Is ChatGPT Confidential Enough for Client Work?

We run a directory of AI legal software and we don't sell any of it. That matters on this topic because most pages answering "can lawyers use ChatGPT" are written by companies selling a purpose-built legal tool, and the easy answer for them is "no, buy ours." The more useful answer is a comparison of what each tier actually promises, and what to ask any vendor, including the ones in our directory.

This is general information about software, not legal advice. Your confidentiality and privilege obligations come from your own jurisdiction's rules and your clients' engagement terms. Talk to your bar's ethics counsel before putting client information into any AI tool.

What happens to what you type into ChatGPT?

Think of a prompt as a document you are handing to a third party. Four things can happen to it afterwards, and each one is a separate question.

1. It can be used to improve the model. On consumer plans this depends on the data-control settings. One legal-tech vendor's write-up of the tiers describes consumer content as usable for model improvement depending on those settings, while Business and Enterprise inputs are excluded from training by default. That is a reported description, so confirm it against OpenAI's current terms before relying on it.
2. It can be retained. Deleting a chat in the interface is not the same as the provider deleting it. The Bar Association of San Francisco flagged in August 2025 that a court order in the New York Times v. OpenAI litigation required OpenAI to keep user chat logs, including deleted ones, and that this applied to the Free, Plus/Pro and Team plans, with enterprise accounts as the exception. Court orders change. Check the current status rather than treating that date as final.
3. It can be shared further than you intended. The same bar alert notes that chats shared by link can surface in Google search results. A shared link containing case strategy is a disclosure, however convenient it was.
4. It can be demanded in a proceeding. In February 2026 a New York federal judge ruled from the bench in United States v. Heppner that documents a defendant generated with a consumer AI tool were neither attorney-client privileged nor work product. Jones Walker's summary of the ruling says the court found no reasonable expectation of confidentiality, partly because the tool's terms said inputs were not confidential, and notes that enterprise-tier agreements typically exclude user data from training and provide contractual confidentiality. That was one trial-court bench ruling in a criminal case, reported secondhand, not settled law everywhere.

The pattern in all four: the protection lives in the contract, not in the interface. A polished chat window tells you nothing about retention, training or who can read the logs.

How do consumer, team and enterprise tiers differ?

The table below compares the tier categories against a purpose-built legal AI tool. Every cell is labeled with where it comes from, because terms change and you should read the current documents yourself before any client file goes in. "Reported" means a secondary source described it and we did not verify it against the provider's own page this run.

	Consumer (free, Plus, Pro)	Team or Business	Enterprise	Purpose-built legal AI tool
Training use	Depends on data-control settings (reported)	Excluded by default (reported)	Typically excluded by contract (reported)	Set by the vendor's agreement and its model provider's terms. Ask for both.
Retention	Court-ordered preservation of chat logs, including deleted ones, was reported in 2025	Court-ordered preservation was also reported to cover Team plans	Reported as the exception to that order; admin-controlled retention (reported)	Stated in the master agreement or DPA. Ask what survives deletion: indexes, logs, backups.
Admin controls	None meaningful for a firm	Workspace admin settings	Fuller admin and retention controls (reported)	Varies. Ask about matter-level permissions and audit logs.
Contract terms	Click-through consumer terms	Business terms	Negotiated agreement, where a DPA and confidentiality terms live	Negotiated or standard MSA plus DPA, sub-processor list, often a SOC 2 report
Confidentiality in practice	A court has treated consumer-tool chats as not confidential	Better than consumer, still read the terms	The tier most commentary says can fit confidential work, subject to your own diligence	Only as good as the documents you actually receive

Two things to take from the table. First, the gap between consumer and enterprise is large, and a lot of the risk comes from lawyers or staff using a personal account because it is faster than asking for a licensed one. Second, the last column is not automatically safe. A legal AI vendor that calls an enterprise model through an API is only as confidential as its agreement with that provider plus its own controls. Our guide to legal AI data security walks through the five questions that expose this.

What does published ethics guidance ask of lawyers?

The main reference point in the United States is ABA Formal Opinion 512, issued in July 2024, which addresses lawyers' use of generative AI tools across competence, confidentiality, communication, supervision and fees. The confidentiality piece rests on the duty in Model Rule 1.6 to make reasonable efforts to prevent unauthorized disclosure of, or access to, information relating to a client's representation. The practical reading that most commentary takes from it is that you should understand how a tool handles inputs before using it with client information, and that for tools that learn from what you enter, you may need informed client consent beyond a line in an engagement letter.

