Can your team use ChatGPT with client data? The 5-minute answer (and the AI policy you actually need)

The 5-minute answer

Whether your team can use ChatGPT with client data depends entirely on which version of ChatGPT they are using. Public ChatGPT — the free or personal-tier product at chat.openai.com — trains on your inputs by default and is not a safe place for client information. ChatGPT Enterprise, ChatGPT Team, and Microsoft Copilot for Microsoft 365 do not train on your inputs by default and can be used with most client data after you have run the appropriate contract and data-classification checks.

That distinction is responsible for most of the AI-and-client-data confusion at small and mid-size firms today. It is also responsible for most of the genuine policy violations — a partner pastes a draft contract into the wrong tab, a paralegal pastes a deposition transcript into a free assistant, a billing manager runs an AR aging report through a public model "just to see what it would say." None of those people are bad actors. They are using a tool that looks like one product but is actually four, and the differences are not visible from the chat window.

If you have not yet written an AI policy, the rest of this article is for you. We will cover the contract-tier decision matrix, the three-question test for any AI tool, the minimum defensible AI policy outline, the data-classification checklist, and what to do if your team has been using public ChatGPT with client information already.

Calculate your AI savings → (2-min, no form gate)

Why the contract tier is the whole answer

OpenAI runs ChatGPT under several distinct contractual tiers, and the privacy and training defaults are different for each. As of early 2026, the practical map looks like this.

Free ChatGPT (chat.openai.com, signed-in or anonymous): conversations are used to train future models by default. Memory features can persist information across sessions. There is no business associate agreement available, no enterprise admin console, and no data-residency commitment. This is the wrong tier for any client data, full stop.

ChatGPT Plus / Pro (the $20–200/month personal tier): privacy is improved — you can opt out of training in settings — but it is still a personal product. There is no admin console, no contract that runs from OpenAI to your firm, and no audit trail. For most professional-services firms, ChatGPT Plus is fine for personal productivity but not appropriate for client data.

ChatGPT Team and ChatGPT Enterprise: business products with contracts that run to your firm. Training on your inputs is off by default. There is an admin console for user management, an audit log for activity review, and contractual data-protection commitments. Enterprise adds SAML SSO, longer retention controls, and custom DPAs. These tiers can typically be used with client data after a data-classification check.

Microsoft Copilot for Microsoft 365: a separate product from Microsoft that uses GPT-4-class models behind the Microsoft 365 commercial-tenant data-protection boundary. Inputs and outputs stay inside your Microsoft tenant; training on your data is off by default; the data-protection commitments inherit from your existing Microsoft 365 contract. For firms already on Microsoft 365 Business Standard or Premium, this is often the lowest-friction path to compliant AI.

Anthropic Claude (claude.ai for Work, claude.ai Team, and the Claude API): parallel structure to OpenAI's. The personal tier (claude.ai) runs under a personal contract; Claude for Work and Claude Team are business tiers with the appropriate enterprise-grade commitments. Anthropic publishes its data-handling commitments at anthropic.com/legal — the short version is that paid business-tier inputs are not used for model training.

Google Gemini for Workspace is the same pattern, mapped to your Google Workspace tenant.

The pattern across vendors is consistent: a personal-tier product is not safe for client data, a business-tier product with the right contract is. Your job as a firm leader is to make sure your team is on the right side of that line.

Run our 5-minute Scorecard → — it asks the same questions a cyber-insurance underwriter is going to ask about your AI surface.

The 3-question test for any AI tool

Before letting any AI product touch client data, run this three-question test. It takes about 90 seconds per tool.

Question 1: What contract is in force, and does it run to your firm or to the user? If the user signed up with their personal email and pays $20/month from a personal card, the contract is between OpenAI and the user — not between OpenAI and your firm. That means there is no entity in the chain that owes your firm a duty of care if the data is mishandled. The fix is moving every team member to a firm-level contract (ChatGPT Team, Enterprise, Microsoft Copilot, Claude Team, Gemini for Workspace).

