Guides · Lawyers

Can lawyers use ChatGPT and other AI tools with client documents?

Gonzalo Sabater, lawyer · 28 October 2026 · 7 minutes

Generative AI is already part of many lawyers’ day: it summarizes complaints, compares contract drafts and suggests the outline of a brief. The question every careful lawyer asks is whether that is acceptable with real client documents. The short answer: carefully, and sharing as little client information as possible.

This article is general information, not legal advice for a specific case or jurisdiction. Check your bar’s rules and guidance and your contracts with AI providers.

Two duties at once

1. Confidentiality

Lawyers must protect information relating to the representation of a client. In the United States, ABA Model Rule 1.6 requires reasonable efforts to prevent unauthorized disclosure, and ABA Formal Opinion 512 (2024) addresses generative AI specifically: lawyers should understand how a tool uses the information they enter, and client consent may be needed before inputting confidential information into some tools. In England and Wales, the SRA Code of Conduct requires solicitors to keep clients’ affairs confidential. Most European bars have equivalent rules.

2. Data protection

Client documents contain personal data about clients, opponents, witnesses and employees. Where the GDPR or UK GDPR applies, entering them into an AI service is processing that must respect data minimisation (Article 5(1)(c)); the provider usually acts as a processor (Article 28), and international transfers may be involved.

What actually changes the risk: not sending the data

To summarize a complaint or review contract clauses, the AI rarely needs the parties’ names, ID numbers, addresses or account numbers. Replace them before sending and you share far less.

• Anonymization removes data so that a person can no longer be identified. Truly anonymous data falls outside the GDPR (Recital 26).
• Pseudonymization replaces data with tags (for example [PERSON_1]) and keeps the key separately (Article 4(5)). Pseudonymized data is still personal data for whoever holds the key, but the risk is much lower, and the GDPR itself lists it as a safeguard (Articles 25 and 32).

Pseudonymization has a practical advantage: when the AI answers with the tags, you can put the real names back without redoing the work.

A sensible way to work

1. Ask what the AI really needs: almost always the legal content, not the identities.
2. Replace identifiers before sending: names, ID numbers, addresses, phone numbers, emails, accounts, case and docket numbers.
3. Watch indirect identifiers: an unusual job title, a date and a town can identify someone without a name.
4. Review the result before sending it. No automatic detection is perfect.
5. Use the right account and check whether the provider trains on your inputs.
6. Write it down: a short internal AI policy helps everyone work the same way.

Where Maskwise helps

Maskwise is a Mac app that handles steps 2 and 4 without the document leaving your computer: it finds more than 40 kinds of data, replaces them with consistent tags in Word, Excel, PowerPoint or plain text while keeping the formatting, and checks the copy before you use it. When the AI answers, it puts the real data back.