Safe Setup Guide: Notion AI for Internal Documentation

Overview

Notion is a workspace for notes, documents and databases. Notion AI is the set of AI features built into it: answering questions from your workspace, drafting and editing text, summarising pages and taking meeting notes.

Notion AI is not sold as a separate add-on on the pricing page checked. The Free and Plus plans include a trial of Notion AI, and the Business and Enterprise plans include the AI features.

This guide treats Notion as a place for a firm's internal knowledge: policies, know-how, training notes and templates. It does not recommend Notion for client files.

Every vendor fact below was checked against Notion's own pages on 29 September 2026. The pages are listed under "Sources checked" at the end of this guide. Settings and prices change, so follow the links before you rely on them.

Setup time: about 10 minutes Suitable for: firms using Notion for internal documentation

Plans and prices

Notion's pricing page gave prices in pounds when viewed from the UK on 29 September 2026. These are the prices per member per month with "Pay yearly" selected. The page says paying yearly saves up to 20% against paying monthly.

Plan	Price	Notion AI
Free	£0	Trial of Notion AI
Plus	£8.50	Trial of Notion AI
Business	£16.50	Notion Agent, AI Meeting Notes, Enterprise Search (beta). Adds SAML single sign-on and private teamspaces
Enterprise	Custom pricing	Adds zero data retention with the model providers, audit log, and controls to disable guests and stop external sharing

The page did not say whether prices include VAT.

What Notion says about your data

	Free, Plus and Business	Enterprise
Used to train models	Not by default. Notion says it will not use your data to train its models unless you opt in	Same
AI model providers	Models hosted by Notion and by organisations such as Anthropic and OpenAI. Contracts prohibit them from training on customer data	Same
Retention by model providers	30 days or fewer	Zero data retention by default
Deleted pages	Can be restored for 30 days, then deleted. Embeddings are deleted within 60 days	Same
Where data is stored	United States	United States by default. An Enterprise workspace can ask to move to another data region
Permissions	Notion AI honours existing page permissions	Same

Three points that are easy to miss:

There is no UK data region. The regions Notion lists are the US (Oregon), the EU (Frankfurt), Japan (Tokyo) and South Korea (Seoul). Data residency is an Enterprise feature, and data stays in the US until Notion confirms a migration is complete.
Data residency covers storage only. Notion says account information, usage data and data processed by its subprocessors may be stored outside the chosen region. Notion Calendar, Notion Mail and beta services are not covered.
Some features can turn on data-retaining models. Notion says certain AI features may need models that retain data, that these are off by default, and that administrators can turn them on in workspace settings.

Step 1: Check which plan and workspace you are in

Confirm with your workspace owner which plan the firm is on.
Use the firm's workspace, signed in with your work email address.
Keep the firm's content out of any personal Notion workspace.

Step 2: Review the Notion AI settings

Workspace owners on any plan can go to Settings, then Notion AI. Notion lists two web search settings:

Enable web search for workspace. When on, Notion AI can search the web when answering questions.
Require confirmation for web requests. When on, Notion AI asks for confirmation before looking at external websites.

For a law firm, turn on the confirmation setting, or turn web search off, until the firm has decided how it should be used.

Ask the workspace owner to confirm that data-retaining models have not been turned on.

Step 3: Understand what Notion AI can reach

Notion says the models used to answer a user's question cannot see or use any information to which that user does not already have access.

That means Notion AI can draw on every page you can open. If a page holding something sensitive is shared with the whole workspace, Notion AI will use it for anyone who asks a related question.

Before relying on Notion AI:

review which teamspaces and pages are open to the whole workspace
review who has been invited as a guest
check whether any pages have been published to the web

On the Enterprise plan, Notion lists controls to prevent people sharing pages externally and to disable guests. On the Business plan it lists private teamspaces.

Step 4: Decide what Notion is for

Reasonable uses:

firm policies and procedures
know-how and practice notes that contain no client information
training notes
precedents and templates with placeholders
notes of internal meetings that do not discuss a client's matter

Not recommended:

client files and matter management
advice to clients and privileged communications
notes of meetings with or about clients
documents disclosed by another party

A page is sent to the AI model providers when Notion AI works on it. On plans other than Enterprise, Notion says those providers may retain it for up to 30 days.

