Answer · Process
Can a regulated firm use ChatGPT with client data?
The answer
A regulated firm can use ChatGPT or a similar tool with client data only where it can show which data goes where, under which terms, with which controls, and who signed that off. The tool is rarely the problem on its own. The problem is the unwritten version: a fee earner pasting a client letter into a consumer account whose terms allow the provider to use the input for training. Business and API terms differ from consumer terms, and that difference is most of the question. A defensible position names the workflow, the tool and tier, the data allowed and excluded, the retention setting, and the evidence the firm could produce if a client or regulator asked. Some workflows will fail that test. The firm should be able to say so in writing rather than discover it later.
What are the five questions to answer for each workflow?
The same five, every time, written down before the workflow runs.
- What is the workflow? Name the task, not the tool. Summarising a lease is a workflow. Using ChatGPT is not.
- Which tool and which tier? A consumer account, a business plan and an API integration are three different products with three different sets of terms.
- Which data may go in, and which may not? Client identifiers, privileged material, health data and anything under a confidentiality undertaking need an explicit yes or no.
- What happens to the input and the output? Retention, training use, location of processing, and who at the provider can see it.
- Who checks the output before it leaves the firm, and who signed this position off?
A workflow with a written answer to all five is defensible. A workflow without one is running on hope. The review that produces the written answers is AI Governance and Assurance.
Why do consumer and business terms matter so much?
Because the same model, reached through a different door, can carry different commitments about what happens to the firm's data.
Consumer products are typically offered on terms written for individuals, and those terms may permit the provider to use inputs to improve the service unless the user changes a setting. Business and API products are typically offered on terms written for organisations, with different defaults on training use, retention and data location, and often a contract the firm can hold the provider to. The words matter more than the brand name on the login screen.
So the question is never whether the firm may use ChatGPT. The question is which product, on which terms, for which data. A firm that cannot answer that has not decided anything yet, whatever its policy document says.
What tends to fail the review?
Workflows where the data path cannot be described, where the output is not checked, or where the person defending it could not explain it to a client.
Common failures include pasting whole client documents into a consumer account, using a tool whose terms nobody at the firm has read, letting a model draft client-facing advice without a named reviewer, and connecting a document store to a tool without knowing which folders it can reach. None of these are exotic. All of them are found in firms that believe they have an AI policy.
Failing is a useful outcome. The multi-office accountancy group in Partners who wanted AI they could defend had several workflows declined in writing, and the declined list was as valuable to the partners as the cleared one.
What evidence should the firm keep?
A written position for each workflow, the terms it relied on at the time, and a record of who approved it and when.
If a client or a regulator asks how the firm used AI on a matter, the answer should be a page, not a recollection. The page names the workflow, the tool and tier, the data rules, the retention setting, the reviewer, and the date the position was agreed. When the provider changes its terms, the position is reviewed and the date updated.
None of this is legal advice, and the review does not replace the firm's own compliance function or external adviser. It gives them something specific to check, which is more than most firms currently have.