We could not open the opinion itself to quote it this run, so read it directly rather than relying on our paraphrase. State bars have issued their own guidance as well, and the State Bar of California published practical guidance on generative AI in the practice of law that is worth reading if you practice there. The rules differ by state, and some bars have said more than the ABA.

What we can say as a software directory: the ethics question and the software question are different questions. The ethics guidance tells you what to look at. The tier comparison above tells you what the software promises. You need both, and neither replaces your own jurisdiction's rules.

How do legal AI vendors handle data differently?

Purpose-built legal AI tools are not magic, but they do tend to differ from a consumer chatbot in five concrete ways you can verify:

• A signed agreement exists. There is a master agreement or data processing addendum that states training and retention terms in writing. A consumer chat window has none that you negotiated.
• There is a sub-processor list. You can see which model providers and cloud hosts touch your data.
• There is independent assurance. Many publish a SOC 2 report or ISO/IEC 27001 certificate. Our post on what a SOC 2 report does and does not tell you covers how to read one.
• There are matter-level controls. Permissions, audit logs and deletion workflows designed for firms.
• There is a place to put your questions. A sales engineer, a trust center, a security questionnaire.

None of that is a guarantee. Some vendors have all five and some have a marketing page. The legal AI procurement checklist and our buyer's checklist for evaluating legal AI turn this into questions you can send before any demo. If you want to compare tools that handle this differently, browse the AI legal tools directory.

One more distinction matters. Safer on confidentiality does not mean safer on accuracy. A tool can keep your data locked down and still invent a citation. That is a separate failure mode, covered in legal AI hallucination sanctions, and it applies to enterprise ChatGPT as much as to anything else.

What should never go into a general chatbot?

Policy beats case-by-case judgment, because the person pasting at 11 p.m. is not re-reading the terms. A workable default for a firm or legal department:

• Never on a consumer or personal account: client names, matter facts, privileged communications, discovery material, deal terms, anything under a protective order or NDA.
• Never via a shared chat link: strategy, drafts, or anything you would not email to opposing counsel.
• Only on an approved tier, after reading its terms: de-identified drafting help, summarizing your own non-client text, brainstorming structure.
• Fine on any tier: public information, general legal concepts you would look up anyway, formatting and tone edits on text that contains nothing about a client.

De-identification is not as safe as it sounds. Remove the client name and leave the unusual fact pattern and the matter can still be identifiable. Treat de-identified prompts as lower risk, not zero risk.

Then write it down. A short firm policy that names the approved tools, the banned accounts and who to ask beats an unwritten understanding, and it gives you something to show a client who asks. If you are starting from nothing, the free tier of a chatbot is also where free AI legal tools usually start, and the same rule applies: free consumer terms are not a place for client files. For the broader question of how far any of this can go, see can AI replace a lawyer.

What should you do this week?

1. Find out what is already in use. Ask staff which accounts they use. The risk is usually an unapproved personal login, not an approved tool.
2. Read the current terms yourself. Provider terms and court orders change, so treat every figure in a blog post, including this one, as a starting point.
3. Pick one approved tier and one purpose-built option, and get the agreement, DPA and sub-processor list in writing before the first client file.
4. Write the one-page policy, and tell clients how AI is used on their matters if your jurisdiction or engagement terms call for it.

FAQ

Does ChatGPT train on what lawyers type?

It depends on the account. Reporting on consumer plans says content can be used to improve models depending on the data-control settings, while Business and Enterprise inputs are described as excluded from training by default. Confirm against OpenAI's current terms for your plan, and remember that "not used for training" is not the same as "not retained."

Is ChatGPT Enterprise safe for client data?

Enterprise terms are the tier commentary most often says can fit confidential work, because they typically exclude training and add contractual confidentiality. "Safe" is still a judgment you make after reading the agreement, checking retention and admin controls, and confirming it satisfies your own bar's guidance. This is general information about software, not legal advice.

Can using ChatGPT waive privilege?

Courts are only starting to address it. A New York federal judge ruled in February 2026 that a defendant's chats with a consumer AI tool were not privileged or work product, and the government also argued that sharing privileged communications with a third-party AI platform can waive privilege over them. That was a single bench ruling in a criminal case, so treat it as a warning sign, not a rule. Ask a lawyer who practices in your jurisdiction.

Is legal AI safer than ChatGPT?

Often it is better documented, with signed agreements, sub-processor lists and security audits you can ask for. It is not automatically safer. Verify training, retention, sub-processors and hosting for any tool using the questions in our legal AI data security guide, then compare options in the directory.