ChatGPT for lawyers: safe use, confidentiality, and record keeping

Lawyers can use ChatGPT for drafting, summarising, and research support, but not with identifiable client information on a consumer plan. Use a business plan with a data processing agreement, verify every citation against a primary source, and keep an exported record of any session that informed client work.

Short answer

The professional risk with ChatGPT is not the tool. It is using a consumer account as though it were a privileged workspace, and treating output as though it were verified.

Confidentiality first

Model rules across jurisdictions require reasonable steps to protect client information disclosed to third party services. On a free or Plus account, conversations may be used for training unless you disable it, and OpenAI staff can access chats for safety review. That is difficult to reconcile with a duty of confidentiality.

Practical position most firms land on:

Consumer plan: anonymised facts and general research only. No names, matter numbers, or document text.
Team or Enterprise: client work permitted under firm policy, since data is excluded from training and covered by a data processing agreement.
Never: privileged correspondence pasted wholesale into a personal account.

The citation problem

Fabricated case citations have produced sanctions in several reported matters. The failure mode is specific and dangerous: the model produces a correctly formatted citation, with a plausible court, year, and reporter, for a case that does not exist. It does this most often when asked for authority supporting a proposition that has none.

Rule of practice: treat every citation as unverified until you have pulled it from a primary database. Use the model for structure, argument shape, and first drafts, not for authority.

Where it genuinely helps

Summarising long documents you already have
First drafts of routine correspondence and clauses
Rewriting dense passages into client friendly language
Chronology building from facts you supply
Interrogating your own argument for weaknesses

Keeping a defensible record

If a chat informed advice that went to a client, you want to be able to show what was asked and what came back. Screenshots are not a record, and the ChatGPT interface is not an archive you control.

Export from Settings, Data Controls, Export Data, then convert the resulting JSON into PDF or Word files that can go on the matter file with everything else. PDF is the format most firms prefer because it drops into a document management system unchanged and reads the same in five years. Doing this at the close of a matter takes minutes and turns an informal tool into something you can account for.

A workable firm policy in five lines

Client identifiable data only on the firm's business account.
Every citation verified against a primary source before it leaves the building.
AI assisted drafts marked as such in internal review.
Sessions that informed advice exported to the matter file.
Annual review, because plan terms change.

Frequently asked questions

Can lawyers put client documents into ChatGPT?

Only on a business plan covered by a data processing agreement and permitted by firm policy. Consumer plans are not appropriate for identifiable client material.

Has ChatGPT caused problems in court?

Yes. Several reported matters have involved fabricated citations submitted to courts, leading to sanctions. Verification against primary sources is essential.

What format should I keep AI sessions in for the matter file?

PDF is the usual choice because it is stable, printable, and drops straight into a document management system. Word works if you need to annotate.

Is ChatGPT covered by legal professional privilege?

No. Disclosing privileged material to a third party service can create waiver arguments. Take advice on your jurisdiction before relying on it.