Can lawyers use ChatGPT with client data? Confidentiality, privilege & the Heppner ruling

Lawyers can use ChatGPT and other consumer AI tools — but pasting unredacted client data into them risks breaching professional confidentiality, waiving legal privilege, and violating the GDPR. The fix is not to avoid AI; it is to remove client identifiers before the text reaches the model — ideally on your own machine — so the prompt contains no information the client would recognise as theirs.

TL;DR

• A consumer LLM is not your client’s lawyer. Feeding it privileged material can strip the privilege, because there is no attorney relationship and — under most providers’ terms — no reasonable expectation of confidentiality.
• In United States v. Heppner (S.D.N.Y., Feb. 2026), a federal court held that documents a defendant created with a public AI chatbot were not protected by attorney-client privilege or work product.
• The ABA (Formal Opinion 512), the Polish Naczelna Rada Adwokacka, and the Krajowa Izba Radców Prawnych all say the same thing in different words: AI is an auxiliary tool, and the duty of confidentiality/professional secrecy travels with the data.
• Under the GDPR, client files are personal data. Sending them to an AI provider with no data-processing agreement or legal basis is a separate breach on top of any privilege problem.
• The reliable practice: redact client identifiers locally, prompt the AI with anonymized text, then restore names on your own device.

Can lawyers use ChatGPT with client data at all?

Yes — lawyers can use ChatGPT, Claude, and Gemini in their practice. Every major bar and law society that has issued guidance treats generative AI as a permitted, useful tool. What none of them permit is treating a consumer chatbot as a confidential extension of the lawyer.

The distinction that matters is what you put in the prompt. Using an LLM to draft a clause, summarise a statute, or brainstorm arguments in the abstract raises no confidentiality issue. Pasting a client’s name, the facts of their matter, a contract, or a case file into the same box is where the duties bite — and where a single prompt can create a lasting record on infrastructure you do not control.

Is it a breach of privilege to paste client data into ChatGPT?

It can be — and a US federal court has now said so on specific facts.

In United States v. Heppner, decided in the Southern District of New York (opinion by Judge Jed Rakoff, February 2026), a defendant facing securities-fraud charges used Anthropic’s Claude to work through his own defence. He typed in facts and legal theories — including information his lawyers had shared with him — and generated roughly thirty documents analysing potential strategies, which he then passed to his defence team. He did this on his own initiative, without his attorneys directing him to. When investigators obtained the documents, his lawyers claimed privilege.

The court rejected the claim. Its reasoning tracked the three classic elements of attorney-client privilege, and the AI documents failed on more than one:

1. No attorney relationship. Claude is not a lawyer — and, the court noted, the tool expressly disclaims providing legal advice or any fiduciary duty. That alone, the judge wrote, disposed of the privilege claim.
2. Not for the purpose of obtaining legal advice from a lawyer. The communication ran between a client and a machine, not between a client and counsel.
3. No reasonable expectation of confidentiality. This is the part every practising lawyer should sit with. The court treated the provider’s privacy policy as dispositive: because the terms permitted the company to collect user inputs and outputs and to disclose data to third parties — including governmental authorities — the defendant could not reasonably expect the exchange to stay confidential.

Notably, the court left a door open: had counsel directed the client to use the tool, the AI might arguably have functioned as an agent within the privilege, akin to a translator or expert retained by the lawyer. But an unsupervised, client-driven prompt to a public chatbot was not protected.

The lesson is not “AI destroys privilege.” It is that privilege depends on confidentiality, and a public LLM’s terms of service can quietly negate the confidentiality you assumed you had.

Sources for the ruling below are worth reading in full: the Harvard Law Review case note, Lawfare’s analysis, the New York State Bar Association, and client alerts from Orrick and White & Case.

What do bar associations say about lawyers using generative AI?

The professional-conduct answer is remarkably consistent across jurisdictions: use it, but the duty of confidentiality does not switch off.

United States — ABA Formal Opinion 512 (July 2024). The American Bar Association’s first formal ethics opinion on generative AI holds that a lawyer must keep confidential all information relating to a representation, regardless of source, unless the client gives informed consent. The opinion is pointed: boilerplate consent buried in an engagement letter is not adequate; lawyers must understand how a given tool uses inputs, whether prompts can resurface in later outputs, and whether inputs are used to train the model. (See the ABA’s summary and the full opinion.)

Poland — Naczelna Rada Adwokacka. In June 2026 the Polish Bar amended the Code of Attorney Ethics to address AI directly. The core rule: an advocate may use technological tools, including AI, only in an auxiliary capacity — such use must not breach professional secrecy (tajemnica adwokacka), compromise the advocate’s independence, or substitute for the lawyer’s own judgment and verification. (Coverage from rp.pl and the Naczelna Rada Adwokacka.)

Poland — Krajowa Izba Radców Prawnych. The National Chamber of Legal Advisers published recommendations for radcowie prawni covering tool selection, GDPR, and when the client should be informed — again centred on protecting tajemnica radcowska. (See the KIRP recommendations.)

Across all three, the takeaway for the prompt box is identical: before client information reaches an external model, it needs either informed consent and an appropriate legal footing, or it needs to not be identifiable client information at all.

Isn’t this also a GDPR problem?

Yes — and it is separate from privilege. A client file is personal data. The moment you paste it into a consumer AI service, you (or your firm, as controller) are disclosing personal data to a third party.