Question 2: Is training on inputs off by default, or do you have to opt out? Off-by-default is the only acceptable answer for client data. Opt-out can be reset by a product update, a setting toggle, or a user mistake. Off-by-default at the contract layer is durable.

Question 3: Where does the data sit, and for how long? The right vendor publishes data-residency commitments and retention controls. ChatGPT Enterprise, Microsoft Copilot, Claude for Work, and Gemini for Workspace all do. If a tool's documentation is vague about retention or residency, that vagueness IS the answer — do not put client data in it.

If a tool fails any of the three questions, do not use it for client work. Use it for personal productivity if you like; do not put a deposition, a tax return, a medical record, or a policy document in it.

The minimum defensible AI policy

Most firms over-engineer their first AI policy. They reach for the 20-page legal document and end up shipping nothing. The minimum defensible AI policy is one to three pages and covers four things.

Section 1 — Approved tools. A short list. For most professional-services firms in 2026, the list is some subset of: Microsoft Copilot for Microsoft 365 (if you are on Microsoft 365), ChatGPT Enterprise or Team (if you are not), Claude for Work, Gemini for Workspace. Anything not on the list is off-limits for client data. Personal-tier tools are explicitly named as off-limits.

Section 2 — Data classifications and what can go where. Most firms can map their data into three classifications: Public (marketing copy, public filings, press releases — may go into any approved AI tool); Internal (operational templates, internal training material, non-sensitive internal communications — may go into approved business-tier AI tools); Confidential (client information, matter-specific work, tax returns, medical records, financial records, legal strategy, anything covered by a confidentiality agreement or a regulatory regime — may go into business-tier AI tools that pass the three-question test, after a per-matter check that the contract permits). That is sufficient for most firms. Heavily regulated firms (healthcare, defense, finance) may add a fourth classification for regulated data with explicit BAA / NDA / FedRAMP requirements.

Section 3 — Training requirements. A 30-minute initial training when AI access is granted. A short annual refresher. Mandatory acknowledgment of the policy. A documented "what to do if you accidentally pasted client data into a public tool" procedure.

Section 4 — Incident reporting. A single point of contact (a partner, a CISO, a vCISO) and a standard reporting form. Most accidental disclosures are caught early if there is a no-blame reporting channel; most evolve into incidents if there is not.

That is the entire policy. Three pages, ten minutes to read, defensible at audit. Firms that need more sophistication add more — but a one-page policy your team will actually read beats a 25-page policy that lives in a SharePoint folder no one opens.

We deliver this exact policy, tailored to firm and industry, as part of every vCAIO engagement. Book a vCAIO scoping call → if you want to see what the tailored version looks like.

What happens when this goes wrong

Three failure modes show up repeatedly across the small and mid-size firms we work with.

Failure mode 1: a user pastes confidential data into a free or personal-tier AI tool, often without realizing they were on the wrong tier. This is the most common failure. The user usually does not notice. The data is now in a model provider's training pipeline (or at least their logs). Depending on the regulatory regime, this may be a notifiable disclosure event under HIPAA, NAIC Model Law MDL-668, attorney-client privilege rules, or the firm's own confidentiality commitments to clients.

Failure mode 2: the firm has a policy but no enforcement. Policies that no one was trained on, no one signed off on, and no one is monitoring become evidentiary problems if there is an incident. A policy without training and acknowledgment is worse than no policy because it documents your awareness without your action.

Failure mode 3: the firm bans AI outright. Shadow AI is the predictable outcome. Team members use AI from personal devices and personal accounts because the work is genuinely faster with it. The firm now has all the data exposure of permissive AI use plus none of the visibility of an approved program. The right answer is almost never a ban; it is a small approved stack and a clear policy.

If your team has been using public ChatGPT with client data already, here is what to do this week: do not panic, do not hide it. Document what was likely shared, evaluate whether any classification crosses a regulatory threshold, consult counsel if it does, switch the team to a business-tier product, and run a 30-minute training. The cost of fixing this is small. The cost of letting it continue and finding out during an incident is not.

