Guides · Consultants

Consultants and AI: using ChatGPT and other AI tools with confidential client information

Gonzalo Sabater, lawyer · 28 October 2026 · 6 minutes

In consulting, AI already summarizes interviews, organizes due diligence findings, drafts report outlines and analyzes cost spreadsheets. The catch: a consultant’s working material is almost always someone else’s confidential information, the client’s.

This article is general information, not legal advice for a specific case.

Three layers of confidentiality

1. Your contract with the client

Most engagements include a non-disclosure agreement or a clause limiting who may receive the client’s information and for what purpose. Putting client documents into an external AI service may be a disclosure to a third party that the contract does not allow. Check yours first.

2. Personal data

Org charts, staff lists, salaries, appraisals, end-customer data: a consulting project is full of personal data. Processing it with AI is subject to the GDPR where it applies, including data minimisation (Article 5(1)(c)) and, if the provider acts as a processor, an Article 28 contract.

3. Inside information

In transactions involving listed companies, some information may be inside information under the EU Market Abuse Regulation (596/2014) or equivalent rules elsewhere. Its circulation must be controlled; sharing it outside the authorized circle is a serious risk.

What actually reduces the risk

1. Replace identifiers: names of people and companies, tax IDs, accounts, addresses, emails, contract numbers.
2. Think about what identifies without naming: “the only turbine maker in the region” identifies a company. Generalize where needed.
3. Treat key figures as sensitive: in a deal, a revenue figure or a price can matter as much as a name.
4. Review the result before sending it, and use an AI account that does not train on your inputs.

Where Maskwise helps

Maskwise finds names, companies, identifiers and accounts in your Word, Excel and PowerPoint files and replaces them with consistent tags without breaking formatting or formulas. The AI works with [COMPANY_1] and [PERSON_1]; when it returns the report, Maskwise puts the real names back. Figures and indirect details are your call: add any word or amount to the list of things to hide.