TL;DR: Passwordless authentication is becoming the standard way to log in, and Microsoft will retire SMS and voice-based MFA for Microsoft 365 on 1 February 2027. If your firm still relies on text message codes, now is the time to plan the switch to passkeys.

Why passwordless authentication matters to your firm right now

Microsoft has confirmed that SMS and voice authentication for Microsoft 365 stops working on 1 February 2027. From September 2026, staff using text codes will start seeing prompts to set up a passkey instead. It affects every partner and every member of staff who logs into email or your case management system.

The National Cyber Security Centre has also changed its position. In April 2026, at CYBERUK, it announced it will recommend passkeys “wherever a service supports them”. For a law firm holding privileged client information, any delay in tightening login security is a delay in reducing your exposure to phishing.

What is passwordless authentication?

Passwordless authentication means logging in without typing a password. The most common form is a passkey. When you set one up, your device creates two matching digital keys. One stays on your device, the other is held by the service you are logging into.

When you log in, your device and the service check that their two keys match. You confirm it is you by unlocking your device with a fingerprint, face scan or PIN. Nothing gets typed, and nothing travels across the internet that a criminal could intercept.

This is what makes passkeys effective against phishing. A fake login page can look identical to the real one, but it cannot request the key on your device, because that key only responds to the genuine website it was created for. Even if a member of staff clicks a convincing phishing link, there is nothing for them to hand over.

Why is Microsoft retiring SMS and voice MFA?

Text messages and phone calls can be intercepted, and attackers have got better at tricking people into approving codes they never requested. Passkeys close that gap entirely.

Matt Dunn, COO and CTO at Labyrinth Technology, explains:

“Phish-resistant multi-factor authentication, such as passkeys, is extremely effective in combating the risk of phishing attacks. This is because it uses a device-bound key which cannot be compromised through a traditional email phishing or man-in-the-middle attack.”

The timeline is fixed. From 1 September 2026, Microsoft prompts SMS and voice users to register a passkey. From 1 February 2027, Microsoft-provided SMS and voice authentication stops working, with no opt-out.

“We’ve started talking to our clients about this, and it’s already clear this change will create a lot of friction,” Matt adds.

What is MFA fatigue and why does it matter for law firms?

MFA fatigue is when an attacker who already has your password sends repeated approval requests to your phone, hoping you eventually tap “approve” just to stop the notifications. Passkeys remove this risk, since there is no approval prompt to accept.

This matters more where client money is involved. Action Fraud recorded 143 cases of conveyancing fraud between April 2024 and March 2025, with losses of £11.7 million and an average loss of £78,393 per case. Most follow the same pattern: an attacker gets into an email thread and sends convincing instructions to change bank details at completion. Passkeys make that initial compromise far harder to achieve.

What should law firms do before the February 2027 deadline?

Audit who is still using SMS or voice MFA

Ask your IT provider for a list of every user still relying on text or phone call authentication. This is the group who will see prompts from September 2026.

Roll passkeys out in stages

Start with a small group that includes at least one partner, so you catch device issues early. Pay attention to staff using personal phones under a bring your own device policy, since their settings tend to be less consistent than firm-managed laptops.

Check your case management system

Confirm whether it supports passkeys directly, or only through your Microsoft 365 login, before you switch everyone over.

How Labyrinth Technology helps

Labyrinth Technology’s authentication solutions already supports passwordless authentication for clients moving away from passwords and one-time codes. For firms on Microsoft 365, that typically starts with Microsoft Entra ID passkeys, with WatchGuard AuthPoint or Okta for firms needing more advanced access controls.

Microsoft’s deadline is 1 February 2027. From today, that gives you under six months to get every partner and every fee earner switched over before the fallback disappears.

Get in touch today.

TL;DR: SRA AI guidance makes solicitors personally responsible for anything AI produces, including research and court submissions. Two firms have already been referred to the SRA this year after AI-generated citations turned out to be fake. Verification, staff training, documented use and client disclosure are what the SRA expects firms to have in place.

What does the SRA’s AI guidance actually say?

The SRA has not written a rulebook for AI. Its compliance tips, last updated in February 2026, restate the Code of Conduct and apply it to AI tools directly.

You stay responsible for your work, whoever/whatever produced the first draft. Client confidentiality applies regardless of the platform. And you must understand a tool well enough to spot when it has got something wrong.

Who is responsible for AI compliance in your firm?

The SRA expects your Compliance Officer for Legal Practice (COLP) to take ownership of AI governance across the firm.

That means someone specific is accountable for how AI tools are used and checked, with the authority to enforce it.

Why are solicitors being referred to the SRA over AI use?

Pinsent Masons referred itself to the SRA after a junior solicitor used AI to research a point of insolvency law. The tool invented a statutory provision that did not exist, and it made it into a letter to the court. Two senior solicitors had signed that letter off without catching the error. (Source – Law Gazette)

In a separate case, Rodney v Gee’z Micro Bar & Pitstop, His Honour Judge Grimshaw referred two solicitors at AML Legal after a skeleton argument cited authorities that turned out to be fabricated. One document even included the line “your client was a litigant in person,” language the judge noted read like something generated rather than written by a lawyer. (Source – Law Gazette)

Judge Grimshaw called for a “robust approach” from the courts, describing fake AI citations as a growing threat to the justice system. Neither case involved a rogue actor trying to deceive the court. Both involved firms that skipped the verification step.

