Question 1

Does the AI train on our client data?

Accepted Answer

No. Your client data is never used to train any AI model. We run inference via AWS Bedrock (EU West, London region), which provides zero data retention (ZDR) by contractual guarantee: Bedrock does not retain prompts or outputs after the API call completes. Your files are processed in memory and discarded. We will publish our data processing agreement before any pilot.

Question 2

Is this SRA compliant?

Accepted Answer

The product is designed to be consistent with the SRA's AI Risk Outlook guidance. Specifically: every AI output is a clearly-labelled draft requiring review and explicit sign-off by a named MLRO or COLP (with their SRA reference logged); no AI output is auto-filed; the firm remains the regulated entity and responsible party; and we maintain an append-only audit log of all AI outputs and human decisions. This does not constitute legal advice about your firm's specific obligations.

Question 3

What happens when AML supervision transfers from the SRA to the FCA?

Accepted Answer

The FCA will inherit the files and procedures your firm creates today. The underlying MLR 2017 obligations remain unchanged: only who supervises changes. The FCA is expected to adopt a more data-driven inspection approach. Our evidence packs are designed to be legible to both the current SRA inspection format and the FCA's anticipated forensic style. We track the legislative progress and will update the product as primary legislation advances.

Question 4

Where is client data stored, and can it leave the UK?

Accepted Answer

All data is stored in AWS eu-west-2 (London). No data transits to US or non-UK/EU infrastructure. AI inference runs via Bedrock's EU endpoints. We will obtain ISO 27001 certification before general availability (currently in design phase). We will apply for Cyber Essentials Plus in parallel. We will be transparent about the certification timeline. We do not claim certifications we do not yet hold.

Question 5

Which practice management systems do you integrate with?

Accepted Answer

We are PMS-agnostic and designed to sit above your existing stack, not replace it. Current integration roadmap: Clio, LEAP, Actionstep, and Osprey. We also read from Thirdfort, Amiqus, and ComplyAdvantage for ID verification and sanctions data. Integration does not require replacing your existing PMS: we ingest matter data via secure API or structured export.

Question 6

Does the AI file SARs (Suspicious Activity Reports) automatically?

Accepted Answer

Absolutely not. Filing a SAR is a legal act with serious consequences. The AI can identify indicators that a matter may warrant SAR consideration and draft the supporting analysis, but the MLRO must review the analysis, make the decision independently, and file via the NCA's SARS Online portal using their own authorisation. We log that the consideration occurred and who made the decision. We never act on it.

Question 7

How do you handle the 'tipping off' prohibition?

Accepted Answer

The system is designed with tipping-off risk in mind. SAR-consideration workflows are partitioned from fee-earner views. Once a SAR consideration is open, the matter is flagged internally to the MLRO only. Fee earners see a general hold instruction without the reason. The system enforces this at the access-control layer, not just the UI layer.

Question 8

What is the cost of the service, and how is it priced?

Accepted Answer

It starts with a free 30-minute call with no commitment, followed by a one-month free pilot with written success criteria and an end date, then a minimum 6-month subscription. Pricing is matched to your firm's size and needs, and we're not enterprise-gated, so the firms the big tools price out can afford us. For current pricing and a plan matched to your firm, contact the team at hello@retibo.com or book a call.

Question 9

Will you sign a data processing agreement (DPA)?

Accepted Answer

Yes. A DPA is required before any client data is processed. We will provide a GDPR-compliant DPA that covers: the lawful basis for processing, sub-processor chain (AWS, Bedrock), data residency guarantees, retention and deletion schedule, and breach notification obligations. This is a standard requirement and not a negotiating point. We will not process your data without it.

Question 10

Is the AI output protected by legal professional privilege?

Accepted Answer

This is a live area of law. The better view is that AI-assisted outputs directed by a qualified lawyer, used in preparation for legal proceedings, and subject to MLRO review and adoption, may be capable of attracting privilege, but this has not been authoritatively decided. We recommend treating AI compliance outputs as records that assist the fee earner's own work product, rather than as privileged communications in their own right. This is not legal advice: your firm should obtain its own counsel on privilege.

FAQs.

10 questions answered.

Book a call.