AI and professional secrecy: can lawyers use ChatGPT with client files?

Most lawyers have tried a public AI chatbot by now. Many have found it useful for summarizing, drafting and translating. The harder question is what happens when the text being pasted in is a client's contract, a witness statement or a case file.

What happens to the document

When you paste a document into a public AI service, three things happen:

1. The text leaves your firm. It travels to the provider's servers, which may be in another country.
2. It is processed under the provider's terms. Depending on the plan and settings, inputs may be stored for a period, reviewed for abuse, or used to improve the service.
3. You lose direct control. You cannot easily verify where the data is, who can access it, or when it is deleted.

For a marketing email, this is usually acceptable. For client information, it touches three sets of rules at once.

Professional secrecy

In both Italy and India, lawyers have a duty to keep client information confidential. The duty is not limited to what is said in court; it covers documents, correspondence and the fact of the engagement itself. Sharing client material with a third party, even a technology provider, needs a sound basis and appropriate safeguards.

Data protection

Client files almost always contain personal data: names, addresses, financial details, sometimes health or criminal data.

• In Italy and the EU, the GDPR applies. Using an AI provider means the provider processes personal data on your behalf, which requires a data processing agreement, and often a transfer outside the EU, which requires further safeguards.
• In India, the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 set duties for data fiduciaries, with the main obligations applying from May 2027.

Italy's AI law adds transparency

Italy's Law 132/2025 allows professionals to use AI for supporting activities, with the professional's own intellectual work remaining prevalent, and requires them to inform clients about the AI systems they use. That is easier when you know exactly which system processes client data and where.

Three ways firms respond

1. Ban AI. Simple, but lawyers often use it anyway on personal devices, which is the worst outcome.

2. Use enterprise cloud AI with contracts in place. Better than consumer tools: you get a data processing agreement and settings that exclude training on your data. Documents still leave the firm, and often the country.

3. Run a private assistant. The model and documents stay on a server in your office or a dedicated server in your country. Nothing is sent to an AI provider. This gives the strongest position on secrecy and data protection, and it is now practical for small and mid-size firms.

Practical checklist

• Write a short internal policy on which AI tools may be used, and for what.
• Never paste client documents into consumer AI tools.
• Prefer tools that cite their sources, so lawyers can check every answer.
• Keep a log of AI use you can describe to clients.
• Add a paragraph on AI use to your engagement letter.

If you want to see how a private assistant works on your own documents, book a demo.