Is ChatGPT Confidential for Lawyers? What AI Trust Looks Like in 2026

The CosmoLex 2026 Legal Tech Report found that AI is already part of everyday work for 74% of surveyed legal professionals, but they aren’t always confident in its reliability and safety. Solo and small firms still have concerns about AI’s accuracy and reliability (60%) and data security and privacy (52%).

As firms increasingly rely on AI to save time and expand capacity, those unanswered questions about confidentiality can carry real compliance implications.

Is ChatGPT confidential for lawyers? Is it safe to use for legal work? The short answer: Lawyers can use ChatGPT and other AI tools without automatically violating client confidentiality. But protecting that data depends on what you share, which AI environment you’re using, how the provider handles your data, and what current ABA guidance requires.

Responsible use starts with understanding how your data is used, stored, and protected along with safeguards that can help keep client information private.

What Affects Client Confidentiality in AI Tools?

General-purpose AI tools like ChatGPT are not automatically safe for legal work because the data entered into the system may be used to train AI models, retained for a period of time, or shared in other ways that could violate client confidentiality.

Each AI platform handles data differently. In order to use these tools without putting confidentiality at risk, firms must consider the input, product, account settings, and data use terms.

Information Input

What do you share or enter into an AI tool? This is where your firm has the greatest control over confidentiality in an AI platform.

There is a difference between asking AI to write a short email and uploading a client file containing names, case facts, financial data, and privileged communications.

Under ABA Formal Opinion 512, you have a responsibility to:

• Understand the technology well enough to use it competently
• Protect confidential client information when using the technology
• Independently review and verify any AI-assisted legal work
• Consider whether client disclosure or informed consent is needed

To keep information confidential, avoid entering identifiable client details into any general-purpose or legal-specific AI tool without verifying that the data-handling settings are appropriate for that use.

Account or Product Tier

Not every version of an AI platform account is suitable for use in a law firm. In most cases, commercial or business accounts feature stronger data privacy controls than personal or consumer accounts.

For example:

• OpenAI: Personal ChatGPT account content may be used to train models, depending on your settings. ChatGPT Business, Enterprise, Edu, and API inputs and outputs are not used for training by default.
• Anthropic: Claude Free, Pro, and Max users can control whether chats are used for model training. Claude for Work and API data is not used for training by default.
• Microsoft: Prompts, responses, and file contents in Copilot for Microsoft 365 are not used to train foundation models, and Copilot Chat with enterprise data protection excludes prompts and output from model training.

The safest choice to maintain confidentiality is using legal-specific AI tools. When using general-purpose AI platforms, only a business or commercial account should be used.

Data-Use Terms

Each AI platform’s data-use terms outline what the company can and cannot do with your data. Before using an AI tool for client-related work, review the platform’s terms and conditions to find out:

• Are prompts or uploaded files used to train the AI model?
• Who can access customer data?
• Is the data shared with other processors or connected services?
• Do contractual confidentiality protections apply?
• Can the provider use your data for purposes beyond delivering the service?
• Does integrating or connecting another app change the data-use terms?

There’s an important distinction here between vendor privacy and your own confidentiality duty. A provider may offer strong privacy protections, but their terms do not substitute your own responsibility to evaluate whether those settings are enough to protect client information.

Data Storage and Retention Practices

Even when an AI tool does not use your data for training or model improvement, it may still store it for a period of time. OpenAI says Temporary Chats may be retained for up to 30 days, while Anthropic says Claude for Work data may be stored indefinitely.

For a law firm, it’s important to know how long your information will continue to be stored and accessible within an AI tool. Even more essential is understanding how to delete or manage your data for stronger protections.

That can include using temporary chat modes, deleting saved conversations and uploaded files, reviewing your retention settings, and setting firm-wide policies for when AI-generated work should be removed or deleted from the platform.

Where your data is stored matters, too. Canadian lawyers should confirm where an AI provider stores and processes any client information and whether privacy or professional requirements restrict data storage outside of Canada.

As one participant noted in the CosmoLex 2026 Legal Tech Report, “The challenge for Canada is that many US companies keep their data centers in the US, and we need data centers in Canada.”

How Small Firms Are Using AI and Legal Tech Today

We asked 50 legal professionals what they use, trust, and think about as legal tech and AI take on a bigger role in the firm. Here’s what they told us.

