Under the UK Sovereign AI bar, GenAI in regulated legal work should be tested, monitored, and proved — not only covered by written policy. This short diagnostic maps where ChatGPT, Claude, Gemini, Copilot and similar tools can expose client confidential information, Legal Professional Privilege, and SRA Code duties. About three to four minutes. You get an exposure band and control-strength profile — not certification, funding eligibility, or legal advice.