complexity and support requirements.
### 5. Level of Strategic IT Support
Firms that include regular IT reviews and planning (vCIO services) can better manage long-term costs and avoid unexpected expenses.
## Why Law Firms Are Moving to Predictable IT Costs
Many law firms are moving away from reactive "break-fix" IT support toward managed services.
Benefits include:
- predictable monthly costs
- proactive maintenance and monitoring
- reduced downtime
- improved cybersecurity
- access to specialist expertise
This approach helps firms avoid unexpected costs and ensures systems remain secure and reliable.
## How IT Budgeting Supports Cybersecurity and Compliance
A structured IT budget ensures that cybersecurity is treated as a core requirement rather than an optional extra.
For example, budgeting allows firms to:
- maintain up-to-date security tools
- implement backup and disaster recovery systems
- meet SRA expectations
- prepare for certifications such as Cyber Essentials
Learn more in our guide on [Cyber Essentials for law firms](/resources/cyber-essentials-law-firms).
## Example: IT Budget for a Growing Law Firm
A 60-person law firm in London reviewing its IT strategy implemented a structured budget aligned with business growth.
This included:
- managed IT support
- enhanced cybersecurity protections
- Microsoft 365 optimisation
- regular IT strategy reviews
The result was improved system reliability, reduced risk, and a clear, predictable IT cost structure.
## How to Plan Your Law Firm's IT Budget
A structured approach helps ensure your IT budget aligns with your firm's needs.
Typical steps include:
1. reviewing current systems and costs
2. identifying risks and gaps
3. defining required security controls
4. planning for growth and scalability
5. selecting an appropriate IT support model
This approach ensures technology supports both operational needs and long-term strategy.
## Why Law Firms Work With Techsperience
Techsperience provides managed IT services for law firms across London and the South East, supporting practices with 20–150 employees.
Key strengths include:
- legal-sector IT expertise
- SRA, Cyber Essentials, and ISO27001 alignment
- all-in-one packages covering support, security, and backup
- proactive monitoring and responsive helpdesk
- quarterly vCIO strategy meetings
- guidance on AI and process improvement
This helps law firms maintain secure and cost-effective IT environments.
## Need Help Planning Your IT Budget?
Choosing between in-house IT and managed IT depends on your firm's size, requirements, and long-term strategy.
A structured review can help you:
- assess current IT capabilities
- identify risks and gaps
- compare available options
- plan the most effective approach
With the right IT strategy, law firms can ensure their technology supports both security and growth.
Techsperience provides managed IT services for law firms across London and the South East, supporting legal practices with 20–150 employees with cybersecurity, compliance, and strategic IT planning. Our team specialises in helping firms meet SRA expectations while improving productivity and reducing technology risk.
#### Frequently asked questions
**How much should a law firm budget for IT support and cybersecurity?**
For most law firms with 20–150 employees, IT budgets are typically structured on a per-user, per-month basis, with costs usually ranging from £100 to £150 per user per month depending on the level of support and cybersecurity required.
**What should a law firm IT budget include?**
A well-structured IT budget should include IT support and helpdesk services, cybersecurity tools and monitoring, Microsoft 365 or cloud platforms, backup and disaster recovery, hardware lifecycle and device management, and strategic IT planning and reviews.
**What factors influence a law firm IT budget?**
Five main factors drive IT budgets: cybersecurity requirements, cloud vs on-premise systems, compliance and regulatory requirements (Cyber Essentials, ISO27001, GDPR), the number of users and locations, and the level of strategic IT support included.
**Why are law firms moving to predictable IT costs?**
Many law firms are moving away from reactive break-fix support toward managed services to gain predictable monthly costs, proactive maintenance and monitoring, reduced downtime, improved cybersecurity, and access to specialist expertise.
---
### Managed IT Costs for London Law Firms
URL: https://techsperience.co.uk/resources/managed-it-cost-law-firms
Published: 2026-04-20
Author: Ben, Principal, Techsperience
Topic: Pricing
> How much managed IT costs for a law firm in London — typical pricing, what should be included, and the hidden costs to avoid.
## How Much Does Managed IT Cost for a Law Firm in London?
### Average Managed IT Cost for Law Firms in London
For most law firms in London with 20–150 employees, managed IT services typically cost between **£100 and £150 per user per month**. The exact cost depends on the level of cybersecurity, compliance requirements, and whether services such as backup, monitoring, and strategic IT planning are included.
For example, a **50-person law firm** will usually invest **£5,000–£7,500 per month** in fully managed IT services. This typically includes helpdesk support, cybersecurity protection, Microsoft 365 management, secure backup, and proactive monitoring.
Law firms often require **higher security standards than typical businesses** because they handle sensitive client information and must meet regulatory expectations such as **SRA guidance, Cyber Essentials, and data protection requirements**. As a result, IT support for law firms is usually structured as a **complete managed service rather than ad-hoc support**.
Understanding what drives IT pricing helps firms choose the right provider and avoid unexpected costs. You can also compare different approaches in our guide on **managed IT vs in-house IT for law firms**.
## The 5 Factors That Determine Managed IT Pricing for Law Firms
Managed IT pricing is typically based on the **number of users and the level of services required**. However, several other factors influence the overall cost.
### 1. Number of Users and Devices
Most MSPs charge **per user per month**. The more staff members and devices that require support, the higher the overall monthly cost.
Typical pricing ranges include:
- **Basic IT support:** £80–£100 per user
- **Fully managed IT services:** £100–£150 per user
- **Advanced security & compliance packages:** £150+ per user
### 2. Cybersecurity Requirements
Law firms are frequent targets for cybercrime due to the value of the information they hold. Advanced cybersecurity solutions such as **endpoint detection and response (EDR), email security, and multi-factor authentication (MFA)** can increase the cost but dramatically reduce risk.
Many law firms invest more in IT due to increasing cybersecurity requirements and regulatory expectations. You can learn more in our guide on [what the SRA actually expects from a law firm’s cybersecurity](/resources/sra-cybersecurity-expectations).
### 3. Compliance Requirements
Many law firms work toward or maintain compliance with frameworks such as:
- **Cyber Essentials**
- **ISO27001**
- **SRA cybersecurity expectations**
- **GDPR data protection requirements**
Supporting these frameworks requires additional monitoring, policies, and documentation.
### 4. Cloud vs On-Premise Infrastructure
Law firms moving to **cloud-based environments such as Microsoft 365 and Azure** often benefit from improved security and flexibility, but the migration and management of these environments can affect pricing.
### 5. Strategic IT Services
Some providers offer strategic services such as **vCIO meetings, IT roadmapping, and business technology planning**. These services help law firms align technology with business growth but are not always included in basic support packages.
## What Should Be Included in Managed IT Support for Law Firms?
A comprehensive managed IT package should cover both **technical support and cybersecurity protection**.
Most law firms should expect the following services:
- Unlimited IT helpdesk support
- Microsoft 365 management and administration
- Device monitoring and maintenance
- Endpoint security protection
- Email security and phishing protection
- Secure cloud backups
- Patch management and software updates
- Network monitoring
- Remote and onsite support
These services ensure that systems remain **secure, reliable, and compliant** while allowing legal teams to focus on client work rather than technical issues. Learn more about [what managed IT support includes for law firms](/resources/managed-it-support-law-firms).
## Hidden IT Costs Law Firms Should Avoid
Some IT providers advertise very low monthly fees but charge separately for essential services.
Common hidden costs include:
### Backup Services
Secure backups are critical for protecting legal data, but some providers charge separately for backup storage or disaster recovery testing.
### Cybersecurity Add-Ons
Security tools such as **endpoint protection, phishing training, and monitoring services** may not be included in basic packages.
Learn more about the [what the SRA actually expects from a law firm’s cybersecurity](/resources/sra-cybersecurity-expectations).
### Reactive Support Charges
Some providers still operate a **break-fix model**, charging hourly for support requests instead of providing unlimited helpdesk access.
### Lack of Strategic IT Planning
Without proactive planning, firms often face unexpected technology costs such as emergency upgrades or downtime.
A well-structured managed IT service should provide **predictable monthly costs and proactive support** rather than reactive problem solving.
## Example IT Budget for a 50-Person Law Firm
To illustrate typical pricing, consider a **50-user London law firm** using Microsoft 365 and modern cybersecurity tools.
Example monthly IT stack:
| Service | Estimated Cost |
|---------|----------------|
| Managed IT Support | Included |
| Microsoft 365 Management | Included |
| Endpoint Security | Included |
| Email Security | Included |
| Secure Backup | Included |
| Monitoring & Maintenance | Included |
Typical pricing model:
**50 users × £120 per user = £6,000 per month**
This model provides a predictable IT budget while covering:
- security protection
- data backup
- ongoing support
- system monitoring
For many firms, the **cost of downtime or a cyberattack far exceeds the monthly cost of proactive IT management**.
## How to Choose the Right IT Provider for Your Law Firm
Not all IT providers understand the specific requirements of legal practices. When selecting a managed service provider, law firms should evaluate several factors.
### Legal Sector Experience
IT providers with experience supporting law firms understand the importance of **confidentiality, compliance, and document management systems**.
### Cybersecurity Expertise
Look for providers with expertise in **Cyber Essentials, ISO27001 alignment, and modern security technologies**.
### Service Level Agreements (SLAs)
Clear SLAs ensure support requests are handled quickly and consistently.
### Strategic IT Guidance
A provider offering **regular IT strategy reviews or vCIO services** can help law firms plan technology investments effectively.
### Compliance Knowledge
Understanding SRA expectations and cybersecurity frameworks is critical for protecting client data.
## Example: Improving IT Security for a London Law Firm
A **60-person London law firm** recently reviewed its IT environment after experiencing repeated phishing attempts and inconsistent support from its previous provider.
The firm implemented a fully managed IT service that included:
- Microsoft 365 security configuration
- multi-factor authentication across all systems
- endpoint detection and response protection
- secure cloud backups
- staff cybersecurity awareness training
Within a few months the firm achieved **Cyber Essentials certification**, reduced security risks, and gained predictable monthly IT costs.
## Why Many London Law Firms Work With Techsperience
Techsperience provides **managed IT services specifically designed for law firms across London and the South East**. The company supports legal practices with **20–150 employees**, helping them maintain secure, compliant, and reliable technology environments.
Key areas of expertise include:
- Legal sector IT support
- Cyber Essentials and ISO27001 security alignment
- Microsoft 365 and cloud infrastructure
- Cybersecurity protection and monitoring
- Secure backup and disaster recovery
- Quarterly strategic IT planning (vCIO)
By combining **technical expertise with legal sector knowledge**, Techsperience helps law firms reduce risk, improve productivity, and maintain predictable technology costs.
## Quick Summary: Managed IT Costs for Law Firms
- 50-person firm: **£5,000–£7,500/month**
- Typical cost: **£100–£150 per user/month**
- Includes: support, cybersecurity, Microsoft 365, backup
- Higher costs reflect increased **security and compliance needs**
## Get a Managed IT Cost Estimate for Your Law Firm
Every law firm's technology environment is different. The best way to understand the exact cost of managed IT services is through a **brief technology assessment**.
