Can Lawyers Use ChatGPT With Client Documents?

What does the ABA say about lawyers using ChatGPT?

The ABA allows it, under the same duties that apply to any tool. Its first formal opinion on generative AI, Formal Opinion 512 (July 2024), applies the existing Model Rules rather than creating new ones.¹

On confidentiality, the opinion is direct. For tools that can learn from what you enter, "a client's informed consent is required prior to inputting information relating to the representation into such a GAI tool." And "merely adding general, boiler-plate provisions to engagement letters purporting to authorize the lawyer to use GAI" is not enough.¹ That sits on top of Model Rule 1.6(c), which requires reasonable efforts to prevent unauthorized disclosure of client information.²

On fees, the ABA's announcement put it plainly: in most circumstances, a lawyer cannot charge a client for learning how to work a generative AI tool.³

What do state bars say about client information in AI tools?

State bars broadly agree with the ABA, and some are stricter. Your state's rules and opinions control, so check them before setting firm policy.

• California: the State Bar's 2026 practical guidance says that, as a general matter, a lawyer "must not input any confidential information of the client into a generative AI solution that may present material risks to confidentiality or security, absent informed client consent" and that reasonable efforts require more than reliance on a vendor's marketing assurances.⁴
• Florida: Ethics Opinion 24-1 (January 2024) recommends getting the affected client's informed consent before using a third-party generative AI program if it would involve disclosing confidential information.⁵
• North Carolina: 2024 Formal Ethics Opinion 1 says that, as of its date, "lawyers should avoid inputting client-specific information into publicly available AI resources."⁶

Does it matter which version of ChatGPT you use?

Yes. The biggest difference is whether your conversations can be used to train OpenAI's models and who controls how long they are kept.

OpenAI's data controls page says consumer ChatGPT may use conversations to improve its models unless the user opts out.⁷ Its enterprise privacy page says it does not use business data from ChatGPT Business, Enterprise, Edu or the API for training by default.⁸

Retention can also be taken out of your hands. In 2025, a court order in the New York Times lawsuit required OpenAI to preserve consumer and Team conversations, and API data without zero data retention, that it would otherwise have deleted. The order did not cover ChatGPT Enterprise or Edu. OpenAI says its obligations under it ended on September 26, 2025, though it still holds limited April to September 2025 data the Times is seeking.⁹ The lesson for firms: a vendor's deletion policy is not the last word on where client data ends up.

What about mistakes and made-up citations?

Verification is the lawyer's job, every time. In Mata v. Avianca (S.D.N.Y. 2023), a court sanctioned two lawyers and their firm, imposing a $5,000 penalty, after they submitted non-existent judicial opinions with fake quotes and citations created by ChatGPT and then stood by them.¹⁰

It keeps happening. An independent database maintained by researcher Damien Charlotin listed more than 2,200 court decisions worldwide involving AI-fabricated content as of late October 2026.¹¹ A business plan protects confidentiality. It does nothing for accuracy.

How many lawyers already use AI tools like ChatGPT?

About three in ten, as of 2024. In the ABA's 2024 AI TechReport, 30.2% of attorneys said their offices use AI tools, from 17.7% of solo practitioners to 47.8% at firms of 500 or more lawyers. ChatGPT was the tool respondents most often said they had adopted or were seriously considering.¹²

Without a firm-approved option, some people will use personal accounts. That is the riskiest version of all, because nobody at the firm can see what went in.

What should a firm do before lawyers use ChatGPT with client documents?

Treat it like any other vendor that touches client information, then add the AI-specific checks.

1. Provide an approved tool. Use a business plan that doesn't train on your data (on OpenAI, retention controls come with Enterprise, not Business), and ban personal accounts for client work.
2. Get informed consent where it's required. Make it specific to the tool and the matter, not a boilerplate engagement-letter clause.
3. Share only what the task needs. Remove names and identifiers when the work doesn't depend on them.
4. Verify carefully. Review output with care that fits the task, and check every citation, quote and fact before anything is filed or sent to a client.
5. Write a short AI policy and train people on it. Cover approved tools, what may go in, who reviews output, and how to report a problem.
6. Bill honestly. Charge reasonable fees for time actually spent, and generally not for learning the tool.
7. Check your state bar. Read your jurisdiction's opinions and recheck them as they change.

This is general information, not legal advice. Your state's rules and your firm's ethics counsel have the final word.

When does a firm need more than ChatGPT?

When the work has to happen inside your own systems. ChatGPT is a good drafting and research assistant, but it isn't set up to run your firm's workflows, like opening a matter from an intake form or keeping your practice management system up to date.

For firms that want AI working on real matters, Soren AI builds it into the systems they already use, deployed in the cloud, on premises or hybrid, depending on where the firm's policies allow client data to go. Common first projects are client intake and a searchable internal knowledge base. More on AI for law firms and how we work. If data location is the sticking point, the same questions apply as when banks keep customer data in-region.