What to do this week

Five concrete actions, in order. None of them takes longer than an hour.

Day 1: Inventory. Ask every team member which AI tools they are currently using and which email address they used to sign up. You will likely find three to five tools you did not know were in use. This is a cheap exercise and it is the foundation for everything else.

Day 2: Tier audit. For each tool found in Day 1, identify whether it is a personal tier or a business tier. Anything personal-tier with client data is the immediate priority.

Day 3: Pick a stack. For most firms on Microsoft 365, the answer is Microsoft Copilot for Microsoft 365 plus Claude for Work or ChatGPT Enterprise as a secondary. For firms on Google Workspace, Gemini for Workspace is the obvious starting point. The vCAIO engagement starts here.

Day 4: Draft the policy. Use the four-section outline above. Three pages maximum. Have the partners and the office manager read it.

Day 5: Train and migrate. A 30-minute training. Migrate every account to the chosen business-tier product. Cancel personal-tier subscriptions. Document the cutover.

That is the entire program. A week of disciplined work and your firm has gone from "we hope our team is being careful" to "we have a documented, defensible, measurable AI program."

How Evolv helps

We deliver this entire program as a vCAIO engagement. The 30-day version delivers the inventory, the policy, the chosen stack, the training, and the migration. The ongoing version maintains the policy, monitors usage, runs the quarterly refresher, and tracks the savings.

Two ways to start.

Option 1: Run the AI Savings Calculator. Two minutes. You get a dollar figure for what your firm could reclaim with a sensibly deployed AI stack — and a list of the tools driving the estimate. No email gate until you choose to share the result.

Option 2: Run the Cyber Scorecard. Five minutes. The Scorecard includes an AI-surface section that maps your current exposure, including questions about which tools your team is using and at what tier. Output is a plain-English report.

If you would rather skip the tool and talk to a human, book a 20-minute scoping call. A named member of our team responds within four business hours.

Frequently asked questions

Is ChatGPT Plus safe for client data? — ChatGPT Plus is a personal-tier product. Even with training opted out, there is no contract running to your firm and no admin console. For most professional-services firms, ChatGPT Plus is fine for personal productivity but not appropriate for client data.

Does HIPAA allow ChatGPT? — HIPAA does not prohibit AI; it requires a Business Associate Agreement (BAA) with any vendor handling Protected Health Information. As of early 2026, OpenAI offers a BAA for ChatGPT Enterprise customers in healthcare. ChatGPT Plus and free ChatGPT do not have BAA coverage. Microsoft Copilot for Microsoft 365 inherits HIPAA-eligible service status from your underlying Microsoft 365 contract if your tenant has BAA coverage in place.

Can our team use Claude with client data? — Claude for Work and Claude Team are the business tiers; they do not train on inputs. The free claude.ai tier is a personal product. The same three-question test applies: contract running to your firm, training off by default, retention and residency documented.

What about Microsoft Copilot — is it safe? — Microsoft Copilot for Microsoft 365 runs inside the Microsoft 365 commercial-tenant data-protection boundary. Inputs and outputs stay in your tenant. Training on your data is off by default. For most professional-services firms already on Microsoft 365, it is the lowest-friction safe AI option.

How do we audit what tools our team is currently using? — Start with a survey. For higher-fidelity, integrate identity-provider logs (Microsoft Entra, Google Workspace, Okta) to see which third-party AI services have been authorized, and review network logs for AI-domain traffic. A vCAIO engagement covers this systematically.

What if we have already had a disclosure event? — Document what was likely shared. Evaluate whether the disclosure crosses a regulatory threshold (HIPAA breach, NAIC MDL-668 notification, attorney-client privilege). Consult counsel if it does. Switch the team to a business-tier product immediately. Run a 30-minute training. Most accidental disclosures do not become incidents if they are addressed promptly and documented.