A review typically examines:
- current IT infrastructure
- cybersecurity protections
- compliance requirements
- business growth plans
This allows firms to receive a **clear, predictable IT budget and roadmap for future improvements**.
**Techsperience provides managed IT services for law firms across London and the South East**, supporting legal practices with **20–150 employees** with cybersecurity, compliance, and strategic IT planning. Our team specialises in helping firms meet SRA expectations while improving productivity and reducing technology risk.
#### Frequently asked questions
**How much does managed IT cost for a law firm in London?**
For most law firms in London with 20–150 employees, managed IT services typically cost between £100 and £150 per user per month. A 50-person firm will usually invest £5,000–£7,500 per month in fully managed IT services covering helpdesk, cybersecurity, Microsoft 365, backup, and proactive monitoring.
**What should be included in managed IT support for a law firm?**
A comprehensive package should include unlimited helpdesk support, Microsoft 365 management, device monitoring and maintenance, endpoint security, email security and phishing protection, secure cloud backups, patch management, network monitoring, and remote and onsite support.
**What hidden IT costs should law firms avoid?**
Common hidden costs include separately charged backup services, cybersecurity add-ons not included in basic packages (endpoint protection, phishing training, monitoring), reactive break-fix support charges, and the absence of strategic IT planning that leads to unexpected technology costs.
**What factors determine managed IT pricing for a law firm?**
Five factors: number of users and devices, cybersecurity requirements (advanced tools like EDR, email security, MFA), compliance requirements (Cyber Essentials, ISO27001, SRA, GDPR), cloud vs on-premise infrastructure, and the level of strategic IT services such as vCIO meetings and roadmapping.
---
### Choosing the Right IT Support
URL: https://techsperience.co.uk/resources/choose-it-provider-law-firm
Published: 2026-03-24
Author: Ben, Principal, Techsperience
Topic: Operations
> How to choose the right IT support provider for your law firm, including key criteria, questions to ask, and common mistakes to avoid.
## How Do You Choose the Right IT Support Provider for a Law Firm?
Choosing the right IT support provider is an important decision for any law firm. Technology underpins everything from document management to client communication, and poor IT support can lead to downtime, security risks, and inefficiencies.
For most law firms with **20–150 employees**, selecting an IT provider involves evaluating not just technical capability, but also **industry experience, cybersecurity expertise, and the ability to support long-term growth**.
A well-chosen IT partner can improve system reliability, strengthen cybersecurity, and provide strategic guidance that supports the firm's development.
## The 5 Key Criteria for Choosing an IT Provider
When evaluating IT support providers, law firms should focus on a number of key factors.
### 1. Experience Supporting Law Firms
Providers with experience in the legal sector understand:
- how law firms operate
- the importance of confidentiality
- common legal software platforms
- regulatory expectations
A provider that specialises in law firms is more likely to deliver relevant and effective support.
### 2. Cybersecurity and Compliance Expertise
Cybersecurity is a critical consideration for law firms.
Your IT provider should be able to demonstrate:
- knowledge of **SRA expectations**
- experience with **Cyber Essentials and ISO27001 frameworks**
- implementation of strong security controls
- ongoing monitoring and risk management
You can learn more about required protections in our guide on [what the SRA actually expects from a law firm’s cybersecurity](/resources/sra-cybersecurity-expectations).
### 3. Proactive Support and Monitoring
Modern IT support should focus on preventing problems, not just reacting to them.
Look for providers offering:
- proactive system monitoring
- regular maintenance and updates
- performance optimisation
- fast response times for support requests
This helps minimise disruption and improve system reliability.
### 4. Clear Pricing and Service Structure
Law firms benefit from predictable IT costs.
A good provider should offer:
- transparent pricing
- clearly defined service inclusions
- scalable packages as the firm grows
To understand typical costs, see our guide on [how much managed IT services cost for law firms in London](/resources/managed-it-cost-law-firms).
### 5. Strategic IT Guidance
Beyond day-to-day support, your IT provider should help plan for the future.
This may include:
- technology roadmaps
- budgeting and cost planning
- advice on cloud systems and infrastructure
- guidance on adopting new technologies such as AI
Learn more in our guide on [how AI can improve productivity in law firms](/resources/ai-productivity-law-firms).
## Questions to Ask an IT Support Provider
When speaking with potential providers, law firms should ask:
- Do you specialise in supporting law firms?
- How do you handle cybersecurity and compliance?
- What is included in your managed IT service?
- How quickly do you respond to support requests?
- How do you support firms as they grow?
These questions help identify whether the provider is a good fit.
## Red Flags to Watch For
Not all IT providers offer the same level of service.
Potential warning signs include:
- lack of legal sector experience
- unclear or inconsistent pricing
- reactive support model (fixing problems only when they occur)
- limited cybersecurity expertise
- poor communication or slow response times
These issues can lead to increased risk and operational disruption.
## The Importance of a Structured Onboarding Process
Switching IT providers can seem complex, but a structured onboarding process ensures a smooth transition.
A typical process includes:
- reviewing existing systems and infrastructure
- documenting users and access
- implementing monitoring and security tools
- ensuring backups are properly configured
- providing a clear transition plan
This allows the firm to move providers with minimal disruption.
## Example: Choosing an IT Provider for a London Law Firm
A **35-person law firm in London** recently reviewed its IT support arrangements after experiencing slow response times and limited cybersecurity visibility.
When selecting a new provider, the firm prioritised:
- legal sector experience
- proactive support
- improved cybersecurity protections
- clear pricing structure
After transitioning to a managed IT provider, the firm saw improved system reliability, faster support response times, and stronger security controls.
## Why Law Firms Work With Techsperience
Techsperience provides **managed IT services for law firms across London and the South East**, supporting practices with **20–150 employees**.
Key areas of expertise include:
- legal-sector IT expertise
- SRA, Cyber Essentials, and ISO27001 alignment
- all-in-one packages covering security, backup, and support
- proactive monitoring and helpdesk services
- quarterly vCIO technology planning
- guidance on AI and process improvement
This ensures law firms have a secure and scalable technology environment.
## Need Help Choosing the Right IT Provider?
Selecting the right IT partner is an important decision that can impact your firm's security, efficiency, and long-term growth.
A consultation can help you:
- assess your current IT setup
- identify risks and gaps
- understand available options
- plan improvements
With the right support, law firms can ensure their technology environment is secure, reliable, and aligned with business objectives.
**Techsperience provides managed IT services for law firms across London and the South East**, supporting legal practices with **20–150 employees** with cybersecurity, compliance, and strategic IT planning. Our team specialises in helping firms meet SRA expectations while improving productivity and reducing technology risk.
#### Frequently asked questions
**What are the key criteria for choosing an IT provider for a law firm?**
Five key criteria are: experience supporting law firms, cybersecurity and compliance expertise, proactive support and monitoring, clear pricing and service structure, and strategic IT guidance. A provider that specialises in law firms is more likely to deliver relevant and effective support.
**What questions should a law firm ask an IT support provider?**
Ask: Do you specialise in supporting law firms? How do you handle cybersecurity and compliance? What is included in your managed IT service? How quickly do you respond to support requests? How do you support firms as they grow? These questions help identify whether the provider is a good fit.
**What red flags should law firms watch for when evaluating IT providers?**
Warning signs include lack of legal sector experience, unclear or inconsistent pricing, a reactive support model (fixing problems only when they occur), limited cybersecurity expertise, and poor communication or slow response times. These issues can lead to increased risk and operational disruption.
**What does a structured IT onboarding process look like?**
A typical process includes reviewing existing systems and infrastructure, documenting users and access, implementing monitoring and security tools, ensuring backups are properly configured, and providing a clear transition plan. This allows the firm to move providers with minimal disruption.
---
### Managed IT Support
URL: https://techsperience.co.uk/resources/managed-it-support-law-firms
Published: 2026-03-18
Author: Ben, Principal, Techsperience
Topic: Operations
> What managed IT support includes for law firms, from helpdesk and cybersecurity to backup, Microsoft 365 management, and strategic vCIO planning.
## What Does Managed IT Support Include for Law Firms?
Managed IT support has become the standard approach for many law firms looking to maintain secure, reliable, and well-managed technology systems. Rather than reacting to issues as they arise, managed IT services provide **ongoing support, proactive maintenance, and cybersecurity protection**.
For most law firms with **20–150 employees**, managed IT support typically includes a combination of helpdesk support, system monitoring, cybersecurity tools, and strategic IT planning. These services are usually delivered for a **fixed monthly cost**, allowing firms to budget for IT more effectively.
Understanding what is included in a managed IT service helps law firms compare providers and ensure they are receiving the level of support required to protect client data and maintain efficient operations.
## Core Components of Managed IT Support
Managed IT support is designed to cover all aspects of a firm's technology environment. While services may vary slightly between providers, most include the following core components:
- day-to-day IT support for staff
- proactive system monitoring
- cybersecurity protection
- cloud and Microsoft 365 management
- backup and disaster recovery
- system maintenance and updates
These services work together to ensure systems remain secure, stable, and efficient.
## 1. IT Helpdesk Support
Helpdesk support provides assistance to staff when technical issues arise.
### What this includes:
- troubleshooting hardware and software issues
- resolving login and access problems
- supporting email and Microsoft 365
- assisting with device setup and configuration
For law firms, fast and reliable helpdesk support is essential to minimise disruption to fee earners and maintain productivity.
## 2. Proactive Monitoring and Maintenance
Managed IT services focus on preventing issues rather than simply fixing them.
### What this includes:
- 24/7 system monitoring
- identifying potential issues before they cause downtime
- performance optimisation
- regular system health checks
This proactive approach helps reduce unexpected outages and improves overall system reliability.
## 3. Cybersecurity Protection
Cybersecurity is a critical component of managed IT support for law firms.
### Typical protections include:
- multi-factor authentication (MFA)
- endpoint protection against malware and ransomware
- email security and phishing protection
- device encryption
- security monitoring and alerts
These protections help ensure that sensitive client data remains secure.
For more detail on required protections, see our guide on [what the SRA actually expects from a law firm’s cybersecurity](/resources/sra-cybersecurity-expectations).
## 4. Microsoft 365 and Cloud Management
Most law firms rely on cloud platforms such as Microsoft 365.
### This typically includes:
- user account management
- email configuration and support
- SharePoint and OneDrive management
- Teams setup and support
- security configuration for cloud services
Effective cloud management ensures staff can work securely from multiple locations.
## 5. Backup and Disaster Recovery
Data protection is essential for legal practices.
### Managed IT services typically include:
- automated daily backups
- secure offsite or cloud storage
- backup monitoring
- regular testing of data recovery
These systems ensure that data can be restored quickly in the event of ransomware attacks or accidental deletion.