See what Matt has to say

What should your law firm have in place to meet SRA AI guidance?

Governance does not need to be complicated. It needs to exist and be followed.

Verify every citation before it leaves the building

Any citation or quotation an AI tool produces gets checked against the primary source before it reaches a client or a court. No exceptions for time pressure.

Train staff on what AI can and cannot do

Staff need to understand that a confident, well-formatted answer from an AI tool can still be entirely wrong, these are known as AI hallucinations.

Keep client data out of AI tools

AI tools can store and reuse whatever is typed into them, so confidential client information should never go near one. The confidentiality duty always applies, no matter which tool is involved. What matters most is knowing where shadow AI might be creeping into your firm, and training staff to use only the tools you have approved.

Record AI use in the matter file

If AI contributed to research or drafting, note it. This protects the fee earner and gives the firm a clear audit trail if something is later questioned.

Tell clients when AI is part of the process

The SRA’s guidance is explicit on this point. Clients should be told when AI is involved as a normal part of client care.

How Labyrinth Technology can help

We work with law firms across the UK to put the practical structures behind compliance guidance like this. That means secure systems for how AI tools connect to your data, and IT support that understands why a law firm’s obligations are different from a typical small business.

If you are reviewing how AI is used across your firm, we can help you build the policies and secure systems that sit behind it.

Two firms have already been referred to the SRA this year over uncaught AI citations. The next one is being decided right now, one verification step at a time.

We are pleased to announce that Labyrinth Technology is now a NetDocuments partner. We have been working with law firms running NetDocuments for years, and this partnership formalises that relationship.

What is NetDocuments?

NetDocuments is a cloud-based document management system built specifically for law firms. It is the system your firm’s documents and matter files are built around. A large number of UK firms have made it the foundation of how they manage their practice, and adoption has been growing steadily.

If your firm is already on NetDocuments, you will know how much of your day-to-day operation depends on it working reliably. A failed migration or a platform issue has an immediate knock-on effect across the whole practice. Having an IT partner who knows NetDocuments properly means you are far less likely to find yourself in that position.

Why this partnership matters for your firm

As a NetDocuments partner, Labyrinth Technology now has a direct relationship with the platform and its support infrastructure. For you, that means faster resolutions and better-informed guidance when your firm is planning anything significant on the platform.

We have dedicated in-house NetDocuments product owners who work with the platform day to day, which means the support your firm gets is grounded in real working knowledge of it. That knowledge is what makes the difference when something needs to move quickly.

This is not a new area of work for us. We have been supporting firms through NetDocuments implementations and migrations for a number of years. The partnership reflects experience we already had.

What Matt Dunn, CTO and COO at Labyrinth Technology, had to say

“As a specialist IT partner for law firms, we’ve spent a decade helping firms that put NetDocuments at the heart of their practice. Managing matters, documents, and client data with confidence.

NetDocuments is strategically important to our clients, so it’s strategically important to us.

With dedicated in-house NetDocuments product owners, we bring deep platform expertise that will translate directly into faster rollouts, smoother migrations, and ongoing support your team can rely on. We’re proud to formalise that commitment through this partnership.”

How can Labyrinth Technology support you

This partnership sits alongside everything else Labyrinth Technology does for law firms. We support firms across Microsoft 365, network security, backup and disaster recovery, and cloud migrations.

NetDocuments also integrates directly with Microsoft 365, so if we already support your firm’s Microsoft environment, the two areas of support connect naturally.

If you would like to talk through what this means for your firm, get in touch with the team.

Every law firm I talk to is asking about Claude Legal at the moment.

Claude, Copilot, Lexis+ AI, Harvey, Thomson Reuters, Clio. The list goes on.

How do you stay ahead without ending up with 5 different AI subscriptions per person that most people are not using?

Here are some of my recommendations from experience.

1. Dedicated research team

It’s a good idea to have a test group of ‘power users’ from different roles across the business to be trying out new AI tools and features and seeing which ones deliver the most value. There needs to be some guard rails and governance here though.

You don’t want to be rolling out new tools every week, or you’ll end up needing an expensive digital transformation project in a year to unpick and consolidate it all!

You also need to do your cyber security due diligence and make sure anything you are testing is set up properly, securely and the data it leverages is ready (accurate, access controlled correctly etc.)

2. Lead with the requirements

Many other law firms are using or experimenting with these tools. So it can be easy to jump to leading with the solution and trying to make it fit.

Take the time to understand how fee earners work, sales, marketing, HR, accounts. Understand their pain points and where AI could save them the most time. Then you can look at matching a solution to those requirements.

3. Measure ROI

The reality is that most law firms will benefit from a combination of these tools to suit different requirements and business functions. Lexis+ for example only uses data from trusted legal sources. Copilot and Claude can leverage Microsoft 365 data and meet you where you work.

But can you clearly demonstrate and measure the ROI from each of these tools? Do that per department and consider whether each one is actually needed by everyone in the business.

4. Governance

You need to define how each of these tools will be used, and consider the appropriate quality, ethical, legal and data privacy implications.

Document it, but make it clear, concise and don’t hide behind policies. Train your team. Regularly. They will forget, trust me.

Look at technical controls to enforce your AI policies.