This article is for informational purposes only and does not constitute legal advice. You should consult with a qualified professional before making any decisions about the use of AI in your law firm.
Does Using ChatGPT Enterprise Violate SRA Confidentiality Rules?
The answer depends on the matter, the product terms and the firm’s controls. Check where client material goes, who can access it and who verifies the output before using the tool.
Before using ChatGPT Enterprise for a matter, ask the firm's responsible compliance and legal reviewers to assess the proposed processing against the applicable confidentiality requirements.
Record which material is permitted, who can access it and who can approve the use.
The Core Problem: Confidentiality and Public AI
Do not put matter material into an unapproved service. Check the specific product's terms and settings, including training use, retention and access, before deciding what the firm may permit.
For an enterprise service, review the processing agreement and the firm's configuration as well as the product description. Confirm that approval covers the particular matter and task.
SRA Requirements: Your Non-Negotiable Checklist
Use the table as a prompt for professional review of confidentiality, competence, accountability and client communication. Its legal and contractual statements need checking against applicable requirements; it is not an authoritative compliance checklist.
| SRA Principle |
How it Applies to ChatGPT Enterprise |
| Confidentiality |
Check the binding terms, configuration and processing evidence for the exact OpenAI product and proposed material. Record what is established about training, segregation, retention and access, and refer unresolved points to the responsible reviewer. |
| Competence |
Train reviewers to check authorities, facts and the limits of the chosen workflow. Record who verifies the work before use; this paragraph does not rely on an unidentified court ruling. |
| Accountability |
Confirm the firm's actual allocation of professional, privacy, operational and compliance responsibilities. Record the people who approve the use, supervise the work and handle an incident rather than assuming one role owns every decision. |
| Client's Best Interests |
Ask the responsible professional which client communications are required for the particular engagement, tool use and agreed terms. Record that disclosure decision and any approved wording. |
The "Enterprise" Illusion: It's Not a Magic Wand
Keep a qualified reviewer accountable for legal reasoning and for checking any output used on a matter.
Set checks for the proposed use:
- Review the service's security documentation, permissions and data-handling arrangements against the firm's requirements.
- Check generated statements and citations against original sources before using them in advice, drafting or research.
- Explain which uses are approved, how staff request an exception and how the firm checks for use outside those limits.
The Pattrn Protocol: A Framework for Safe AI Adoption
When considering the Pattrn Protocol or another proposed governance framework, ask whether it covers the following controls. A framework name does not establish compliance for a matter.
- Govern: You need to establish clear policies and procedures for the use of AI. This includes an acceptable use policy, a data classification policy, and a risk management framework.
- Educate: You need to train your lawyers on the risks and limitations of AI. They need to understand that it's a tool to assist them, not replace them.
- Monitor: You need to have visibility into how AI is being used across your firm. This includes monitoring for data leakage, inaccurate outputs, and unauthorised use.
The Bottom Line
Decide approval at the level of the matter and proposed task, with the relevant product terms and review arrangements recorded.
Before rollout, assign responsibility for permissions, output review and escalation when the task or material falls outside the approval.
Pause use if the firm cannot resolve the confidentiality or review requirements for the matter.
Take the Next Step
Ask what an assessment would cover for your firm, including permitted matter material, supplier review and responsibility for checking outputs. Confirm the deliverables before commissioning it.
Book a Discovery Call → or learn more about the AI Audit.
Need a safer AI route for your firm?
Assess proposed uses of Claude, ChatGPT or Copilot alongside client-confidentiality, professional-liability and SRA compliance questions.