For many law firms, much of the required security infrastructure is already in place through **managed IT services and cybersecurity tools**.
## 6. System Updates and Patch Management
Keeping systems up to date is a key part of maintaining security.
### This includes:
- regular software updates
- operating system patching
- security updates for applications
- vulnerability management
Timely updates reduce the risk of cyber attacks exploiting known vulnerabilities.
## 7. IT Strategy and vCIO Support
In addition to day-to-day support, many managed IT providers offer strategic guidance.
### This may include:
- quarterly IT reviews
- technology planning aligned with business goals
- budgeting and cost planning
- recommendations for system improvements
- guidance on adopting new technologies such as AI
This helps law firms ensure their technology supports long-term growth.
## How Managed IT Support Is Priced
Managed IT services are typically priced on a **per-user, per-month basis**.
For most law firms, costs typically range from **£100–£150 per user per month**, depending on the level of support and cybersecurity requirements.
To understand pricing in more detail, see our guide on [how much managed IT services cost for law firms in London](/resources/managed-it-cost-law-firms).
## Example: Managed IT Support for a 60-Person Law Firm
A **60-person law firm** might use a managed IT service that includes:
- unlimited helpdesk support
- proactive monitoring of all systems
- cybersecurity protection for devices and email
- Microsoft 365 management
- secure backup and disaster recovery
- quarterly IT strategy meetings
This allows the firm to maintain a secure and reliable IT environment without needing internal IT resources.
## How Managed IT Supports AI Adoption in Law Firms
As law firms begin adopting AI tools, having a well-managed IT environment becomes even more important.
Managed IT services help ensure that:
- AI tools are deployed securely
- data protection requirements are maintained
- systems remain stable and scalable
Learn more in our guide on [how AI can improve productivity in law firms](/resources/ai-productivity-law-firms).
## Why Law Firms Work With Techsperience
Techsperience provides **managed IT services for law firms across London and the South East**, supporting practices with **20–150 employees**.
Key areas of expertise include:
- legal-sector IT expertise
- SRA, Cyber Essentials, and ISO27001 alignment
- all-in-one packages covering security, backup, and support
- proactive monitoring and helpdesk services
- quarterly vCIO technology planning
- guidance on AI and process improvement
This ensures law firms have a secure and scalable technology environment.
## Need Support for Your Law Firm's IT Systems?
Managed IT services provide a structured and proactive approach to maintaining secure and reliable systems.
If your firm is reviewing its IT support, a consultation can help identify:
- current risks and gaps
- opportunities to improve security and efficiency
- the most appropriate support model
With the right IT partner, law firms can focus on delivering legal services while technology is managed effectively in the background.
**Techsperience provides managed IT services for law firms across London and the South East**, supporting legal practices with **20–150 employees** with cybersecurity, compliance, and strategic IT planning. Our team specialises in helping firms meet SRA expectations while improving productivity and reducing technology risk.
#### Frequently asked questions
**What does managed IT support include for a law firm?**
Managed IT support typically includes day-to-day IT support for staff, proactive system monitoring, cybersecurity protection, cloud and Microsoft 365 management, backup and disaster recovery, and system maintenance and updates. Most firms also receive strategic IT planning through quarterly vCIO reviews.
**How much does managed IT support cost for law firms?**
Managed IT services are typically priced on a per-user, per-month basis. For most law firms, costs range from £100–£150 per user per month, depending on the level of support and cybersecurity requirements.
**How does managed IT support cybersecurity for law firms?**
Typical protections include multi-factor authentication (MFA), endpoint protection against malware and ransomware, email security and phishing protection, device encryption, and security monitoring and alerts. These protections help ensure that sensitive client data remains secure.
**How does managed IT support AI adoption in law firms?**
Managed IT services help ensure that AI tools are deployed securely, that data protection requirements are maintained, and that systems remain stable and scalable as new technologies are introduced.
---
### Managed IT vs ad-hoc support: what changes when you have a plan
URL: https://techsperience.co.uk/resources/managed-it-vs-ad-hoc-support
Published: 2026-03-12
Author: Ben, Principal, Techsperience
Topic: Operations
> Most law firms start with a "guy who sorts the computers." Here's what the transition to managed IT actually looks like — and what it costs to delay it.
Most law firms start the same way: a partner who is "good with computers," or a friendly local consultant who pops in when things break. It works fine until it doesn't — typically around the 20-fee-earner mark, when the cost of an unscheduled outage starts to be felt in billable hours rather than in afternoons.
This article is for managing partners and practice managers wondering whether the transition to managed IT is worth making. The short answer: yes, and probably sooner than you think. The longer answer is below.
## Ad-hoc support: what you actually buy
Ad-hoc IT — also called "break-fix" or "time-and-materials" — is a transactional model. Someone bills you when they fix a thing. The implications are predictable:
- **Reactive by design.** The IT firm only makes money when something breaks. There is no commercial incentive to prevent the break.
- **No visibility.** Nobody is looking at your environment when you're not actively asking them to. Patches drift. Backups silently fail. Permissions accumulate.
- **No plan.** Strategic IT decisions — when to refresh the laptops, what to do about the partner working from a country house, whether your practice-management software is still fit for purpose — happen by accident, if at all.
- **Variable spend.** Some months are quiet. Some months are not. You can't budget for the not-quiet months.
For a 5-person firm, this is fine. For a 25-person firm with SRA obligations and £4m of annual revenue running through Microsoft 365, it isn't.
## Managed IT: what changes
Managed IT is a fixed-fee model. You pay per user per month; the IT firm takes ongoing responsibility for keeping your environment current, secure, and aligned with your firm's needs. Three things change immediately:
**01. The incentives flip.** A managed-IT firm makes more profit when fewer things go wrong. Time spent fixing the same problem twice is time the firm doesn't recover. The cheapest path to profit is preventing problems in the first place.
**02. Strategy becomes part of the relationship.** Most reputable managed-IT contracts include some form of quarterly review — what we call a vCIO session. The conversation shifts from "the email server crashed" to "we're hiring three new fee-earners next quarter; here's the kit, the licences, and the security implications."
**03. Compliance becomes routine.** SRA expectations, Cyber Essentials, GDPR, ISO 27001 — these stop being annual fire-drills. They become ambient outcomes of how the firm is run.
## What it costs to delay
The honest list:
- **Outages last longer.** Without proactive monitoring, problems get noticed when a fee-earner can't work — usually mid-afternoon Friday. Fixing them then is harder, slower, and more expensive than preventing them.
- **Insurance gets harder.** Cyber-insurance underwriters now ask very specific questions about access controls, MFA, backup integrity, and patching cadence. The answers are easy if you have managed IT. They're awkward if you don't.
- **Audits become projects.** Without continuous alignment, every SRA file review or client security questionnaire becomes a six-week scramble. With managed IT, the answers are already on the page.
- **The senior partner becomes the IT director.** This is the one nobody puts on the spreadsheet. Time spent thinking about IT problems is time not spent on fee-earning work, client relationships, or actually running the firm.
## The transition itself
Switching from ad-hoc to managed IT is less disruptive than most firms fear. A reputable managed-IT firm will:
1. Audit your existing environment and document it (often more thoroughly than the previous arrangement ever was).
2. Migrate licence ownership to your firm's name where it isn't already (a surprisingly common gap).
3. Standardise device builds, security baselines, and backup posture — usually in the first 60 days.
4. Establish the cadence of strategic reviews so the partners know where IT decisions are made.
Most transitions happen invisibly to fee-earners. The first thing they notice is that the helpdesk is now answered by someone whose name they recognise.
## Is managed IT right for every firm?
No. A genuinely small firm — 5 fee-earners, off-the-shelf Microsoft 365, no specific compliance overlays — can probably run on ad-hoc support for some time. The economic case for managed IT becomes clear around the 15-to-20-fee-earner mark and is usually obvious by 25.
If you're between those numbers and uncertain, the honest answer is to ask. We're happy to tell you that you don't need us yet — we'd rather have that conversation now than convert a forced sale later.
#### Frequently asked questions
**What is managed IT?**
Managed IT is a model where an outside firm takes responsibility for your IT environment on an ongoing basis — proactively maintaining, monitoring, securing, and improving it — for a predictable monthly fee. It contrasts with ad-hoc support, where you call someone only when something is broken.
**How is managed IT different from a break-fix arrangement?**
Break-fix is reactive: you only pay when something breaks, and the IT firm only profits when something breaks. Managed IT is proactive: a fixed monthly fee creates the right incentives — the firm makes more money when fewer things go wrong.
**When should a law firm switch to managed IT?**
Most firms benefit from managed IT once they have around 15 fee-earners or more, particularly if they handle confidential client data and need SRA-aligned controls. The economic case is usually obvious by 25 fee-earners.
---
### IT Systems for Law Firms
URL: https://techsperience.co.uk/resources/it-systems-law-firms
Published: 2026-03-09
Author: Ben, Principal, Techsperience
Topic: Technology
> The core IT systems every mid-sized law firm should have in place — from Microsoft 365 and case management to cybersecurity, backup, and AI tools.
## What IT Systems Should a 50-Person Law Firm Have in Place?
Technology plays a critical role in modern legal practices. Law firms rely on secure IT systems to manage client data, collaborate internally, and deliver services efficiently. For a typical **50-person law firm**, the right technology environment must balance **security, reliability, and productivity**.
Most mid-sized law firms use a combination of **cloud services, cybersecurity protections, and legal practice software** to support their operations. A well-designed IT environment not only protects confidential client information but also improves efficiency across legal teams.
This guide explains the **core IT systems every mid-sized law firm should have in place** to support secure and productive operations.
## The Core Technology Stack for Modern Law Firms
A typical law firm technology environment consists of several key components that work together to support daily operations.
These usually include:
- secure cloud productivity tools
- document and case management systems
- cybersecurity protection
- secure backup and disaster recovery
- collaboration and communication tools
- IT monitoring and support
Together, these systems form the foundation of a **secure and reliable legal IT infrastructure**.
## 1. Secure Cloud Productivity Platform
Most modern law firms use **Microsoft 365** as their primary productivity platform.
This typically includes:
- Outlook for email
- Microsoft Teams for communication
- SharePoint for document storage
- OneDrive for secure file sharing
- Microsoft Word and Excel for legal documents
Cloud platforms allow lawyers to **work securely from multiple locations while maintaining strong data protection controls**.
## 2. Legal Document and Case Management Systems
Law firms rely on specialised software to organise case files and manage client information.
Examples include:
- legal case management platforms
- document management systems
- time tracking and billing software
- secure document sharing tools
These systems help legal teams:
- organise case files
- manage client communications
- track billable work
- collaborate securely across teams
Proper configuration and security controls are essential to protect confidential legal information.
## 3. Cybersecurity Protection
Cybersecurity is one of the most important components of a law firm's IT environment.
Key protections should include:
### Multi-Factor Authentication (MFA)
MFA adds an additional layer of protection when accessing email, cloud services, and remote systems.
