# Can lawyers use ChatGPT with client information?

General information, not legal advice. By Josef Long, October 17, 2026.

Often yes, but not casually. A lawyer's duty to protect client information applies to an AI tool the same way it applies to email or a cloud drive, and the ABA has said what to think about first.

## The short answer

There is no blanket rule that bans a lawyer from using ChatGPT or any other generative AI tool, and no rule that makes it safe by default. The question is what happens to the information once it is typed in, and whether the lawyer has taken reasonable steps to protect it. The ABA's Formal Opinion 512 (July 29, 2024) walks through the duties involved: https://www.americanbar.org/content/dam/aba/administrative/professional_responsibility/ethics-opinions/aba-formal-opinion-512.pdf State rules vary, so check yours.

## What the ABA says to consider

- Confidentiality (Model Rule 1.6). Before entering client information into a tool, understand who can see it, how long it is kept, and whether it can end up in training data or in front of other users.
- Informed consent. Where a tool may disclose or learn from client information, the opinion says the lawyer needs the client's informed consent first, and that generic engagement-letter wording is not enough in many cases.
- Competence (Model Rule 1.1). Understand what the tool can and cannot do, including that it can produce confident, wrong answers.
- Verification. Review output before anyone relies on it. Courts have sanctioned lawyers who filed briefs citing cases an AI tool invented, such as Mata v. Avianca (S.D.N.Y., 2023).
- Supervision and fees. Partners are responsible for how staff use these tools, and a firm cannot bill a client for time it did not spend.

## What changes with the tool

| Setup | What to find out |
|---|---|
| A free or personal consumer account | Whether the provider may keep conversations and use them to improve its models, and whether you can opt out. The setup most likely to be a problem for client information. |
| A business or enterprise plan | What the contract says about training, retention, vendor staff access and storage location. Read the terms, not the marketing. |
| A tool built on an AI provider's API | Two companies now handle the data. Ask about both, and about subprocessors. |
| A tool that runs on the firm's own machines | The information does not go to an outside service, so the questions become access inside the firm and what the tool may connect to. |

More: https://vaultscribe.app/private-legal-ai.md

## A checklist a firm can adapt

1. Write down which tools are approved.
2. Separate public information from client information.
3. Read the data terms before use: training, retention, vendor access, subprocessors and deletion.
4. Decide when client consent is needed, and record how it is obtained.
5. Strip or limit identifying details where the task does not need them.
6. Verify every citation and quotation against the source.
7. Keep a record of which tool was used on which matter.

## Questions

**Is it a violation to put client information into ChatGPT?** Not automatically. Opinion 512 says a lawyer must consider confidentiality first, and in many cases needs the client's informed consent. State rules differ.

**Is a business or enterprise plan enough?** It can reduce risk, but it does not remove the lawyer's duties. Read the terms, know where data is stored and who can access it, and decide whether consent is needed.

**Does a lawyer have to check AI output?** Yes. Opinion 512 says output must be reviewed for accuracy before relying on it.

## How VaultScribe approaches it

Client information does not go to a vendor by default. Work happens on the firm's own machines, every outside request is in a log you can read, and sending, deleting and sharing wait for a person's click. Now accepting founding design partners: hello@vaultscribe.app