AI Meeting Notes. A meeting note is a record of what was said. Decide before the meeting whether one should be made, and tell the people in the meeting.

Your professional duties

This section summarises published rules and guidance. It is not legal advice, and it has not yet been reviewed by a solicitor.

Confidentiality. Paragraph 6.3 of the SRA Code of Conduct for Solicitors, RELs, RFLs and RSLs requires you to keep the affairs of current and former clients confidential unless disclosure is required or permitted by law or the client consents.
Competence. Paragraph 3.2 requires the service you provide to be competent, and paragraph 3.3 requires you to keep your professional knowledge and skills up to date.
Supervision. Under paragraph 3.5, where you supervise or manage others you remain accountable for the work carried out through them.
Responsibility for output. The SRA's Risk Outlook report on AI (20 November 2023) says you "remain responsible and accountable for the outputs from AI you are using".
Law Society guidance. "Generative AI – the essentials" advises carrying out due diligence on the supplier, and being able to say where data is processed, who processes it, how and where it is stored, and who has access to it. It also warns that tools built on top of generative AI platforms may share metadata with the underlying technology provider.
Data protection. Where a page contains personal data, the UK GDPR and the Data Protection Act 2018 are relevant. The Information Commissioner's Office says a restricted transfer of personal data outside the UK must be covered by UK adequacy regulations, appropriate safeguards or an exception. Notion stores data in the United States by default.

Follow your firm's own AI and information security policy where it is stricter than this guide.

What not to put into Notion

client names, or facts that would identify a client or matter
privileged communications or advice
personal data about clients or third parties, including health information and financial details
National Insurance numbers, passport numbers or bank account details
the terms of a confidential settlement
anything covered by a confidentiality agreement or undertaking

Examples of prompts that carry no client information:

"Summarise this internal training note"
"Draft an outline for a training session on [TOPIC]"
"Improve the wording of this internal policy"

Checking output

Answers from the workspace: open the pages Notion AI cites and confirm they say what the answer says
Out-of-date know-how: check the date of the page the answer came from
Statements of law: check every case and statutory reference against its source, for example Westlaw UK, Lexis+ UK, BAILII, The National Archives' Find Case Law or legislation.gov.uk
Web results: check the website an answer came from before relying on it
Meeting notes: read the note against your own recollection before circulating it

If client information goes in by mistake

Delete the page. Notion says a deleted page can be restored for 30 days and is then deleted.
Tell the person your firm's policy names, usually the compliance officer for legal practice (COLP) or the data protection lead.
Record what was entered, when, who could see the page, and whether Notion AI was used on it.

The ICO says a notifiable personal data breach must be reported to it without undue delay and not later than 72 hours after you become aware of it. Whether an incident is notifiable is for your firm to assess. Paragraph 7.11 of the SRA Code requires you to be honest and open with clients if things go wrong.

Quick checklist

Before first use

Plan confirmed with the workspace owner
Web search settings reviewed
Sharing, guests and published pages reviewed
Firm has decided what Notion is for
Your firm's AI policy read

Every time

Working in the firm's workspace
No client information on the page
Cited pages opened and read
Meeting notes only where a record is appropriate

Sources checked

All read on 29 September 2026.

Notion

Rules and guidance

SRA Code of Conduct for Solicitors, RELs, RFLs and RSLs (version in effect from 11 April 2025)
SRA Risk Outlook report: the use of artificial intelligence in the legal market (20 November 2023)
Law Society: Generative AI – the essentials (page dated 1 October 2025)
ICO: International transfers guide
ICO: Personal data breaches guide

Need help?

If you have a question about this guide, or find that a setting has moved, contact hello@counsel.directory.

Review status: this guide has not yet been reviewed by a solicitor.

Disclaimer: This guide is general information about configuring a software product. It is not legal advice and it is not advice on your professional obligations. You remain responsible for complying with the SRA Standards and Regulations, data protection law and your firm's policies. Check with your firm's compliance and IT teams before using a new tool for client work.