### Endpoint Security
Modern endpoint protection helps detect malware and ransomware attacks before they spread.
### Email Security
Advanced filtering helps block phishing emails and malicious attachments.
### Device Encryption
Encryption protects sensitive data stored on laptops and mobile devices.
Because law firms handle sensitive client information, strong cybersecurity controls are essential. You can learn more in our guide on [what the SRA actually expects from a law firm’s cybersecurity](/resources/sra-cybersecurity-expectations).
## 4. Secure Backup and Disaster Recovery
Reliable backups are essential for protecting legal data.
A good backup strategy should include:
- automated daily backups
- secure offsite storage
- encrypted data protection
- regular backup testing
These protections ensure that the firm can **recover quickly from ransomware attacks, hardware failures, or accidental data loss**.
## 5. IT Monitoring and Support
As law firms grow, managing IT systems internally becomes increasingly complex.
Many firms use **managed IT services** to monitor systems and provide ongoing support.
Managed services typically include:
- proactive system monitoring
- helpdesk support for staff
- security updates and patching
- backup monitoring
- IT strategy planning
To understand how these services are typically priced, see our guide on [how much managed IT services cost for law firms in London](/resources/managed-it-cost-law-firms).
## 6. Collaboration and Communication Tools
Legal teams often collaborate across departments and locations. Modern collaboration tools make this easier.
Common tools include:
- Microsoft Teams for messaging and meetings
- secure file sharing platforms
- video conferencing tools
- shared calendars and task management systems
These tools help lawyers work efficiently while maintaining secure communication.
## 7. Artificial Intelligence and Automation Tools
Many law firms are beginning to adopt AI tools to improve productivity.
AI can assist with:
- document drafting
- legal research
- meeting summaries
- internal knowledge search
When implemented properly, AI tools can significantly reduce administrative workload. Learn more in our guide on [how AI can improve productivity in law firms](/resources/ai-productivity-law-firms).
## Example: Technology Setup for a 50-Person Law Firm
A typical technology stack for a mid-sized law firm might include:
| System | Example Tools |
|--------|---------------|
| Productivity platform | Microsoft 365 |
| Document storage | SharePoint / OneDrive |
| Communication | Microsoft Teams |
| Cybersecurity | Endpoint protection + MFA |
| Backup | Cloud backup system |
| Monitoring | Managed IT monitoring tools |
This type of environment provides **secure access, strong cybersecurity protections, and reliable system performance**.
## Why Law Firms Work With Techsperience
Techsperience provides **managed IT services and cybersecurity support for law firms across London and the South East**, helping legal practices with **20–150 employees** maintain secure and reliable technology environments.
Key services include:
- legal-sector IT expertise
- Microsoft 365 environments for law firms
- cybersecurity aligned with SRA expectations
- secure backup and disaster recovery
- proactive IT monitoring and support
- quarterly vCIO technology planning
By combining technical expertise with legal sector knowledge, Techsperience helps law firms build **secure, scalable IT systems that support growth**.
## Need Help Reviewing Your Law Firm's IT Systems?
Technology requirements evolve quickly as law firms grow and adopt new tools. A structured IT review can help identify opportunities to improve security, efficiency, and reliability.
A technology assessment typically reviews:
- existing infrastructure
- cybersecurity protections
- cloud systems and collaboration tools
- opportunities for automation and AI
With the right technology foundation, law firms can operate securely while improving productivity and client service.
**Techsperience provides managed IT services for law firms across London and the South East**, supporting legal practices with **20–150 employees** with cybersecurity, compliance, and strategic IT planning. Our team specialises in helping firms meet SRA expectations while improving productivity and reducing technology risk.
#### Frequently asked questions
**What IT systems should a 50-person law firm have in place?**
A typical mid-sized firm needs secure cloud productivity tools (Microsoft 365), document and case management systems, cybersecurity protection (MFA, endpoint security, email security, encryption), secure backup and disaster recovery, collaboration and communication tools, and IT monitoring and support.
**Which productivity platform do most law firms use?**
Most modern law firms use Microsoft 365 as their primary productivity platform, including Outlook for email, Microsoft Teams for communication, SharePoint for document storage, OneDrive for secure file sharing, and Word and Excel for legal documents.
**What cybersecurity protections should a law firm IT environment include?**
Key protections include multi-factor authentication (MFA), modern endpoint security against malware and ransomware, advanced email filtering for phishing and malicious attachments, and device encryption for laptops and mobile devices.
**How can AI tools help a law firm?**
AI can assist with document drafting, legal research, meeting summaries, and internal knowledge search. When implemented properly within a secure environment, AI tools can significantly reduce administrative workload across legal teams.
---
### Consider this before using AI browsers at work
URL: https://techsperience.co.uk/resources/consider-these-before-using-ai-browsers-at-work
Published: 2026-03-02
Author: Ash, Microsoft 365 & Cloud, Techsperience
Topic: Technology
> AI browsers can boost productivity dramatically — but they can also quietly send sensitive data to the cloud. Here is what to think about before rolling them out.
Have you ever wondered what your browser is doing in the background while you work?
Most people think of a browser as a simple window to the internet. But a new wave of AI browsers is changing that idea completely.
These tools are clever, fast, and can automate tasks that used to take minutes, or even hours.
And that sounds great… until you realise they might also be quietly collecting or sending data you'd never normally share.
New technology is wonderful. But we know how quickly something helpful can become something risky when it's used in the wrong way. Or without the right safeguards.
AI browsers are a perfect example of that.
AI browsers (such as Microsoft Edge with Copilot, OpenAI's ChatGPT Atlas and others) are designed to boost productivity by doing more than displaying websites. They can read what's on the page, summarise it for you, translate it, gather data, and even take actions automatically.
But here's the problem: They can also be tricked.
Researchers found that "the default settings in many AI browsers prioritise a smooth user experience over strong security." In other words, the browser is designed to be helpful first and safe second.
And that's where things get messy for businesses.
Because these browsers don't just display your data. They often send what's on your screen to a cloud-based AI system so it can understand, summarise, or interact with it. That might include sensitive emails, financial information, client details, internal documents, or anything else an employee happens to have open at the time.
If the AI assistant sees it, there's a chance that data has already left your computer and been processed elsewhere.
This becomes even more concerning when you realise that some of these browsers can perform actions on their own. They can navigate websites during logged-in sessions, interact with content, and complete routine tasks.
That's brilliant for efficiency, but it also means they could be tricked by a malicious webpage and convinced to hand over information without the user even noticing.
The warning is clear: AI browsers can expose businesses to unnecessary risk if they're not configured and used correctly.
So, what do you need to think about before rolling them out?
Start with the basics: Understand where the data goes.
Many AI browsers don't allow you to keep the AI processing local on the device. Instead, everything is sent to the provider's cloud service.
That means your cyber security and data protection policies need to cover this. Especially if you work with sensitive information, regulated data, or anything involving clients.
It's also important to think about how staff will use these browsers day-to-day.
Even if the browser itself meets your security standards, an employee could easily introduce new risks by doing something as simple as opening an AI sidebar while sensitive information is visible on another tab. The AI doesn't know what's private, it processes what it can see.
And then there's the temptation issue.
Because these tools can automate boring tasks, some employees might try to use them to get through mandatory training or compliance activities. It's easy to forget that an automated click-through isn't the same as a trained, security-aware human.
None of this means AI browsers are bad. Far from it.
They're powerful, exciting tools with real business benefits. But like any emerging technology, they need guard rails.
If you decide to allow AI browsers in your business, make sure your staff understand how they work. Help them see that anything open in their browser could potentially be sent to the AI service.
Encourage them to avoid using AI functions while viewing highly sensitive data. And make sure your IT team can centrally manage security settings so that convenience never comes at the expense of safety.
We're still in the early days of AI browsers. Their risks aren't fully understood yet, and the default settings often favour convenience over protection. Use them responsibly, after proper risk assessments and training. Before you adopt an AI browser across your business, take the time to make sure you're doing it securely. If you need help with that, get in touch.
Not sure whether your firm has the guard rails in place yet? The free [Law Firm AI Readiness Check](/ai-readiness-check) takes about six minutes and tells you where the gaps are.
#### Frequently asked questions
**What is an AI browser?**
AI browsers (such as Microsoft Edge with Copilot, OpenAI's ChatGPT Atlas, and others) are designed to boost productivity by doing more than displaying websites. They can read what's on the page, summarise it, translate it, gather data, and even take actions automatically.
**What is the security risk with AI browsers?**
AI browsers often send what's on your screen to a cloud-based AI system to understand, summarise, or interact with it. That might include sensitive emails, financial information, client details, or internal documents. Default settings typically prioritise smooth user experience over strong security.
**Can AI browsers be tricked?**
Yes. Because some AI browsers can perform actions on their own — navigating websites, interacting with content, completing routine tasks — they could be tricked by a malicious webpage and convinced to hand over information without the user even noticing.
**How should businesses approach AI browsers safely?**
Make sure staff understand how they work, encourage them to avoid using AI functions while viewing highly sensitive data, and ensure your IT team can centrally manage security settings so convenience never comes at the expense of safety. Conduct proper risk assessments and training before adoption.
---
### PowerPoint drops its "Reuse Slides" feature
URL: https://techsperience.co.uk/resources/ppt-drops-its-reuse-slide-feature
Published: 2026-02-23
Author: Chris, Operations, Techsperience
Topic: Technology
> Microsoft has retired PowerPoint's much-loved Reuse Slides feature. Here is what changed and the workarounds that come closest to it.
Have you noticed that some changes don't feel like improvements?
Microsoft has announced that it's retiring PowerPoint's much loved Reuse Slides feature.
For anyone who builds presentations regularly, that's a real blow.
If you've never used it, Reuse Slides was one of those quiet, behind-the-scenes features that made life a lot easier.
It let you open a small panel within PowerPoint, browse through another presentation, and pick out the exact slides you wanted to reuse. You could even choose whether to keep the original formatting.
It was perfect for keeping your company's logo, colours, and layout looking consistent. And it was a huge time saver.
Instead of rebuilding every deck from scratch, teams could pull in existing slides from previous proposals, reports, or training materials. It kept things looking professional and saved hours of fiddling with design templates.
But earlier this year, that convenience disappeared.
Microsoft says it removed Reuse Slides because there are duplicate ways to do the same thing. It no longer makes sense to maintain overlapping features.
While that might be technically true, it's not much comfort for people who liked the simplicity of clicking one button and getting straight to work.
You can still reuse slides. It just takes an extra step or two.
One simple method is to open both PowerPoint files at once and drag and drop slides between them. This usually keeps most of your formatting, animations, and media in place.
Another option is to go to View > New Window, which opens a duplicate of your current deck. That's helpful if you want to work on a new version while keeping the original untouched.
These alternatives do the job, but they don't feel quite as seamless.
Reuse Slides gave you more control, especially when you only needed a few slides from a larger deck.