That triggers the ordinary GDPR questions:

• Legal basis for the disclosure (Art. 6).
• A data-processing agreement with the provider if it processes personal data on your behalf (Art. 28) — consumer tiers of chat tools generally do not give you one for this purpose.
• Special-category data safeguards if the matter touches health, biometrics, criminal allegations, and so on (Art. 9, Art. 10).
• Security and data-protection-by-design (Art. 25, Art. 32).

Recital 26 offers the escape hatch: the GDPR does not apply to genuinely anonymous information. If the text you paste no longer relates to an identifiable person, there is no personal-data disclosure to justify. That is precisely why removing identifiers up front is the cleanest compliance route — it collapses the privilege risk and the GDPR risk at the same time. For the difference between removing identifiers reversibly and irreversibly, see anonymization vs pseudonymization.

Risk checklist: before you paste client data into an AI tool

Run this before any client material touches a prompt box:

• Does the prompt contain a client name, party, matter reference, or case number?
• Any direct identifiers — PESEL, NIP, REGON, KRS, tax IDs, email, phone, IBAN, address?
• Any quasi-identifiers that single someone out in combination — a rare diagnosis, an exact date plus a job title, an unusual transaction?
• Does the provider’s privacy policy allow it to use your inputs for training, or to disclose them to authorities?
• Do you have a data-processing agreement covering this use, or documented informed client consent?
• Would you be comfortable if this exact prompt surfaced in discovery or a regulator’s file?

If any answer gives you pause, don’t paste the raw text. Redact first.

Do / don’t: lawyers and consumer AI tools

Do	Don’t
Strip client identifiers before prompting	Paste a contract, pleading, or file “just to summarise it”
Redact locally, on your own device	Rely on a chatbot’s “we don’t train on your data” toggle as your only safeguard
Keep the name-to-token mapping under your control	Store the mapping key in the same cloud tool you’re prompting
Get informed client consent where AI use is material	Bury AI consent in engagement-letter boilerplate (ABA 512 says it’s not enough)
Treat AI output as a draft to verify	Let AI substitute for your own legal judgment (NRA: auxiliary use only)
Check the provider’s terms on disclosure to authorities	Assume the exchange is privileged because it feels private

Before / after: a redacted prompt with legal flavour

You do not have to give up the AI’s usefulness to protect the client. Replace the identifiers, keep the structure:

Before (do not paste):

Draft a settlement letter for our client Jan Kowalski (PESEL 85010212345), regarding the dispute with Nowak Transport sp. z o.o. (NIP 521-30-51-000) over the contract signed on 12 March 2025. Kowalski’s email is [email protected].

After (safe to paste):

Draft a settlement letter for our client [KLIENT] (PESEL [PESEL]), regarding the dispute with [COMPANY] (NIP [NIP]) over the contract signed on [DATE]. The client’s email is [EMAIL].

The model drafts an equally good letter from the second version — it never needed the real names to do the legal work. Once you have the draft back, you restore [KLIENT] → Jan Kowalski locally, from a mapping file that never left your machine. Because the same value always maps to the same token, the letter stays coherent. (On why swapping one field is not enough on its own, see re-identification risk.)

How Amaze fits: redact locally, then prompt

This is exactly the workflow Amaze is built for. It detects and masks personal data entirely on your own machine — names (including Polish surnames across grammatical cases), email, phone, addresses, and Polish identifiers such as PESEL, NIP, REGON, KRS, plus IBAN and login credentials — before any text reaches ChatGPT, Claude, or Gemini.

Because it runs on-device (it works even air-gapped, with no outbound connection while a document is processed), the client data never leaves your control in the first place — so there is no provider privacy policy to negate your confidentiality, and no third-party disclosure to justify under the GDPR. The masking is reversible with a private key you hold, and every operation can be exported as an audit report for your DPO or file. For a step-by-step walkthrough, see anonymize data before ChatGPT, Claude & Gemini.

FAQ

Can I use ChatGPT for legal work at all? Yes. Bar and law-society guidance treats generative AI as a permitted, useful tool. The constraint is on what you feed it: identifiable client information needs consent and a legal basis, or it needs to be removed before prompting.

Does the Heppner ruling mean AI chats are never privileged? No. It was a US decision on specific facts — a client using a public chatbot on his own, without counsel’s direction. The court explicitly suggested the outcome could differ if a lawyer directs and supervises the tool as an agent. But it is a clear warning that a provider’s terms can defeat the confidentiality privilege depends on.

If I turn off “train on my data,” is that enough? It helps, but it is not the whole picture. The provider may still retain inputs, and may still be compelled to disclose them. ABA Formal Opinion 512 expects lawyers to understand the tool’s actual data handling — not just flip a setting. Removing the client data before prompting is the more robust safeguard.

Is pseudonymized client data safe to paste? Pseudonymized data is still personal data under the GDPR, so paste it and you are still disclosing personal data to the provider. Full anonymization — where the text no longer relates to an identifiable person — is the cleaner route. See anonymization vs pseudonymization.

What about tajemnica adwokacka / radcowska specifically? Professional secrecy in Poland is broad and does not have a “but I only pasted it into an AI” exception. The NRA and KIRP guidance both require that AI use not breach it — which in practice means the identifiable client content should not reach an external model.

Part of our guide: how to use AI without leaking client data.