Is ChatGPT Confidential for Lawyers? What ChatGPT Business Protects, and What Your Bar Still Expects

Disclosure: Sayfe.ai is an OpenAI SMB Channel Partner. OpenAI may pay Sayfe.ai a referral commission for qualifying ChatGPT Business signups. The promotion described here is set by OpenAI; it is not a Sayfe.ai discount, and it does not change what Sayfe.ai earns. This article is general information, not legal or ethics advice; check your own jurisdiction's rules and opinions.

Short answer: it depends on which ChatGPT you use, and no software makes you "confidential" on its own. On OpenAI's consumer plans (Free, Go, Plus and Pro), OpenAI's pricing page says content can be used to train its models unless you opt out. On ChatGPT Business, OpenAI says it does not train on your organization's data by default, encrypts data at rest and in transit, and holds a SOC 2 Type 2 report. That is the technical floor most bar guidance asks you to check. The ethics duty is still yours: the State Bar of California's 2026 guidance, as summarized by Wilson Elser, says a lawyer may not put confidential information into AI without the client's informed consent regarding the risks.

So the useful question for a solo or small firm is not "is ChatGPT confidential?" but "have I picked a tool whose terms I can defend, and have I done the client-facing part?" This guide covers both, with the cost math for a two- to five-lawyer practice at the end.

What ChatGPT Business Does, and Doesn't, Promise

Everything in this table comes from OpenAI's own pages, read on November 3, 2026: the plan comparison on chatgpt.com/pricing and the OpenAI business data page.

Two things in that table matter more for lawyers than for most buyers. First, the training default: OpenAI's business data page says "We don't train our models on your organization's data by default," and it names ChatGPT Business in that commitment. Second, the gaps. Business does not offer data residency, Enterprise Key Management or, as far as OpenAI's page says, custom retention. If a client's outside counsel guidelines require any of those, Business is the wrong tier for that matter.

One more boundary. OpenAI's page says it offers a Business Associate Agreement to ChatGPT for Healthcare and API healthcare customers. It does not list ChatGPT Business. If your practice handles medical records as a business associate of a covered entity, for example in personal injury or med-mal work, do not assume ChatGPT Business covers that.

What the Bars Are Saying in 2026

Most bars have now said something, and the guidance is consistent: you can use generative AI, but you have to know how the tool handles data, protect confidential information, supervise its use, verify its output and bill fairly. Three sources small firms should read:

• State Bar of California (2026). According to Wilson Elser's summary, the new guidance replaces the bar's 2023 guidance and now covers agentic AI as well as generative AI. Its key points: a lawyer may not input confidential information without informed client consent regarding the risks; lawyers must understand "the relevant terms of use, privacy policies, and vendor documentation"; they must follow client instructions that restrict AI use; general AI subscriptions "typically constitute overhead"; and "no paper filed in court should contain citations that the attorney responsible for the filing has not personally read and verified."
• Alabama State Bar, Formal Opinion 2026-01. As Jackson Lewis summarizes it, the opinion creates no new obligations, but it says that before entering client information you should understand whether prompts are retained, whether information may be used for training, who can access it, and what the vendor commits to by contract. It also says deploying a tool "without basic due diligence on how that tool works and what it can get wrong has not satisfied Rule 1.1."
• ABA Law Practice Division. Jennifer Ellis's 2026 article "Practical Uses of ChatGPT in Your Legal Practice" cites ABA Formal Opinion 512 (2024) and anchors use in Model Rules 1.1, 1.6 and 5.3. Her advice: "Avoid entering confidential or protected information into non-enterprise systems," and "Never rely on ChatGPT for case law validation or citation accuracy."

Read together, the guidance lines up with the table above. The "non-enterprise systems" warning describes consumer accounts, where training is on unless someone opts out. A firm workspace with training off by default and a SOC 2 report is the kind of tool these opinions assume you will vet. The consent and verification duties apply whichever tool you choose.