The drag and drop method can work, but it's less precise and can sometimes cause small formatting quirks that need tidying up afterwards.
Still, change is inevitable. Microsoft wants fewer overlapping features and a more streamlined experience, even if that means saying goodbye to a few long-standing favourites.
If your business relies on PowerPoint for client presentations, sales decks, or internal training, make sure your team knows about this change. Get them comfortable with the drag and drop method or the "New Window" trick to save time and confusion later.
And if you need help getting to grips with this, or any other change in Microsoft, get in touch.
#### Frequently asked questions
**Why has Microsoft removed the Reuse Slides feature?**
Microsoft says it removed Reuse Slides because there were duplicate ways to do the same thing, and it no longer made sense to maintain overlapping features. The change is part of a wider effort to streamline the PowerPoint experience.
**What did Reuse Slides actually do?**
Reuse Slides let you open a small panel within PowerPoint, browse through another presentation, and pick out the exact slides you wanted to reuse. You could even choose whether to keep the original formatting — useful for keeping your company's logo, colours, and layout consistent.
**How can I reuse slides now?**
You can still reuse slides; it just takes an extra step. Open both PowerPoint files at once and drag and drop slides between them, which usually keeps formatting, animations, and media in place. Alternatively, go to View > New Window to open a duplicate of your current deck.
**What should businesses do about this change?**
If your team relies on PowerPoint for client presentations, sales decks, or internal training, make sure they know about the change. Get them comfortable with the drag-and-drop method or the New Window trick to save time and confusion later.
---
### SRA cybersecurity expectations in plain English
URL: https://techsperience.co.uk/resources/sra-cybersecurity-expectations
Published: 2026-02-03 · Updated: 2026-09-05
Author: Kate, Compliance & Cybersecurity, Techsperience
Topic: Compliance
> The SRA doesn't specify a tech stack. It specifies outcomes. Here's what those outcomes demand from your IT environment in practice.
The SRA's approach to cybersecurity is unusual in regulated industries. Where the FCA prescribes, the ICO codifies, and the NCSC publishes detailed control catalogues, the SRA mostly stays out of technical specifics. It tells you what outcomes to achieve and leaves the *how* to your judgement.
That sounds permissive. In practice, it makes the SRA's expectations harder to satisfy, not easier — because outcome-based regulation gives you no checklist to hide behind. You're judged on whether your controls were proportionate to the risk, and that judgement happens after something has gone wrong.
This article is a plain-English translation of what the SRA actually expects from a law firm's IT environment, and what those outcomes demand technically.
## The four outcomes
The SRA's expectations boil down to four outcomes:
1. **Confidentiality of client information.** Only the right people can see client data.
2. **Integrity of client information.** Client data isn't tampered with — and you can prove it wasn't.
3. **Availability of client information.** When a fee-earner needs a file, they can get it.
4. **Demonstrability.** You can show the SRA, an auditor, or a client what you did and why.
Most cyber-incident findings against firms come back to a failure on one of those four. Usually more than one.
## What confidentiality requires technically
In practice, confidentiality requires:
- **Multi-factor authentication** on every account, every device, every entry point. No exceptions for partners. No exceptions for "the laptop only goes out once a month."
- **Access controls scoped to need-to-know.** A fee-earner working on Smith v Jones doesn't need access to Brown v Williams unless there's a reason. A receptionist doesn't need access to the matter files at all.
- **Encrypted devices.** Every laptop, tablet, and phone storing client data — even temporarily — must be encrypted at rest. Bitlocker on Windows, FileVault on Mac, MDM-enforced on mobiles.
- **Secure email.** End-to-end encryption isn't required, but transport encryption (TLS) is now table-stakes, and large or sensitive transfers should use a secure portal rather than attachment-by-email.
- **Confidentiality clauses in IT supplier contracts.** Your managed-IT firm should be bound by the same confidentiality expectations as the rest of your supply chain. Most aren't, by default.
## What integrity requires technically
- **Audit logs.** Who accessed what, when, from where. Microsoft 365 generates these automatically; most firms don't review them.
- **Version history.** Document management and matter management systems must keep version history that can't be silently overwritten.
- **Append-only audit trails for key events** — particularly client-money transactions, file changes by external counsel, and access events on confidential matters.
- **Backups that can't be deleted.** Ransomware attackers explicitly target backup systems. Immutable backups (cloud-stored, time-locked) are now standard practice.
## What availability requires technically
- **Tested backups.** Backups that have never been restored aren't backups; they're hopes. Restore drills, ideally quarterly, are how you find out.
- **Documented recovery time objectives.** How long can your firm function without email? Without the case management system? Without the document store? You should know, and you should have tested it.
- **Redundancy proportionate to risk.** A 25-person firm doesn't need geo-redundant infrastructure. It does need a clear answer to "what happens if the office floods."
- **Patched systems.** Most outages aren't dramatic; they're a six-month-old vulnerability in a system that wasn't updated. Continuous patching matters more than dramatic disaster-recovery investments.
## What demonstrability requires
This is the one most firms fail on. Even firms that have decent controls often can't *show* they have them. The minimum:
- **A written information-security policy.** Read by every staff member at induction and every year thereafter.
- **A documented incident response plan.** Specific to your firm, with named owners, current contact details, and a tested escalation path.
- **A risk register.** Identifying the cyber risks specific to your firm, the controls in place, and the residual risk.
- **Evidence of training.** Phishing-awareness training records for every staff member, refreshed annually at minimum.
- **An IT supplier register.** Naming every external party with access to your environment, the data they touch, and the contractual basis for their access.
If you can't produce any of those documents in 24 hours, you're below the SRA's expectations for demonstrability — regardless of how good your underlying controls are.
## What "proportionate" actually means
The SRA's proportionality principle is sometimes read as "we're a small firm, so the rules are looser." That's not what it means.
Proportionality is about *how* you achieve the outcomes, not *whether* you achieve them. A 20-person firm doesn't need a 24-hour Security Operations Centre staffed by analysts in shifts. It does need MFA, encrypted devices, secure backups, a phishing-aware staff, and a written response plan. The controls are smaller; the outcomes are the same.
## Where Cyber Essentials fits in
Cyber Essentials is a UK government scheme covering five technical controls: firewalls, secure configuration, user access control, malware protection, and patch management. It is not specifically required by the SRA, but it covers most of the technical baseline the SRA expects.
For most small law firms, achieving Cyber Essentials annually is the cleanest single way to satisfy the technical-control expectations. It does not, by itself, satisfy the demonstrability outcome — that requires policy, training, and incident-response work on top. Our [practical Cyber Essentials checklist](/resources/cyber-essentials-law-firms) covers what the five controls require and what to fix first.
ISO 27001 is the next step up: a full information-security management system with formal policies, risk assessment and audited governance. It takes four to twelve months rather than four to eight weeks, and it is the right answer for firms whose clients ask for it in due diligence — typically panel work for banks, insurers and large corporates. Most firms should get Cyber Essentials done first and build towards ISO 27001 from there rather than starting with it.
## How often the work has to happen
The SRA's outcomes are not satisfied once. A reasonable cadence for a 20-to-150-person firm:
| Activity | Frequency |
|----------|-----------|
| Security monitoring, patching, backup checks | Continuous |
| Vulnerability scanning | Monthly |
| Staff phishing and security training | Quarterly |
| IT strategy review with the partners | Quarterly |
| Cyber Essentials recertification, policy and risk-register review | Annually |
None of this is expensive if it is built into how the environment is run. For a firm of this size the whole set of controls above normally sits inside a managed-IT contract at [£100 to £150 per user per month](/resources/managed-it-cost-law-firms). What is expensive is doing it as a project every time a client questionnaire arrives.
## What to do if you're worried
The honest test: pick a fee-earner at random. Ask them to walk you through what they'd do if their laptop were stolen on the train tonight. If the answer involves uncertainty about whose number to call, what data is on the device, or whether the firm even knows it's missing, you have an SRA exposure.
Fixing it doesn't require a six-figure programme. It requires a small number of unglamorous controls done consistently. That's the work most managed-IT firms quietly skip — and the work the SRA actually cares about.
#### Frequently asked questions
**Does the SRA require Cyber Essentials?**
No, the SRA does not formally require Cyber Essentials certification. However, Cyber Essentials covers most of the technical controls the SRA expects firms to have in place, so achieving certification is a useful way to demonstrate alignment.
**What does the SRA expect from a law firm's IT?**
The SRA expects firms to protect the confidentiality, integrity, and availability of client information. In practice, this means access controls, MFA on all accounts, encrypted devices, secure email, audit trails, retention policies, and a tested incident response plan.
**What happens if a law firm has a cyber breach?**
A material breach must be reported to the SRA, the ICO (under UK GDPR), and any affected clients. The SRA will assess whether the firm's controls were proportionate and whether the breach response was adequate. Fines, conditions, and adverse findings are all on the table.
**Do small law firms have the same cybersecurity obligations as large ones?**
The obligations are the same — but the SRA expects controls to be proportionate to the firm's size and risk profile. A 20-person firm doesn't need a 24-hour SOC team; it does need MFA, encrypted laptops, secure backups, and a written response plan.
**How much does SRA-grade cybersecurity cost a law firm?**
For a firm of 20 to 150 staff, the controls the SRA expects — MFA, managed and encrypted devices, endpoint detection, email filtering, immutable backups, patching, monitoring and staff training — are normally delivered inside a managed-IT contract at £100 to £150 per user per month, rather than bought as separate products. Cyber Essentials certification should be included in that, not charged on top.
**How often should a law firm review its cybersecurity?**
Continuously for monitoring and patching, monthly for vulnerability scanning, quarterly for staff phishing training and the IT strategy review with the partners, and annually for Cyber Essentials recertification and a policy review. Cybersecurity is a cadence, not a project.
---
### Cyber Essentials for law firms: a practical checklist
URL: https://techsperience.co.uk/resources/cyber-essentials-law-firms
Published: 2026-01-18 · Updated: 2026-09-05
Author: Kate, Compliance & Cybersecurity, Techsperience
Topic: Compliance
> Cyber Essentials is the right starting point for most small firms. Here's what it actually requires, and what to fix first if you're starting from scratch.
Cyber Essentials is a UK government-backed certification covering five technical control areas. For law firms wondering where to start with cyber posture, it's almost always the right first step. This article walks through what it actually requires, what trips firms up, and what to fix first if you're starting from scratch.
## The five control areas
**01. Firewalls.** Boundary firewalls between your network and the internet, configured to deny by default and only permit specific, justified traffic. Personal firewalls on each end-user device.
**02. Secure configuration.** Default configurations are insecure. Default admin passwords must be changed. Unused accounts must be disabled. Unnecessary software and services must be removed. Mobile devices must be encrypted and remotely wipeable.
**03. User access control.** Each user has their own account. Administrative privileges are limited to those who need them. Accounts are removed promptly when staff leave. Multi-factor authentication is enabled on cloud services. Strong password practices are enforced.