[Get the Report →]

Confidentiality Is Just One Concern with AI in Law Firms

The CosmoLex 2026 Legal Tech Report found that among the 90% of participants who say they use AI-powered tools, many participants’ concerns fall into three categories: accuracy and reliability, data security and privacy, and ethics and compliance.

Concern #1: Can You Trust the Answer?

Sixty percent of participants named accuracy and reliability as a top concern with AI in the report.

One respondent said, “AI is still not guaranteed to be accurate and reliable; after all, you still need to sign your name to everything you produce.” Another noted, “Using AI is like training an intern…you need to check the work.”

When you use AI to draft, summarize, research, and review documents faster, make sure all output is verified by a human before trusting it.

Concern #2: How Is Your Data Handled and Stored?

Data privacy and security were also concerns for firms and legal professionals using AI for legal work. As one respondent stated, “My primary concern is data security and privacy to ensure I protect the attorney-client privilege, so I don’t upload documents to systems I don’t trust.”

That puts the burden on firms to know where information goes, how long it’s stored, how it’s used by the AI tool, and what protections apply before ever entering client information into the platform.

Using embedded AI within a trusted legal software environment can reduce some of that uncertainty by keeping more of the work inside a system your firm has already evaluated. Tools like CosmoLex also ensure your data is always stored where your firm operates; U.S. data centers for U.S.-based firms, and Canadian data centres for firms in Canada.

Concern #3: Are You Exercising Professional Judgment?

Even if the output is accurate and your account settings help protect confidentiality, you are still the final decision-maker with an ethical duty to exercise professional judgment.

Ethics and compliance were top AI concerns for 28% of participants in the report, and one respondent captured that concern directly: “We are concerned about abdicating decision-making responsibility and judgment to machines.”

Use AI to support the work, but keep legal judgment, review, and final decisions with the lawyer.

AI Confidentiality Checklist for Law Firms

Before using AI for client-related work, asking these questions can help you protect private details:

• What are you sharing? Never enter identifiable client information, privileged communications, financial details, case strategy, or sensitive documents into general-purpose AI tools unless you have verified that it provides appropriate protections.
• Did you opt out of model training? Verify that your AI tool settings have been updated to prevent your data from being used for AI model training and improvement.
• What kind of account is it? Business, enterprise, and legal-specific AI products may offer stronger confidentiality protections while preventing data from being used to improve or train AI models. Personal, consumer-grade accounts may not have these protections.
• How long is your data retained? Find out how long chats, prompts, and uploaded files stay in the system and whether you can manually delete them. Use temporary chats when appropriate, remove files you no longer need, and ensure everyone within your firm follows the same guidelines.
• Where is your data stored? Data location can be especially important for Canadian firms. Confirm where retained data is stored and whether that location meets your professional and organizational requirements.
• Who can access your information? Find out whether your data can be accessed by the AI provider, integrated applications, or other third parties. Confirm how any third-party access changes your applicable confidentiality protections.
• Did you verify the output? AI-assisted research, review, drafting, and summaries still need human verification. Cross-check any output to ensure it is accurate and factual before proceeding.
• Are you disclosing AI use to clients? Consider whether the engagement letter or client communications should explain how AI may be used in representation. Check with your bar association or law society to confirm whether you need to obtain informed consent.
• Does your firm have an AI policy? Can lawyers use ChatGPT or other general-purpose tools? Can they upload client documents into an AI platform? What limitations do you set on AI use for legal work? Be sure your policy is documented and accessible to your entire team.

A Safer Way to Bring AI into Legal Work

AI can be safe for legal work, but only when the right protections are in place. Lawyers still need to know what information they are sharing, how that data is handled, and who has access to it.

General-purpose AI platforms leave firms to manage privacy settings and retention rules on their own. Legal software with embedded AI can build those protections into the platform from the start.

For firms, that means fewer moving parts and settings to manage and a safer way to use AI without losing sight of confidentiality.

CosmoLex brings embedded AI into the same secure platform you use to manage matters, accounting, trust accounting, and billing. Your data is never used to train AI models, is stored in the U.S. or Canada, and stays connected in a single end-to-end system designed to simplify the business of running your firm.

See how CosmoLex approaches AI with a personalized walkthrough. Book a demo now to explore how your firm can use AI with built-in safeguards, less switching between tools, and more control over your data.