A Confidentiality Checklist for a 2–5 Lawyer Firm

This is what we walk small firms through during onboarding. None of it takes long, and it gives you a file you can show a client or a grievance committee.

1. Get everyone off personal accounts. The biggest real-world risk is not the firm's workspace. It is an associate pasting a draft into a personal Plus account at 11 p.m. Put everyone in one Business workspace and say in writing that client work goes nowhere else.
2. Save the vendor documentation. Print or PDF OpenAI's business data page and the plan comparison with the date you read them, and keep them in your AI policy file. California and Alabama both expect you to understand the terms. Having a dated copy shows you did.
3. Update your engagement letter. Add a short paragraph saying the firm uses generative AI tools with contractual no-training commitments, that a lawyer reviews all output, and that the client can opt out. Under California's guidance that is the start of informed consent, not the whole of it. For sensitive matters, have the conversation as well.
4. Check outside counsel guidelines. Many corporate clients now include AI clauses. If one says no third-party AI, or requires data residency, follow it. That is a client instruction, and California's guidance says you must follow it.
5. Minimize what you paste. Use initials or role labels ("Buyer," "Plaintiff's treating physician") unless the task needs the real names. It costs you nothing on most drafting tasks.
6. Verify every citation by reading it. ChatGPT is a drafting and summarizing tool, not a citator. Use your research platform for authority and read every case you cite.
7. Treat the subscription as overhead. California's guidance treats general AI subscriptions as overhead, not a client charge. Bill for time actually spent, and make sure AI-assisted work does not inflate hours.
8. Write a one-page AI policy and review it twice a year. Cover who can use the workspace, what may and may not go in, the review requirement, and who answers questions. California's guidance calls for policies that are updated as the tools change, and they change often. ChatGPT, for example, moves to a shared ChatGPT and Codex usage allowance in December.

For the workflows themselves (research summaries, contract first drafts, deposition outlines, client letters), see our earlier guide on how law firms use ChatGPT. For the broader security picture, see the ChatGPT data privacy and security guide.

What It Costs a Small Practice

ChatGPT Business workspaces start at two seats, which suits a solo with a paralegal, a two-partner firm, or a small practice with staff. Since November 2, 2026, OpenAI's partner promotion takes 20% off up to five ChatGPT Business Standard seats for 48 months. It is applied only through an OpenAI SMB Channel Partner's referral link, such as Sayfe.ai's, and you cannot get it buying direct at chatgpt.com. OpenAI's own examples use monthly Standard seats at a $25 list price:

A few practical notes. The discount covers Standard seats on monthly billing, which is what OpenAI's examples show. If you are weighing annual billing or Premium seats, ask us to confirm the numbers at checkout before you commit, because we will not quote math OpenAI has not published. Sayfe.ai adds no markup. Full details are in our guide to the 20% partner promotion.

If you are still deciding whether the firm needs Business at all, our ChatGPT Business vs. Plus comparison covers the difference. For a law practice it mostly comes down to the training default and admin control, the two things in the table above.

When ChatGPT Business Is Not Enough

To be honest about the limits, Business is the wrong choice, or only part of the answer, if:

• A client requires data residency or control of the encryption keys. OpenAI lists both as Enterprise features, not Business.
• You need fixed retention periods for a records policy or litigation hold. OpenAI offers retention controls to "qualifying organizations" and does not say Business qualifies. Confirm this before you rely on it.
• You handle health information under a business associate relationship. OpenAI's BAA is offered for ChatGPT for Healthcare and the API, not Business.
• You need cited, validated authority. Use a legal research platform for case law. ChatGPT is good at the first draft, the summary and the plain-English client letter, and bar guidance says you must verify its output.

For most two- to ten-person practices doing transactional, estate, family, employment or small-business work, those limits do not apply, and Business is the right tier. Our legal practice page shows how we set it up for firms.

Frequently Asked Questions

About Sayfe.ai: Sayfe.ai is an OpenAI SMB Channel Partner. We help small and medium-sized businesses, including law practices, implement and get value from ChatGPT Business. Sources for this article were read on November 3, 2026.