Can your firm use ChatGPT with client information?

The short answer has two halves.

A free or personal account: no. Not with anything that identifies a client.

A business account the firm set up, with the right terms and settings: often yes, within limits set by your profession and your clients.

The difference between those two answers is the whole subject. This article is general information, not legal advice. Check with your bar, your board or your regulator before you settle your firm's rule.

Why the version matters

Personal accounts. With the free and individual paid versions of ChatGPT, what you type can be used to improve the service unless you find the setting and turn it off. The conversation is stored on the provider's systems. And the account belongs to the person, not the firm, so when they leave, a history full of client matters leaves with them.

Business accounts. OpenAI says it doesn't use data from its business products to train its models by default, and those products give the firm control over accounts and retention. You can read its commitments on its enterprise privacy page. The business versions of Microsoft Copilot and Google Gemini, which come with the office software you may already pay for, make similar promises.

Terms change, and they differ from plan to plan. Read the ones for the exact product you buy, and keep a dated copy.

"They don't train on it" doesn't mean "it's confidential"

Even on the best terms, your client's information is being stored and processed by another company. Two consequences follow.

It's a disclosure to a third party. Your professional rules and your engagement terms decide whether you're allowed to make it.

"Deleted" depends on things outside your control. In 2025, a federal court hearing a copyright case ordered OpenAI to preserve chat records it would otherwise have deleted, including conversations users had removed themselves. The order stood for more than four months before it was lifted, and OpenAI said its Enterprise customers weren't affected (Engadget). Anyone who had pasted a client's file into a personal account in those months had no way to take it back.

What your profession says

Lawyers in Florida

Florida Bar Ethics Opinion 24-1 says a lawyer may use generative AI, on conditions:

• Research the tool before using it: its policies on data retention, data sharing and self-learning.
• Get informed consent. The opinion recommends obtaining the client's informed consent before using a third-party AI tool in a way that discloses confidential information.
• Verify the output. In 2023 a New York federal court fined two lawyers and their firm $5,000 for filing a brief that cited cases an AI tool had invented (Mata v. Avianca).
• Bill honestly for the time it actually took.

The other duties are covered in what the Florida Bar expects.

Tax preparers and accountants

Section 7216 of the Internal Revenue Code makes it a crime for a preparer to knowingly or recklessly disclose tax return information, or to use it for anything other than preparing the return. The penalty is a fine of up to $1,000, up to a year in prison, or both. There are exceptions, including disclosures made with the taxpayer's consent in the form the regulations require.

We haven't found IRS guidance that addresses AI tools directly. Until there is some, the careful reading is to treat pasting identifiable return information into an AI tool as a disclosure, and to get your adviser's view or the client's written consent first.

The FTC Safeguards Rule also applies. An AI provider that handles client information is a service provider, and the rule expects you to vet it and to have security terms in the contract.

Everyone else

Financial advisers, insurance agencies, title companies and consultancies each have a privacy rule and a set of client contracts that work the same way. And check those contracts. Some corporate clients now forbid their outside advisers from using AI on their work at all, or require permission first.

A decision table

What you want to put in	Personal account	Business account the firm manages
A general question with no client facts	Fine	Fine
A draft with every identifying detail removed	Not as a habit. People forget to remove things.	Fine
A client's name, documents or matter details	No	Yes, if your professional rules and the client's terms allow it. Record the decision.
Social Security numbers, account numbers, tax returns, health information	No	Only with a documented basis, such as consent. Better not to.
Passwords and access codes	Never	Never

If you want to say yes: seven steps

1. Choose one tool and buy the business version. One is easier to control than five.
2. Read the data terms and save a copy: training, retention, where it's stored, who else handles it.
3. Create the accounts yourselves, on work email, with multi-factor authentication. No personal accounts for firm work.
4. Set how long conversations are kept.
5. Write a one-page policy and have everyone sign it. Our AI use policy template is ready to adapt, and a policy that works explains each rule.
6. Tell clients where you have to, and add a line to your engagement letter.
7. Fix your file permissions before you switch on an assistant built into your office software. Those assistants can find any file the person asking is allowed to open. If the shared drive is open to everyone, so is the partners' compensation spreadsheet.

What's already happening at your firm

Whatever you decide, someone at your firm has probably pasted client text into a chatbot this month. They did it to save time, on a personal account, because nobody gave them an approved way to do it.

A ban doesn't stop that. It moves it onto personal phones, where you can see nothing. What works is an approved tool, a short rule, and settings that back the rule up: control over which apps and browser extensions can be installed on firm computers, and monitoring of the accounts themselves. See device monitoring and patching.

What it costs, against what it risks

	What it comes to
A business AI subscription	A few hundred dollars a year per person. Check the provider's current price.
A written policy and the settings behind it	Part of our compliance support. Our plans run from $75 to $234 per person per month.
Doing it properly	Staff save real time, with your approval, inside a tool you control
Leaving it alone	The same use, on personal accounts, with client files you can't get back
One disclosure that comes to light	A conversation with the client, possibly with your regulator, and for a tax preparer a potential criminal penalty

This is a rare security decision where the safe choice also makes the firm faster. The cost is small and known. The exposure of leaving it alone is neither, and you wouldn't hear about it until a client asked what you'd done with their file.

Where to start

1. Ask your staff what they use. Without blame. You need the real answer.
2. Pick the approved tool and set it up.
3. Adopt the one-page policy.
4. Put it on the agenda every six months. These tools change quickly.

If you'd like help choosing the tool and putting the settings in place, book a free review.