AI Document Tool for Lawyers That Doesn't Train: 6 Checks

To pick an AI document tool for lawyers that doesn't train on your files, read the terms for the exact plan you will sign in to and confirm they cover the file, your prompts, the output and any feedback you send. Then check retention separately. The same six checks work for converters, summarizers, review assistants and drafting tools.

AI software that takes documents comes in several kinds, and a tool can collect more than the document. This post sorts the tools by what they receive, shows how published terms treat the extra material, and gives a checklist and a file note. Vendor pages quoted here were read in October 2026 and will change. Nothing here is legal advice.

What kinds of AI document tool do lawyers hand files to?

Lawyers hand files to five broad kinds of AI document tool: converters that read scans into text, summarizers, review and extraction assistants, drafting assistants, and transcription or meeting-note tools, plus general chat assistants that can play any of those roles. They differ in how much of the matter each one receives beyond the page itself.

Two things stand out when you set the tools side by side.

First, the further down the table you go, the more of your own thinking the tool receives. A converter gets the lease. A drafting assistant gets the lease, your client's negotiating position and the sentence where you explain what the other side does not know yet.

Second, one product can sit in several rows. A PDF editor with an AI assistant is a converter on Monday and a summarizer on Tuesday. The terms that applied to the first feature may not be the terms for the second. Check the feature you are about to use, not the brand.

Schema Law sits in the first row. Its site describes a service that reads pages into text and tables for export, and its security commitments include the sentence "What you upload is never used to train or improve an AI model. Not ours, and not anyone else's." Hold that sentence to the same checks as any other vendor's.

Prompts, outputs and feedback buttons as training material

Training terms can reach three things besides the uploaded file: what you type, what the tool writes back, and whatever is attached to a feedback click. A promise that names only "your documents" or "your files" may leave the other three open, so read for each one by name.

The State Bar of California's practical guidance on generative AI, as revised in 2026, puts it in one sentence: "Breaches of confidentiality could occur via both prompt content and uploaded materials."

Published vendor terms show how the pieces are treated. These are examples of how such terms read. They say nothing about which companies any particular converter relies on.

Prompts and outputs. Terms that address both will say so. Anthropic's page on whether data from its commercial products is used for model training says: "By default, we will not use your inputs or outputs from our commercial products" to train its models. Microsoft's data, privacy and security page for Microsoft Copilot says: "Prompts, responses, and data accessed through Microsoft Graph aren't used to train foundation LLMs, including those used by Microsoft Copilot." Both sentences name the input and the output. When a vendor's sentence names only one, ask about the other.

Feedback. A rating click can carry far more than a rating. The same Anthropic page says that when you give feedback through the thumbs up or down button, "we will store the entire related conversation, including any content, custom styles, conversation preferences, or model settings, in our secured back-end for up to 5 years", and that feedback may be used to "train our AI models as permitted under applicable laws." It also says owners of a Team or Enterprise plan can switch off members' ability to submit feedback. Microsoft's page handles the point differently: customer feedback is optional and may be used to improve the product, and "We don't use this feedback to train the foundation LLMs used by Microsoft Copilot."

Two vendors, two different answers to the same button. So the question for any tool is: when someone at my firm clicks a rating, what is sent, how long is it kept, what is it used for, and can an administrator turn the button off?

A worked example. Tessa Brandt, an associate, uploads a supply agreement between two fictional companies, Larkfield Foods and Penrose Cold Storage, to a summarizer. She types: "Summarize the termination rights. Our client Larkfield wants out before the March renewal and has not told Penrose." She gets a summary and clicks thumbs down because it missed a clause. Count what left the firm:

1. The agreement.
2. The client's identity and its undisclosed plan, in the prompt.
3. The summary, which restates the contract's terms.
4. The feedback click, which under some terms pulls the first three items into a separate store with its own retention period.

Item 2 is the most sensitive thing in the exchange, and it was never in the document. A promise about "uploaded files" may not reach it.

Check the terms of service for prompts, outputs, and uploads as three clauses. Generative artificial intelligence can store the sentence you typed about the client's plan. Client confidentiality covers that sentence the same way it covers the agreement. The duty of competence includes finding out whether an administrator can turn the feedback button off. If the plan offers that switch, save a screenshot with the vendor file.

Other streams to ask about. Corrections you make to a tool's reading, saved instructions or templates, files pulled from a connected drive, and chats with the vendor's support staff are all content. If the terms do not mention one, ask.

Does a business tier of an AI document tool train differently from its free tier?

Yes, it can. One product name may cover two sets of terms, one for individual or free accounts and one for business accounts, with opposite defaults on training. Which set applies depends on the account you sign in with, not on the logo on the screen.

