Usually not — and the reason is rarely the one people expect. It is not that the model will memorise the file. It is that pasting it was itself the disclosure, and the obligation not to make it was yours.
A chat window has no audience in it. Nobody is copied, nothing is sent, and the whole thing looks much more like a notebook than like an email. That feeling is the problem: legally the box is a third party, and putting a client’s details into it is handing their information to a company they have never heard of.
What the rules actually say
The wording differs by profession, but the shape does not. In each case the duty sits on you, and it is a duty about disclosure rather than about technology.
- •Solicitors. Confidentiality runs to the client and survives the retainer. Disclosure needs consent or another lawful basis; the fact that a tool was convenient is not one.
- •Accountants. Professional bodies treat client data the same way, and add a data-protection duty on top where the information identifies a person.
- •Clinicians. HIPAA and its equivalents bind the clinician, not the chatbot. A session note pasted into a general assistant is a disclosure to a party with no agreement in place.
- •Everybody else. Under GDPR the question is your lawful basis and whether you can still honour a deletion request afterwards — which is harder once the text has left.
The rules bind you. They have nothing to say about the model.
What a paid plan does and does not fix
Business and enterprise plans are a real improvement and worth having. They exclude training on your inputs, add a data processing agreement, and give you somewhere to point during an audit. That covers what happens to the text after it arrives.
It does not cover the sending. If your obligation is that the information does not leave your control, a contract describing how somebody else looks after it is a different promise to the one you made. Plenty of firms have decided that is enough, with advice. The point is that it is a decision, not a default.
What is fine
Most of what people want a model for on a client matter does not involve the client at all:
- •Questions about the law, a standard, or a clause
- •A template, a structure, a checklist
- •Rewriting your own words more clearly
- •Explaining something you will then apply yourself
The line is not the subject matter. It is whether somebody reading the prompt could work out who it is about — and that includes the combination of details, not only the name.
Removing the name is not enough
This is the most common mistake, and it is an honest one. The name is the easiest identifier to see and rarely the only one in the document. A date of birth, a postcode, an account number, a case reference, an employer, or an unusual combination of ordinary facts will identify a person on their own.
A file with the name taken out and everything else left in is not anonymous. It is a file with the name taken out.
Three arrangements that hold
- •Ask without the client in it. Reformulate the question so no detail identifies anybody. Slower, free, and correct.
- •Get consent. Some clients will agree, particularly where the work is cheaper for it. Record it.
- •Take the people out before it is sent. Replace every identifying detail with a stand-in, send that, and put the real values back in the answer. The model works on a coherent document and never receives a real person.
Why substitution rather than deletion
Deleting the details breaks the answer. A model handed [NAME] writes about [NAME], and the reply comes back needing repair. Handed a plausible different person, it writes an ordinary letter — and the real name goes back in before you read it.
That is what Secure AI does: the identifying detail is found and replaced on your own machine before anything is sent, and restored in the reply. The document stays usable and the people in it never leave.
Try Secure AI free
Frontier AI chat — encrypted by default, with your identity stripped before any request reaches the provider.
Common questions
Does it matter if I delete the chat afterwards?
Not for the disclosure. Deleting your copy does not undo the sending, and retention on the other side is governed by their terms rather than by your delete button.
What if I only paste one paragraph?
The same test applies. One paragraph of a witness statement can be more identifying than a whole contract.
Is a local model the answer?
It removes the disclosure entirely, which is the cleanest answer available. The trade is that the models you can run on a laptop are some way behind the ones you cannot, and for a lot of professional work that gap is the reason you wanted a model in the first place.
None of this is legal advice. It is the shape of the problem. Your regulator, your insurer and your firm’s policy are the authorities on your particular case.