**04. Malware protection.** Anti-malware running on every device. Application allowlisting on servers and key endpoints. Auto-updates enabled. Email and web filtering in place.
**05. Patch management.** Operating systems and software receive security updates within 14 days of release. End-of-life software is removed or replaced. Internet-facing systems are patched first.
The full requirements are published by the IASME Consortium, the body that runs Cyber Essentials on behalf of the NCSC. They are revised annually, usually each April.
## Where small law firms typically fall short
The certification process is a self-assessment, but the assessment is rigorous. The most common gaps in our experience:
- **Personal devices used for work** — laptops at home, partners using personal phones for email — without enrolment in mobile device management.
- **Accounts of leavers still active** — particularly for cloud services that were set up by a single user (Dropbox, DocuSign, e-discovery tools).
- **Default Microsoft 365 settings** — particularly conditional access policies, MFA enforcement, and external sharing rules.
- **Unmanaged software** — applications installed by individual fee-earners outside IT's knowledge, particularly Chrome extensions and macOS App Store installs.
- **Patching gaps** — especially on third-party software (Adobe Acrobat, Zoom, browser extensions) where automatic updates aren't enabled.
None of these are dramatic. They are the consequences of an environment that has been allowed to accumulate.
## What to fix first
If you're a 20-to-50-person firm starting from scratch, the order of operations:
1. **Enable MFA on Microsoft 365 for everyone, no exceptions.** Single biggest risk reducer. Should take a week including communication and rollout.
2. **Inventory every device that touches firm data.** You cannot secure what you can't list. Include personal devices used for email.
3. **Enrol every device in management** — Microsoft Intune is the default; equivalents exist for Mac and mobile. This is what makes the rest of the controls enforceable.
4. **Audit user accounts.** Every active account, every cloud service, every shared mailbox. Disable everything that doesn't have a current owner.
5. **Standardise device builds.** Encryption on. Auto-lock on. Auto-update on. Personal-firewall on. Browser locked down.
6. **Establish a patching cadence.** Microsoft 365 and Windows Update first. Third-party software next.
Once the above is in place, the Cyber Essentials assessment is straightforward. Most firms with managed IT achieve it within four weeks of starting; firms starting from a longer-neglected position should plan for two to three months including remediation.
## What Cyber Essentials doesn't cover
Cyber Essentials covers technical controls. It does not cover:
- Staff training and phishing awareness
- Written information-security policies
- Incident response procedures
- Backup integrity and restore testing
- Supplier and third-party risk management
- Physical security
- ISO 27001-grade governance
For SRA expectations, these matter at least as much as the technical baseline. Cyber Essentials is the foundation; the rest is what makes the firm actually defensible. We've written up [what the SRA actually expects from a law firm's cybersecurity](/resources/sra-cybersecurity-expectations) separately, outcome by outcome.
## Cyber Essentials Plus
Cyber Essentials Plus is the audited version of the same standard. Where Cyber Essentials is a self-assessment, Cyber Essentials Plus involves an assessor running a controlled set of technical tests against your environment. It is meaningfully more credible — particularly to insurers and to clients running supplier-due-diligence processes.
For firms with material exposure (M&A practices, family law for high-net-worth clients, cross-border litigation), Plus is increasingly worth the additional cost. For most small commercial-practice firms, base-level Cyber Essentials remains a sensible annual exercise.
## What it costs, and who pays
The assessment fee itself is small: from £320 + VAT for the smallest firms to around £600 + VAT above 50 staff, set by IASME and revised occasionally. The real cost is the remediation, and that is where the contract with your IT provider matters. A managed-IT firm that runs your environment to the standard continuously has nothing extra to do at assessment time, which is why Techsperience includes the certification in the monthly fee rather than quoting it as a project. If your provider charges separately for Cyber Essentials, ask what they are doing the rest of the year. There is more on [what managed IT should cost a law firm](/resources/managed-it-cost-law-firms) if you want to check the number.
If you'd like to know where your firm currently stands against Cyber Essentials, the honest answer takes about 90 minutes to find out. We're happy to do that as part of an opening conversation — but only after we've agreed to work together.
#### Frequently asked questions
**What is Cyber Essentials?**
Cyber Essentials is a UK government-backed certification scheme covering five technical control areas: firewalls, secure configuration, user access control, malware protection, and patch management. It is awarded annually after a self-assessment review.
**How much does Cyber Essentials cost?**
Cyber Essentials assessment fees range from £320 + VAT for very small firms to around £600 + VAT for firms over 50 employees. Most managed-IT contracts include the certification work as part of the standard fee — Techsperience does, at no additional charge.
**How long does Cyber Essentials certification take?**
For a firm with reasonable existing controls, certification can be achieved in two to four weeks from start to finish. Firms with significant gaps may need eight to twelve weeks of remediation before submitting the assessment.
**Is Cyber Essentials enough for a law firm?**
Cyber Essentials covers the technical baseline. It does not cover staff training, written policies, incident response procedures, or supplier management — all of which the SRA expects. Cyber Essentials is a foundation, not a finish line.
**What is the difference between Cyber Essentials and Cyber Essentials Plus?**
Cyber Essentials is a self-assessment questionnaire reviewed by a certification body. Cyber Essentials Plus covers the same five controls but adds an independent technical audit: an assessor runs vulnerability scans and hands-on tests against a sample of your devices. Plus is meaningfully more credible to insurers and to clients running supplier due diligence, and most firms start with the base level and progress to Plus.
**Does the SRA require Cyber Essentials?**
No. The SRA does not mandate any particular certification. It expects proportionate controls that protect client confidentiality, and Cyber Essentials covers most of the technical ones, which is why it is the cleanest single way for a small firm to demonstrate the technical baseline.
---
### What should IT cost per user in a law firm?
URL: https://techsperience.co.uk/resources/it-cost-per-user-law-firm
Published: 2025-12-07
Author: Ben, Principal, Techsperience
Topic: Pricing
> The honest answer with real numbers. Why the range is wide, what drives the high end, and how to benchmark your current spend.
This is one of the most-searched questions in legal-IT, and most answers are unhelpful. They're either vendor-marketing pieces ("call us for a quote!") or industry surveys averaging across firms of wildly different sizes and risk profiles. This article gives the honest answer with real numbers — and the reasons the range is as wide as it is.
## The headline numbers
For a UK private-practice law firm using managed IT:
- **Managed-IT services:** £100 to £150 per user per month
- **Microsoft 365 licensing:** £20 to £45 per user per month (depending on plan)
- **Practice-management software:** £30 to £60 per user per month (varies enormously by vendor)
- **Other software (e-signature, dictation, e-discovery, comms):** £10 to £30 per user per month
**Total ongoing spend: £160 to £285 per user per month.**
That doesn't include hardware refresh (typically £30 to £50 per user per month if you amortise a 3-to-4-year laptop refresh), one-off project work (office moves, migrations, upgrades), or the costs of doing it badly (outages, breaches, missed audits).
For a 50-person firm, £160 to £285 per user per month works out to £96,000 to £171,000 per year. For 100 people, it's £192,000 to £342,000.
## Why the range is wide
Three factors drive most of the variance:
**01. Cybersecurity intensity.** Firms handling high-value M&A work, family law for high-net-worth clients, or large client-money flows have stricter security needs than a high-street commercial practice. The latter sits at £100/user/month for managed services; the former sits at £150.
**02. Software stack complexity.** A clean Microsoft 365 firm with one practice-management system and a document store is cheap to run. A firm with three legacy applications, two case-management systems from a recent merger, and a dictation workflow that hasn't been touched in eight years isn't.
**03. Working pattern.** A single-office firm where everyone works on-premises four days a week is simpler than a firm with a London HQ, two regional offices, frequent court appearances, and partners working from country homes. The technology has to follow the people; that costs more to do well.
## How to benchmark your current spend
Most firms can't easily produce a per-user IT spend figure. Costs are spread across managed-services contracts, Microsoft licences, individual software subscriptions, hardware refresh budgets, and ad-hoc consulting. To benchmark properly:
1. **Add up everything.** Managed services. All software licences. All hardware bought in the last three years (divided by three for an annualised figure). All consulting and project work. All cyber-insurance premiums. Anything labelled "IT" in the P&L.
2. **Divide by your average headcount over that period.** Use fee-earners + support staff combined, not just fee-earners.
3. **Compare to the ranges above.** If you're significantly below £160/user/month all-in, you're likely under-investing — particularly in security or strategic IT. If you're significantly above £285/user/month, you may have technical-debt accumulation, vendor sprawl, or over-engineered infrastructure.
## When the cheap answer isn't actually cheap
The most common pattern we see in firms that have under-invested in IT: a managed-IT contract priced at £60-£80 per user per month with no vCIO time, no continuous alignment review, no SOC monitoring, and a helpdesk that's actually a four-person team in a shared service handling fifty other clients.
The headline price looks competitive. The total cost of ownership doesn't, once you factor in:
- Outages that could have been prevented
- Audit findings that take legal time to remediate
- Cyber-insurance premiums that tick up year-on-year because the underwriter sees gaps
- Time the senior partner spends acting as an unofficial IT director
- Breach risk that would-be acquirers will discount your firm for
The right comparison isn't "is £60 cheaper than £125 per user per month." It's "what does £60-grade IT actually cost the firm by the end of three years."
## Pricing posture: published vs custom-quoted
Most managed-IT firms refuse to publish their pricing. The reasoning given is that "every firm is different" — and there is a grain of truth to that — but the actual reason is that the call where pricing is discussed is also the call where the firm tries to sell you a higher tier than you needed.
Techsperience publishes its range — £100 to £150 per user per month — because we'd rather you know the number before you pick up the phone. If our range is wrong for your firm, fine. Better to find out in two minutes on a website than after a forty-minute call neither of us wanted to have.
#### Frequently asked questions
**How much should a law firm spend on IT per user?**
For a UK private-practice law firm with managed IT, expect to spend £100 to £150 per user per month on managed services, plus an additional £50 to £80 per user per month on Microsoft 365 licensing and core software. Total ongoing spend lands at £150 to £230 per user per month, excluding hardware refresh and one-off projects.
**What does Microsoft 365 cost for a law firm?**
Most UK law firms use Microsoft 365 Business Premium (£18.10 per user per month, ex VAT) or Office 365 E3 / E5 for larger firms. Add Intune, Azure AD Premium, and Defender for Business as needed. Expect £20 to £45 per user per month for Microsoft licensing alone.
**Are managed IT contracts cheaper than hiring in-house?**
For firms under approximately 80 staff, managed IT is usually meaningfully cheaper than hiring in-house. A capable in-house IT manager costs £55,000 to £75,000 per year fully loaded; a managed-IT contract for the same firm typically lands at £40,000 to £80,000 per year — and includes 24×7 monitoring, vCIO time, and tools no in-house hire could justify.
**Should hardware be included in IT pricing?**
Generally no. Most managed-IT contracts price the service per user per month and quote hardware separately at supplier list price (or modestly above). Mixing them tends to obscure both lines.
