Can lawyers use ChatGPT with client information?

This page follows Florida Bar Ethics Opinion 24-1, issued 19 January 2024. It is advisory and not binding, and it is one state's view. Your own bar or regulator decides what applies to you.

• Lawyers may use generative AI but “must protect the confidentiality of client information”, by “researching the program's policies on data retention, data sharing, and self-learning”.
• The duty of confidentiality “applies to all information learned during a client's representation, regardless of its source”.
• It “is recommended that a lawyer obtain the affected client's informed consent prior to utilizing a third-party generative AI program if the utilization would involve the disclosure of any confidential information”.
• A lawyer must know “whether the program is 'self-learning'”. The risk the opinion names: a client's information “may be stored within the program and revealed in response to future inquiries by third parties”.
• Older guidance on cloud services applies equally: check that the provider has an enforceable duty to keep information confidential and to tell you about a breach or an order to produce it, check its security and policies, and check whether it keeps your data after you stop using it.
• If a tool does not involve disclosing confidential information to a third party, “a lawyer is not required to obtain a client's informed consent” under that rule. The opinion adds that confidentiality concerns may be mitigated by using an in-house generative AI rather than an outside one where a third party hosts and stores the data.

The same opinion says a lawyer must verify “the accuracy and sufficiency of all research performed by generative AI” and remains responsible for the work product. It cites a federal case in which a judge sanctioned two lawyers and their firm over false citations generated by AI (Mata v. Avianca, S.D.N.Y., 22 June 2023), and notes the judge wrote there is “nothing inherently improper about using a reliable artificial intelligence tool for assistance”.

• List every AI tool your firm uses, including personal and free accounts. Business terms cover only the plan they come with.
• For each one, find the sentence in its terms about training on your data and about how long prompts and files are kept. For example, Microsoft's page on data protection for Copilot used by organisations says: “Your data isn't used to train foundation models”. Terms differ by plan and change, so read the sentence for each tool you use.
• Decide which matters need the client's informed consent, and put it in your engagement letter in words a client can follow.
• Write a one-page rule: which tool for which job, and a person checks every citation.
• If the honest answer to “may a third party see this file?” is no, the model has to run on your firm's own hardware or in its own cloud account.

A business plan from a large provider can be enough for work that discloses no confidential client information, or where the client has given informed consent and the provider's terms fit your rules. It is not enough when a client, a court or your own rules say no third party may process the file. Then the options are removing client details by hand, which is slow and fails on one missed page, or AI that runs on your own hardware or in your own cloud account.

That second case is what we set up: Aether Core, private AI installed on your own machine or in your own cloud account. We also tell you plainly when you do not need it. For a wider checklist, see Before your firm puts client files into AI. This page is general information, not legal advice.