Explainer · 05

Can I paste client files into ChatGPT?

It's the question behind most of our consults. The honest answer is that it depends — on your profession, your clients' agreements, and the specific service and plan you use. It's worth finding out before the first paste, not after.

Start with your obligations, not the tool

Most confidential work comes with rules written long before AI existed, and they still apply:

  1. Lawyers

    Duties of confidentiality cover what you share with outside services. The American Bar Association addressed generative AI directly in 2024 (Formal Opinion 512), and many state bars have issued their own guidance.

  2. Healthcare

    In the US, sharing patient health information with a vendor generally requires a Business Associate Agreement under HIPAA. A standard consumer AI account won't come with one.

  3. Finance and accounting

    Tax preparers, advisors and firms have their own confidentiality and data-security rules, and engagement letters often add more.

  4. Everyone else

    NDAs and client contracts often limit who you can share information with — and a cloud AI provider counts as a who.

This isn't legal advice. Your licensing body, compliance officer or attorney is the right place to confirm what applies to you.

Questions to ask any cloud AI service

  • Is my data used for training? And is that on by default, or something I have to switch off?
  • How long is it kept? Including conversations I've deleted.
  • Who can review it? Can staff read conversations — for safety review or anything else?
  • Will you sign an agreement? A BAA, a data processing agreement, or whatever your field requires — and on which plan.

Your three realistic options

  1. Don't paste it

    Use cloud AI only for work that isn't confidential. Free, and often enough.

  2. Use a plan with the right agreement

    Some providers offer business tiers with contractual protections. Read what they actually cover.

  3. Keep it in the building

    Run the model on hardware you own, so confidential material never goes to a third party at all. That's what we build.