---
### Managed IT vs in-house IT for law firms: when does hiring make sense?
URL: https://techsperience.co.uk/resources/managed-it-vs-in-house
Published: 2025-11-14 · Updated: 2026-09-05
Author: Ben, Principal, Techsperience
Topic: Operations
> Sometimes a full-time hire is the right answer. Here's the honest comparison — costs, cover, expertise — including the cases where we'd tell a firm to hire internally.
The "should we hire in-house or use a managed-IT firm?" question is asked a lot, and most answers are either self-serving (managed-IT firms saying "use us") or romanticised (firms imagining a single brilliant IT manager who'll solve everything). Neither is right.
This article gives the honest comparison, including the cases where we'd tell a firm to hire internally rather than work with us.
## What a managed-IT firm gives you
A reputable managed-IT firm gives you:
- A team of people, with overlapping skills, available across business hours and on-call out-of-hours
- 24×7 Security Operations Centre cover (almost impossible to replicate in-house under 200 staff)
- Tools and platforms that wouldn't be cost-effective for a single firm (RMM, MDR, ticketing, audit tooling, vCIO software)
- A vCIO presence at the partners' table
- Continuous Technology Alignment review against industry standards
- Compliance posture (Cyber Essentials, ISO 27001 alignment, SRA expectations) baked in
- Continuity when individuals are on holiday or leave
The headline cost for a UK law firm is £100 to £150 per user per month, plus software licences and hardware. There is a fuller breakdown of [what managed IT support includes for a law firm](/resources/managed-it-support-law-firms) and [what it should cost](/resources/managed-it-cost-law-firms) if you want to check either side of the comparison.
## What an in-house IT person gives you
A full-time IT manager gives you:
- Someone who works for your firm, in your office, with your culture
- Deep familiarity with your specific environment, software stack, and people
- Same-day responsiveness on minor issues — fee-earners can walk over to the IT desk
- A single internal voice for IT decisions
- Capacity for project work without separate quotes
The headline cost for a UK law firm in London or the Home Counties is £55,000 to £75,000 fully loaded for a capable IT manager. A junior support hire is £30,000 to £40,000.
## Where managed IT wins
For firms under approximately 80 staff:
- **You can't afford the redundancy.** A single IT manager goes on holiday. Gets ill. Quits with two weeks' notice. Your firm depends on technology — you cannot have one person be the single point of failure for it.
- **You can't justify the toolset.** The tools a managed-IT firm uses (security operations platform, MDR, vCIO software, network monitoring, backup-and-restore at scale) cost more per year than a junior IT salary. Multi-tenanted across many firms, the unit cost is reasonable. Single-tenanted, it isn't.
- **You'd have to pick a generalist.** Below 80 staff, you can hire one person. That person will be a competent generalist — they will not be a deep specialist in security, networking, M365 administration, *and* practice-management integration. A managed-IT firm has each of those people.
- **Compliance posture is hard to maintain.** Cyber Essentials, ISO 27001, SRA expectations — these need continuous attention by people who do them across many environments. A solo in-house manager will let some slip; not from incompetence, just from bandwidth.
## Where in-house wins
For firms over approximately 250 staff:
- **The economics flip.** At 250 staff, the marginal cost of additional managed-IT users exceeds what an in-house team would cost. You can hire two or three people for what 250 users at £125/month per user buys you.
- **Internal politics matter more.** A 250-person firm has internal coalitions, change-resistant fee-earners, and entrenched ways of working. An external IT firm has limited authority to push through change. An internal CIO has more.
- **Specialist roles become viable.** At 250 staff you can justify a security specialist, a M365 administrator, an applications person, and an IT manager. Below that, you're hoping one person does all four.
## The middle ground: 80-250 staff
Most firms in this range benefit from *both*. The right model is usually:
- One in-house IT person — typically titled IT Manager — handling day-to-day user support, internal advocacy, and project coordination.
- A managed-IT firm providing infrastructure operations, security operations centre cover, vCIO strategy, and continuous alignment review.
The in-house person is the firm's voice; the managed-IT firm is the depth and the cover. The two together are meaningfully better than either alone, at this size.
For Techsperience clients in this range, we work alongside the in-house IT manager rather than around them. The vCIO sessions are joint sessions. The alignment review surfaces gaps the in-house person can prioritise. The 24×7 SOC means the in-house person can take a holiday.
## When we'd tell a firm to hire instead
The honest answer:
- **You're growing past 250 staff and don't have an internal IT lead yet.** Hire one. We'll be the team that sits behind them.
- **You have a specific compliance overlay we don't have depth in.** If your firm has a regulatory profile that needs daily, deep specialist attention — not just SRA-grade controls — an in-house specialist is the right answer.
- **You've had a managed-IT relationship that didn't work, and the diagnosis is fundamentally cultural.** Sometimes the answer is "we need someone in our office, on our payroll, in our culture." A managed-IT firm cannot replace that, however good.
If any of those describe your situation, we'd say so on the 10-minute call. We'd rather not start a relationship that ends in eighteen months because the underlying need was different.
## How to think about the decision
Two questions, in order:
1. **Below 80 staff?** Managed IT is the right default. Solo in-house hire is almost always the wrong call.
2. **80 to 250 staff?** Managed IT *plus* one in-house person is the right default. Pure in-house is fragile; pure managed-IT misses internal advocacy.
3. **Over 250 staff?** Internal team plus managed-IT for specialist depth (SOC, vCIO, peer benchmarking) is increasingly common. Pure managed-IT is unusual at this size; pure in-house leaves specialist gaps.
The wrong decision is rarely the choice of model. It's underestimating the level of investment required, then trying to make whichever model you picked work on a 70%-of-needed budget.
One more thing that has changed the arithmetic since we first wrote this: AI tooling. Rolling out Copilot or a legal AI product safely is a security and data-governance job before it is a productivity one, and it is exactly the kind of specialist, occasional work that a solo in-house generalist will not have done before. If AI is on your firm's agenda, weight that in favour of having a team behind you, whichever model you choose. Our [AI Readiness Check](/ai-readiness-check) is a reasonable way to see how much of that work is ahead of you.
#### Frequently asked questions
**When should a law firm hire in-house IT?**
Most firms over 100 fee-earners benefit from at least one in-house IT person, typically as an IT manager working alongside a managed-IT firm. Firms over 250 fee-earners may justify a full in-house team. Below 80 fee-earners, in-house IT is usually more expensive and less effective than managed IT.
**How much does an in-house IT manager cost?**
For a law firm in London or the Home Counties, expect £55,000 to £75,000 per year fully loaded (salary + employer NI + pension + benefits) for a capable IT manager. A junior IT support role lands at £30,000 to £40,000 fully loaded.
**Can in-house IT and managed IT coexist?**
Yes — and for firms over 80-100 fee-earners, this is usually the right model. The in-house person handles day-to-day user support and acts as the internal IT voice; the managed-IT firm provides infrastructure, security, vCIO strategy, and 24×7 monitoring.
**What does managed IT for a law firm actually include?**
A helpdesk that owns problems end to end, Microsoft 365 and device management, patching, email security, endpoint protection and 24×7 security monitoring, backup and recovery, and — in a good contract — a continuous review of the environment against a standard plus quarterly strategy time with the partners. It is delivered for a fixed monthly fee per user, which is what makes it easy to compare against a salary.
---
### Microsoft 365 for law firms: the configuration decisions that matter
URL: https://techsperience.co.uk/resources/microsoft-365-law-firms
Published: 2025-10-02
Author: Ash, Microsoft 365 & Cloud, Techsperience
Topic: Technology
> M365 out-of-the-box is not M365 configured for a regulated professional-services firm. The ten settings most firms get wrong.
Microsoft 365 is the dominant productivity platform for UK law firms — and for most firms it's a sound choice. But out-of-the-box M365 is not M365 configured for a regulated professional-services firm. Default settings prioritise frictionless usability, often at the cost of confidentiality, auditability, and SRA-grade controls.
This article covers the ten configuration decisions that matter most for a UK law firm. None of them is technically advanced. All of them are routinely missed.
## 01. MFA on every account, no exceptions
The default for new Microsoft 365 tenants is "MFA optional unless the security defaults are on." Many tenants — particularly older ones, set up before 2020 — have the option but no enforcement. A spot-check in any law firm's tenant will usually find at least one account without MFA enabled. Often, that account belongs to a partner.
The fix is conditional access policies that *require* MFA on every account, every login, with no per-user exclusions. Yes, partners too. Yes, the receptionist's account. Yes, service accounts (which should be moved to managed identities or workload-specific authentication where possible).
## 02. Conditional access scoped to context
MFA alone is no longer enough. Modern attackers phish MFA tokens routinely. The next layer of defence is conditional access — policies that block or restrict access based on:
- Whether the device is enrolled in Intune
- Whether the device is compliant with security baselines
- The country the connection is from
- The application being accessed
- The risk score Microsoft assigns to the sign-in attempt
A baseline conditional access stack for a UK law firm:
- Block legacy authentication
- Require MFA from outside the UK
- Require compliant device for sensitive applications (M365 admin, finance, HR)
- Block unknown countries entirely
- Apply elevated risk thresholds for partners and finance staff
Configuring this takes about a day. Most firms haven't done it.
## 03. External sharing locked down by default
Default M365 settings allow OneDrive and SharePoint files to be shared with anyone, with anonymous links, with no expiration. For a law firm, this is wrong.
Sensible defaults:
- External sharing limited to specified domains (your clients, opposing counsel, expert witnesses)
- Anonymous links disabled or restricted to specific document libraries with explicit approval
- Sharing links expire after 30 days by default
- Sharing audit logs reviewed monthly
The setting changes are five clicks each. Skip them and you have a confidentiality leak waiting to happen.
## 04. Audit logging enabled and retained
The Microsoft 365 audit log captures who accessed what, from where, when, and what they did. Default retention is 90 days for Business plans (180 days for E3, 365 days for E5). For a law firm, 90 days is not enough — particularly when an SRA file review may go back further.
Enable Purview Audit (Premium) for E5 tenants. For Business Premium tenants, configure log shipping to a SIEM or to a long-term storage account. The cost is modest; the payoff at audit time is enormous.
## 05. Defender for Business or Defender for Endpoint
Built-in Microsoft Defender Antivirus is not the same as Defender for Business / for Endpoint. The latter adds:
- Endpoint detection and response (EDR)
- Threat hunting
- Automated investigation and remediation
- Vulnerability management
- Attack surface reduction rules
Defender for Business is included in Business Premium. Most firms don't have it deployed, despite paying for the licence.
## 06. Intune device management
Intune is what makes most security controls actually enforceable. Without it:
- You can't require encrypted devices
- You can't enforce screen lock
- You can't push security baselines
- You can't remote-wipe a stolen laptop or phone
- You can't restrict which devices access M365
Enrolling devices in Intune takes hours, not days, but it requires deliberate planning around partner laptops, BYOD, and personal phones used for email. Most firms half-do it, or don't do it at all.
