Can Lawyers Use ChatGPT With Client Data?

Q: Is it a violation to put client information into ChatGPT?

Not automatically. The ABA's Formal Opinion 512 says a lawyer must consider the duty of confidentiality before putting client information into a generative AI tool, and in many cases needs the client's informed consent first. Which tool, which settings and what information all matter, and state rules differ.

Q: Does a lawyer have to check AI output?

Yes. Opinion 512 says lawyers must review AI output for accuracy before relying on it. Courts have sanctioned lawyers who filed AI-generated citations to cases that do not exist.

Often yes, but not casually. A lawyer's duty to protect client information applies to an AI tool the same way it applies to email or a cloud drive, and the ABA has said what to think about first. This guide covers what the duty requires, what changes with the tool you choose, and a checklist a firm can adapt.

The short answer

There is no blanket rule that bans a lawyer from using ChatGPT or any other generative AI tool. There is also no rule that makes it safe by default. The question is what happens to the information once it is typed in, and whether the lawyer has taken reasonable steps to protect it. The ABA's Formal Opinion 512 (July 29, 2024) walks through the duties involved. Read the opinion. State bar rules and guidance vary, so check yours.

What the ABA says to consider

Confidentiality (Model Rule 1.6). Information relating to the representation of a client must be kept confidential. Before entering it into a tool, a lawyer should understand who can see it, how long it is kept, and whether it can end up in the tool's training data or in front of other users.
Informed consent. Where a tool may disclose or learn from client information, the opinion says the lawyer needs the client's informed consent first. It says generic wording in an engagement letter is not enough in many cases.
Competence (Model Rule 1.1). A lawyer should understand what the tool can and cannot do, including that it can produce confident, wrong answers.
Verification. Output must be reviewed before anyone relies on it. Courts have sanctioned lawyers who filed briefs citing cases an AI tool invented, such as in Mata v. Avianca (S.D.N.Y., 2023).
Supervision and fees. Partners are responsible for how staff use these tools, and a firm cannot bill a client for time it did not spend.

What changes with the tool

"ChatGPT" is not one thing. The risk depends on which version, which settings and which contract.

SetupWhat to find out

A free or personal consumer accountWhether the provider may keep your conversations and use them to improve its models, and whether you can opt out. This is the setup most likely to be a problem for client information.

A business or enterprise planWhat the contract says about training on your content, retention, who at the vendor can access it, and where it is stored. Vendors often state they do not train on business data by default. Read the terms rather than the marketing.

A tool built on an AI provider's APITwo companies now handle the data. Ask about both, and about any subprocessors.

A tool that runs on the firm's own machinesThe information does not go to an outside service, so the main questions become access inside the firm and what the tool is allowed to connect to.

There is a longer treatment of these differences, with questions to ask any vendor, in Private legal AI.

A checklist a firm can adapt

Write down which tools are approved. Staff who are not told will use whatever is easiest, including personal accounts.
Separate public information from client information. Drafting a generic template is a different risk from pasting in a client's facts.
Read the data terms before use. Training, retention, access by the vendor's staff, subprocessors and deletion.
Decide when client consent is needed, and record how it is obtained. Do not rely on boilerplate alone.
Strip or limit identifying details where the task does not need them.
Verify every citation and quotation against the source before filing or sending.
Keep a record of which tool was used on which matter, in case a client or a court asks.

Questions

Is it a violation to put client information into ChatGPT?

Not automatically. The ABA's Opinion 512 says a lawyer must consider the duty of confidentiality first, and in many cases needs the client's informed consent. Which tool, which settings and what information all matter, and state rules differ.

Is a business or enterprise plan enough?

It can reduce risk, for example when a vendor commits not to train on your content. It does not remove the lawyer's duties. The firm still needs to read the terms, know where data is stored and who can access it, and decide whether consent is needed.

Does a lawyer have to check AI output?

Yes. Opinion 512 says lawyers must review output for accuracy before relying on it, and courts have sanctioned lawyers who filed citations to cases that do not exist.

How VaultScribe approaches it

VaultScribe is built so client information does not go to a vendor by default. Work happens on the firm's own machines, every outside request is in a log you can read, and sending, deleting and sharing wait for a person's click. I am looking for founding design partners, with a non-binding letter of intent and terms agreed on a call.

Become a design partner Security and architecture

Related: Private legal AI, AI meeting transcription and client confidentiality and Legal AI agent for law firms. This page is general information and is not legal advice.