Cybersecurity
Can Attorneys Use ChatGPT With Client Information? A Cybersecurity Guide for San Luis Obispo Law Firms
A San Luis Obispo attorney drafts a demand letter by pasting a client's full case summary into ChatGPT — never considering that OpenAI's default settings may use that conversation to train future AI models. That gap between convenience and compliance is where ChatGPT client information risks for attorneys in San Luis Obispo quietly accumulate.
The ChatGPT Habit Most Law Firms Haven't Thought Through
ChatGPT is fast and useful for drafting and research — but most attorneys using it with real client details have never read OpenAI's data usage terms or verified whether their account type supports privacy controls.
On free and Plus tiers, OpenAI has historically used conversation data for model training unless users manually opt out — a step most attorneys never take. The Enterprise tier changes this but requires a separate organizational agreement. Attorneys assuming their Plus subscription carries enterprise-grade protections are working from a false baseline.
What the California State Bar Actually Says About AI and Confidentiality
The State Bar of California's Practical Guidance for the Use of Generative Artificial Intelligence explicitly requires attorneys to understand how AI tools handle data before using them with client information — a competence obligation tied to California Rules of Professional Conduct Rule 1.6.
California Rules of Professional Conduct Rule 1.6
Rule 1.6 requires attorneys to make reasonable efforts to prevent unauthorized disclosure of client information. The State Bar's AI guidance maps directly onto this rule: using a generative AI tool without understanding its data retention and training practices is treated as a failure of that reasonable-efforts standard.
What a Violation Actually Looks Like
An attorney pasting a deposition summary — including a client's name, medical history, and opposing party details — into free-tier ChatGPT may transfer privileged information to a third party without a data processing agreement. The State Bar's guidance frames this as a confidentiality breach, not a technical oversight.
Three Real Cybersecurity Risks Hidden Inside ChatGPT for Law Firms
Three distinct risk categories apply to law firms using ChatGPT with client data: data retention and training exposure, prompt injection attacks, and shadow IT proliferation. Each operates through a different mechanism and requires a different control.
- Data retention and training: On non-Enterprise tiers, confidential case details may persist in OpenAI's systems and inform future model outputs. Attorneys who haven't opted out have no visibility into what happens after a session ends.
- Prompt injection attacks: Malicious instructions embedded in a document pasted into ChatGPT can manipulate its output or expose prior session contents — a particular risk when attorneys paste opposing counsel's documents or third-party records.
- Shadow IT proliferation: When a paralegal logs into a personal ChatGPT account on a firm laptop, the firm has no visibility into what client data left the network or under what data terms.
All three risks are addressable through the cybersecurity services for San Luis Obispo businesses that include endpoint monitoring, web filtering, and data loss prevention — controls most solo and small-firm attorneys lack today.
The Difference Between Risky and Responsible AI Use at Your Firm
Responsible AI use hinges on a clear binary: tasks with no client-identifying information are lower-risk; tasks requiring client names, case facts, financial data, or medical records are high-risk without enterprise-grade data controls.
| Lower-Risk AI Tasks | High-Risk AI Tasks |
|---|---|
| Drafting generic letter templates with no client details | Pasting client names or case facts into free-tier ChatGPT |
| Summarizing public case law or published court opinions | Entering medical records or financial data into any non-enterprise AI tool |
| Generating billing code descriptions with no matter specifics | Uploading opposing party information into a consumer AI session |
Microsoft Copilot for Microsoft 365 operates within a firm's existing Microsoft 365 tenant, keeping conversation data inside the organization's environment rather than a consumer AI platform. For firms already on Microsoft 365, Copilot offers a materially different data posture than consumer ChatGPT.
What a Secure AI Policy for Your San Luis Obispo Law Firm Should Include
A firm-level AI acceptable-use policy should address four components: an approved tools list, a prohibition on entering client PII into non-enterprise tools, staff training on prompt hygiene, and IT-enforced web filtering.
- Approved tools list with data residency requirements: Name each permitted AI tool and document where it stores and processes data. Unapproved tools are prohibited by default.
- Prohibition on client PII in non-enterprise AI tools: Any detail identifying a client, matter, or opposing party must never appear in a prompt submitted to a non-enterprise platform.
- Prompt hygiene training: Staff must know what never belongs in a prompt: client names, matter numbers, financial figures, medical details, and privileged communications.
- IT-enforced web filtering: Endpoint-level filtering blocks unapproved AI platforms on firm devices, preventing shadow IT before it starts.
Most solo and small firms on the Central Coast have no written AI policy — and that absence is itself a bar compliance gap. IT compliance support built for professional service firms can close it with a policy that is both technically enforceable and bar-compliant.
How a Managed IT Partner Helps Your Firm Use AI Without Exposing Client Data
A managed IT partner translates AI policy into enforced technical controls: configuring Microsoft 365 data loss prevention rules, enforcing endpoint management across firm devices, and conducting quarterly security reviews that include AI tool audits — producing written documentation the firm can reference if a compliance question arises.
Professional IT Solutions provides managed IT services for San Luis Obispo law firms with more than 15 years serving professional service firms on the Central Coast. For the full picture of proactive IT management, flat-fee managed IT services in San Luis Obispo include the endpoint management, DLP configuration, and compliance documentation that AI policy enforcement requires.
Frequently Asked Questions
Is it a bar ethics violation to use ChatGPT with client information in California?
Not automatically — but the California State Bar's AI guidance requires attorneys to understand how their tools handle data before use. Entering client details into a non-enterprise AI tool without data controls may fall short of the reasonable-efforts standard required under Rule 1.6.
Does ChatGPT store the information I type into it?
On free and Plus tiers, OpenAI has historically retained conversation data and may use it for model training unless the user opts out in account settings. The Enterprise tier disables this by default under a separate organizational agreement — a paid Plus subscription does not provide the same protections.
What is the safest AI writing tool for attorneys who handle confidential client data?
Microsoft Copilot for Microsoft 365 is widely recommended because it processes data within the firm's existing Microsoft 365 tenant rather than a consumer platform. Any AI tool should be paired with a documented acceptable-use policy and IT-enforced controls to be genuinely low-risk.
How do I create an AI acceptable-use policy for my law firm?
A law firm AI acceptable-use policy should name approved tools with their data residency terms, prohibit entering client PII into non-enterprise platforms, include staff training on prompt hygiene, and be backed by IT-enforced web filtering. A managed IT provider with legal-sector experience can build and enforce all four components.
Not Sure If Your Firm's AI Tool Use Is Putting Client Data at Risk?
In a free 10-minute discovery call, we'll review how your San Luis Obispo law firm is currently using AI and cloud tools and show you exactly where client data may be exposed — no jargon, no obligation.
Schedule Your Free Discovery Call
