Is ChatGPT safe for client data?

Paragraph 6.3 of the Code of Conduct for Solicitors, issued by the Solicitors Regulation Authority (SRA) for England and Wales, requires solicitors to keep the affairs of current and former clients confidential "unless disclosure is required or permitted by law or the client consents".1

On 17 August 2026 the SRA published a warning notice on the misuse of AI. It states that "Both free to use and paid for AI systems may pose risks to client confidentiality", and that "Client information should only be entered into AI systems where appropriate contractual, technical and organisational safeguards are in place to protect confidentiality." The notice adds that firms should satisfy themselves that client data "is not used to train AI models except where explicitly authorised and appropriate to do so, and is not retained longer than necessary".2

The Law Society's guide "Generative AI – the essentials", updated in June 2026, says confidential data should not go into "a free, online generative AI service where you have no operational relationship with the vendor other than use". It also states: "Careful consideration needs to be taken when client data is to be shared with a third-party AI vendor."3

ICAEW's guidance on generative AI and ethics states that respecting client confidentiality "means not loading confidential information into public Generative AI tools, even if such information has become publicly available." Its reason: "There is limited visibility and control over who the information is shared with, how it is secured and how long it is retained."4

Where the information is personal data, guidance from the Information Commissioner's Office (ICO), the UK's data protection regulator, states that "The UK GDPR imposes a legal obligation on controllers and processors to formalise their working relationship", and reads Article 28(3) as requiring a written contract every time a controller uses a processor.5

The American Bar Association issued Formal Opinion 512, its first formal ethics opinion on generative AI, on 29 July 2024. The ABA's release summarises its reading of Model Rule 1.6: "a lawyer using GAI must be cognizant of the duty to keep confidential all information relating to the representation of a client, regardless of its source, unless the client gives informed consent."6 The opinion's own PDF returned an access error when requested for this article, so the wording here is the ABA's release.

For accountants, the AICPA Code's Confidential Client Information Rule provides: "A member in public practice shall not disclose any confidential client information without the specific consent of the client." Its interpretation on third-party service providers sets out two routes before confidential client information is disclosed to one: a contract under which the provider maintains confidentiality, with reasonable assurance that it has procedures to prevent unauthorised release, or "specific consent from the client".7

For tax practitioners, the IRS Office of Professional Responsibility published guidelines on AI use on 24 June 2026. They state that "GAI platforms may present risks regarding the unauthorized disclosure of sensitive taxpayer information, especially when data is uploaded to unsecured or public systems", and that "Practitioners must strictly handle all client data using only secure, enterprise-approved AI." The same guidelines point to the civil and criminal preparer penalties in sections 6713 and 7216(a) of the Internal Revenue Code.8

The Council of Bars and Law Societies of Europe published a guide on generative AI for lawyers on 2 October 2025. It states that "The professional rules apply to all client data", and that lawyers "should refrain from entering any personal, confidential or other data related to the client into the user interface of the GenAI" unless appropriate safeguards are in place. The safeguards it lists include a data protection agreement limiting use of the data to the firm's purposes, and "setting up AI systems to run locally or within a secured environment controlled by the law firm".9

On 6 August 2024 the Dutch Data Protection Authority reported that it had received breach notifications caused by employees entering personal data into AI chatbots. In one, an employee of a GP practice had entered patients' medical data; in another, a telecom employee had entered a file that included customer addresses. The authority states: "By entering personal data into AI chatbots, the companies that offer the chatbot may gain unauthorised access to those personal data." Where an employee does this against the employer's agreements, it states, "this means there is a data breach".10

OpenAI separates services for individuals from services for businesses. For the first: "When you use our services for individuals such as ChatGPT, Sora, or Operator, we may use your content to train our models." For the second: "By default, we do not train on any inputs or outputs from our products for business users, including ChatGPT Team, ChatGPT Enterprise, and the API."11 "ChatGPT Team was renamed to ChatGPT Business on August 29, 2025."12

For part of 2025, deleting a ChatGPT chat did not remove it from OpenAI's systems. In its copyright case against OpenAI, The New York Times asked for user content to be preserved, including "even deleted ChatGPT chats". A court order required it. OpenAI's own page listed who was affected: "ChatGPT Free, Plus, Pro, and Team" and API use "without a Zero Data Retention agreement". It also said: "This does not impact ChatGPT Enterprise or ChatGPT Edu customers."17

"Our obligations under the earlier order ended on September 26, 2025," OpenAI wrote in an update dated 22 October 2025. It still holds "limited historical April–September 2025 user data", stored under legal hold.17

In 2025, a court order outranked the deletion promise. Which plan a firm was on decided whether its deleted chats were swept in.

None of the guidance quoted above names a ChatGPT plan, and none of it approves one.

On OpenAI's own pages, a personal plan may train on what is typed into it unless the user switches that off, and it is not among the products OpenAI's privacy page names for a DPA. That is close to the Law Society's free online service with "no operational relationship with the vendor other than use", and to the public tools ICAEW describes. That reading is this article's, not the Law Society's or ICAEW's.

The business plans and the API change two things the guidance asks about: training is off by default, and a Data Processing Addendum is available. Admins of Business and Enterprise workspaces control retention, and Enterprise and API customers can pick where content is stored. Whether that adds up to "appropriate contractual, technical and organisational safeguards", in the SRA's words, is a judgement each firm makes. No regulator quoted here has made it for any plan.

The American texts add client consent as a route of its own. The AICPA interpretation accepts either a confidentiality contract with the provider or the client's specific consent, and the ABA's release puts informed consent at the centre of Rule 1.6.

On every plan, the text goes to OpenAI. The terms decide what OpenAI may do with it once it arrives.

One of the safeguards the CCBE lists takes the provider out of the question: AI systems that "run locally or within a secured environment controlled by the law firm".9 The CCBE's technical guide, published on 27 March 2026, adds: "On-premise deployment is often preferred when the users deal with confidential or sensitive data."18

That is what private AI means here: a local AI model on the firm's own hardware, answering from the firm's own documents, with nothing sent to a vendor. The firm takes on the machine and its upkeep instead of a subscription. A model small enough to run in an office is not the model behind ChatGPT, so what it can do on a firm's documents has to be tested on those documents rather than assumed.

I offer this as a service. There is no client case study yet: how it works.

• That any ChatGPT plan meets any regulator's rules. None of the texts quoted names one.
• That OpenAI's pages still say this. They were read on 3 October 2026, and several show only a relative update date.
• The full text of ABA Formal Opinion 512, which returned an access error. The ABA's own release is quoted instead.
• The position in any other country, or for any other AI provider. One set of examples is given for Britain, the United States and Europe.