## 07. SharePoint structure that matches the firm
Default SharePoint creates a single-team-site mess that doesn't reflect how a law firm actually works. A sensible structure:
- One site per major business function (Litigation, Corporate, Property, etc.)
- Matter-specific sites or document libraries — usually integrated with the practice management system
- A separate restricted site for HR, finance, partners-only documents
- Permission scoping that follows matter boundaries
Without this, fee-earners default to OneDrive for matter files (see #10) and the firm loses control of the document estate.
## 08. Email retention, not just deletion
Default Exchange retention is "keep forever or until the user deletes." For a law firm, this is wrong both ways. The right model:
- Active mailbox retention until matter close + N years (per your firm's retention policy)
- Litigation hold capability for live matters
- Archive mailboxes for older content
- Deletion policies that fire automatically at retention-period end
Implementing this in Microsoft Purview takes a project, not an afternoon. But running without it leaves you exposed at retention audits and creates needless eDiscovery cost.
## 09. Phishing protection beyond defaults
Microsoft Defender for Office 365 includes anti-phishing protection — but the default policies are tuned for general business, not for a law firm. Specifically:
- Configure impersonation protection for partner email addresses (a common spear-phishing target)
- Enable user-impersonation alerts
- Tune Safe Links and Safe Attachments for legal-document workflows
- Set up DMARC for your firm's domain (and enforce p=reject once you've confirmed it's safe)
Combined, these reduce successful phishing attempts by an order of magnitude.
## 10. OneDrive is personal storage, not matter storage
The single most common configuration mistake we see: fee-earners using OneDrive as their primary working folder, including for matter documents.
When that fee-earner leaves the firm, two things happen. Either (a) the firm scrambles to extract matter files before the OneDrive is deleted, or (b) the firm continues to pay for the leaver's licence indefinitely to avoid losing access. Both are wrong; both are common.
The fix is structural, not technical: matter files belong in SharePoint sites, document management systems, or practice management systems that are scoped to the matter and visible to the team. OneDrive is for drafts and personal working copies. Make that policy clear, give fee-earners somewhere to actually save matter files that's as easy as OneDrive, and the problem largely goes away.
---
None of these ten changes requires enterprise-grade Microsoft licensing. All of them are within Business Premium. The work is configuration, not procurement — which means the gap between a well-run M365 tenant and a poorly-run one is smaller than most firms assume, and easier to close than they fear.
#### Frequently asked questions
**Which Microsoft 365 plan is right for a law firm?**
Most UK law firms under 100 staff are best served by Microsoft 365 Business Premium. It includes Office, Exchange, SharePoint, OneDrive, Teams, Intune for device management, and Defender for Business. Firms over 300 staff usually need Office 365 E3 or E5, which scale beyond Business Premium's 300-user cap.
**Does Microsoft 365 meet SRA cybersecurity expectations?**
Microsoft 365 can meet SRA expectations, but only if configured properly. The default settings — particularly around external sharing, MFA enforcement, conditional access, and audit log retention — are not aligned with what the SRA expects. Configuration decisions matter as much as the licence itself.
**What is conditional access and why does it matter?**
Conditional access is the Microsoft 365 feature that lets you require additional verification (or block access entirely) based on context — who the user is, what device they're on, where they're connecting from, and what they're trying to access. It is the single most important security control above MFA, and most firms haven't configured it.
**Should law firms use OneDrive for client files?**
No. OneDrive is personal storage; client files belong in shared, properly governed locations — typically SharePoint document libraries or a dedicated practice/document management system. Mixing personal storage and matter files is a recipe for confidentiality breaches when staff leave.
---
### Switching IT providers: how a law firm changes managed-IT firms without disruption
URL: https://techsperience.co.uk/resources/switching-it-providers-law-firms
Published: 2025-09-15 · Updated: 2026-09-05
Author: Ben, Principal, Techsperience
Topic: Operations
> Most firms avoid switching IT providers because they fear disruption. Here's how a competent transition actually works — and how to test whether yours will be one.
Most law firms put off switching IT providers far longer than they should. The most common reason isn't price or contract terms — it's fear of disruption. Fee-earners don't have time for a botched migration; partners don't want to spend two months explaining why the email is down.
The fear is reasonable. Transitions can go badly. But a competent transition is mostly invisible to fee-earners, takes four to eight weeks, and has well-understood failure modes that a good incoming provider will plan around.
This article covers what actually happens, how to evaluate a transition plan, and the warning signs that the new provider won't deliver one.
## Signs it's time
Before the how, the whether. Most firms that should switch know it already, but the signs are worth naming:
- **Response times have quietly stretched.** A ticket that used to be fixed the same afternoon now takes three days and a chase. Fee-earners have started working around IT rather than through it.
- **You only hear from them when something has broken.** No one is checking the environment against a standard between incidents, so every quarter brings a new surprise.
- **You can't see your own security posture.** If you asked today whether every laptop is encrypted and every account has MFA, and the honest answer is "I'd have to ask them", you don't have a managed environment; you have a helpdesk.
- **Nobody has talked to the partners about IT in a year.** No budget conversation, no roadmap, no view on AI. The relationship is reactive by design.
- **The invoices keep surprising you.** Extras, project fees for things that should be routine, price rises with no explanation. Managed IT should be a predictable monthly number.
If two or more of those describe your provider, the risk of switching is smaller than the risk of staying. How to pick the replacement is its own subject; we've covered [how to choose an IT provider for a law firm](/resources/choose-it-provider-law-firm) separately. What follows is what should happen once you have.
## What a competent transition looks like
The work falls into four phases.
**Phase 1: Discovery (weeks 1-2).** The new provider documents your environment from scratch. Every device, every account, every cloud service, every shared mailbox, every server, every contract. They do this even if the existing provider has handover documentation — particularly if the existing provider has handover documentation, since that documentation is often optimistic.
What you should see: a written inventory at the end of week 2. If there isn't one, the discovery phase didn't actually happen.
**Phase 2: Stabilisation (weeks 2-4).** Before any cutover, the new provider standardises baselines. Devices get enrolled in management. Accounts get audited and tidied. Patches that were missing get applied. Backup health is verified end-to-end.
This is the unglamorous phase. It is also where most of the long-term value of switching is captured. A new provider who skips it is selling you a brand change, not a service change.
**Phase 3: Cutover (one weekend).** Tenant ownership, billing, helpdesk responsibility, monitoring, and 24×7 cover all formally move over. The cutover itself is usually a single weekend — Friday evening to Monday morning. Done well, fee-earners notice nothing on Monday except that the helpdesk number has changed.
**Phase 4: Settle (weeks 5-8).** First-month tickets, edge cases that surface as people start using the system normally, fine-tuning of policies, and the first vCIO session with the partners. This is when the new relationship actually gets formed.
## How to evaluate a transition plan
Ask the prospective new provider to walk you through their plan in detail before you sign. Specifically:
- **Who does what, week by week?** A real plan has named roles and named weeks. A vague plan has neither.
- **What's the fall-back if cutover goes wrong?** A real plan can roll back to the previous state. A vague plan assumes nothing will go wrong.
- **What documentation do you produce?** A real plan produces a full network and service inventory. Demand to see a sample from a previous transition (with the client name redacted).
- **What credentials and ownership transfer?** Microsoft 365 tenant ownership should be in your firm's name, not the IT firm's. If your existing provider holds tenant ownership "for convenience," that needs fixing during the transition.
- **What happens to the existing provider's documentation?** It should be requested in writing and reviewed for completeness. Gaps should be filled before cutover, not after.
## Warning signs the transition will go badly
The honest list:
- **The provider promises a transition in less than four weeks for a 50-person firm.** This is achievable only by skipping discovery or stabilisation. You'll feel it in month three.
- **The provider doesn't ask to see your existing contract.** Contract terms — particularly notice periods, data-return obligations, and exit cooperation clauses — drive the transition timeline. A provider who doesn't ask hasn't planned around them.
- **No named technical lead for your account.** "Our team will handle it" is not a plan. A specific named person should own the transition.
- **The provider proposes to migrate your Microsoft 365 tenant.** In almost all cases, you don't move tenants — you transfer admin access and ownership. A provider proposing tenant migration is either confused or planning to lock you in via their own tenant.
- **No first-month settle plan.** A transition that ends at cutover is half-done. Real transitions have a structured first 30 days post-cutover.
## What you should hear from your existing provider
Most managed-IT contracts have exit-cooperation clauses. A reputable existing provider will:
- Provide a complete inventory of devices, accounts, services, and credentials
- Transfer Microsoft 365 admin ownership to your nominated successor
- Cooperate on a knowledge-transfer call covering known issues, custom configurations, and quirks
- Honour the notice period without quietly degrading service
If your existing provider becomes uncooperative the moment you give notice, that's a signal you should have switched sooner — and a signal to be conservative about how much notice you give. Most firms time the notice for the same date they sign with the new provider, so the gap closes immediately.
## When *not* to switch
The transition is real work and not always worth it:
- **You've been with your current provider less than 18 months.** Most relationships need that long to find their rhythm. Don't switch in year one unless something is fundamentally wrong.
- **The price gap is the only reason.** Saving 15% on a managed-IT contract is rarely worth the disruption risk. Switch for fit, capability, or culture — not pricing alone.
- **You're about to do something else disruptive** — an office move, a merger, a major software rollout. Stack disruptions are rarely well-tolerated. Sequence them.
If none of those apply and the relationship isn't working, the right time to start the conversation about switching is now. The longer a misaligned IT relationship continues, the harder the eventual unwind.
#### Frequently asked questions
**How long does it take to switch IT providers?**
A well-run transition between managed-IT providers takes between four and eight weeks, depending on the size of the firm and the complexity of the existing environment. The cutover itself — when responsibility formally moves — typically happens over a single weekend with minimal user impact.
**Will fee-earners notice when we switch IT providers?**
In a competent transition, the only thing fee-earners notice is that the helpdesk number changes — and that calls are now answered differently. Email, files, applications, and devices continue to work. If fee-earners experience real disruption, the transition was rushed.
**Do we need to give notice to our existing IT provider?**
Yes. Most managed-IT contracts have notice periods of 60 to 90 days. Read your contract carefully — particularly clauses about data return, account credentials, and exit cooperation. The notice period is when most of the transition work actually happens.
**What are the signs it is time to change IT provider?**
Tickets that sit for days; a provider you only hear from when something has broken; no visibility of your own security posture; no one who has sat down with the partners in the last year to talk about budget and roadmap; and invoices that keep surprising you. Any one of those is worth a conversation. Two or more, and the relationship has probably already ended in practice.
**What should we ask the new provider before signing?**
Ask: who owns our Microsoft 365 tenant after the switch (it should be you); what credentials and documentation do you receive; what does your migration plan look like; what's your fall-back position if something goes wrong; how do you handle the first 90 days; and who specifically will be working on our account.