Anthropic publishes the two sets as separate articles under one title. Its page for commercial products says inputs and outputs are not used for training by default. The consumer page on model training says the company will use chats and coding sessions, including to improve its models, if the user chooses to allow it, if a conversation is flagged for safety review, or if the user otherwise opts in.

OpenAI puts both in one document. Its help page on how your data is used to improve model performance, as archived in October 2026, has one heading for services for individuals, where content may be used for training unless the user opts out, and another for business services, where inputs and outputs are not used by default.

What this means for a firm:

• The email address decides. A lawyer who signs in with a personal address is on the individual terms, whatever the firm has bought.
• A trial may not be the paid plan. Ask whether a free trial of the business tier runs under the business terms from the first day.
• "By default" is a setting. Both vendors' business terms use those words. Find out who can change the default and how you would know it had been changed.
• Free tiers of other tools need the same question. A converter with a free plan and a paid plan may or may not treat them alike. Schema Law's pricing page lists its no-training commitment under every plan, the Free plan included, which you can read on the pricing page.

Tools that staff signed up for on their own are one way a firm ends up on individual terms without knowing it. The post on shadow AI in law firms explains how to find them.

Six checks that an AI document tool does not train on a lawyer's files

Run six checks before a client document goes into any AI document tool: the data streams, the account, the companies behind the tool, the feature switches, the connected sources, and the exit. Each one closes a gap that a headline promise can leave open.

ABA Formal Opinion 512 sets the floor: "As a baseline, all lawyers should read and understand the Terms of Use, privacy policy, and related contractual terms and policies of any GAI tool they use to learn who has access to the information that the lawyer inputs into the tool", or consult someone who has. The checks give that reading a shape.

1. Streams. List what this tool will receive from you: file, typed instruction, output, corrections, ratings, audio. For each one, find the sentence in the terms that says it is not used to train or improve a model. Mark any stream with no sentence.
2. Account. Confirm which agreement governs the account each person will use. Check the plan name on the account page against the plan named in the terms. Do it for every user, not only for the person who bought the subscription.
3. Companies behind the tool. Ask whether the vendor's own software reads the document or whether another company's model does. If another company is involved, ask for the term in the vendor's contract with that company that covers training, and whether your content reaches it under a business agreement.
4. Switches. Find every setting that sends content for improvement: a model improvement toggle, a feedback button, a "share with support" option, a beta program. Record how each is set and who can change it. If an administrator can disable feedback for the whole firm, decide whether to do so.
5. Connected sources. If the tool can read from your email, document management system or shared drive, find out what it may pull in without an upload, and whether the training terms cover that content as well.
6. Exit. Ask what happens to content already held if the vendor changes its terms, if you downgrade to a free plan, or if you close the account. A promise that applied on a business plan may not follow the data to a different plan.

Scoring is simple. A stream, account or company with no written answer is an open item. Decide for each open item whether to get an answer, restrict what goes into the tool, or pick a different tool.

Headline promises can carry qualifiers of their own, such as carve-outs for de-identified data or a right to change the policy. The list of where no-training promises hide exceptions goes through that fine print clause by clause.

California's guidance adds a caution that applies to all six checks: "Reasonable efforts require more than reliance on generalized marketing assurances."

Zero data retention and no training as two separate promises

No training means your content is not used to teach a model. Zero data retention means the vendor does not keep your content after processing. A tool can make the first promise and still store everything you send for weeks, and a retention promise can come with its own exceptions. Ask about each one separately.

OpenAI's API documentation on data controls shows the two side by side. On training: "As of March 1, 2023, data sent to the OpenAI API is not used to train or improve OpenAI models (unless you explicitly opt in to share data with us)." On retention, in the same document: "By default, abuse monitoring logs are generated for all API feature usage and retained for up to 30 days, unless longer retention is required by law, or is reasonably necessary to protect our services or any third party from harm." Zero Data Retention is described there as a control that eligible customers may be approved for, which excludes customer content from those logs.

So under those terms a customer has a no-training commitment by default and a retention period by default, and has to apply for the second to go away.

Zero is also a defined term with edges. Anthropic's page on which products a zero data retention agreement applies to says that under such arrangements the company "does not store their inputs or outputs except where needed to comply with law or combat misuse or harm", that it "still retains User Safety classifier results", and that the arrangement covers only listed products.

Two practical points. If a vendor's sales page says "zero data retention", ask whether that is the default for your plan or something you must request, and ask for the exceptions in writing. And if a tool keeps a history of your past documents and chats for your convenience, it is retaining them. That may be fine. It is not zero.

How should a lawyer record that a no-training term was checked?

Record the check in a short dated note kept with the firm's vendor records: the tool, the plan, the sentence relied on and where it sits, the settings as found, the open items, and the date to look again. The note is what lets you show, later, that the decision was made with care.

A note that fits on one screen:

Tool and feature:      [name], document summary feature
Plan and account type: [plan name], firm accounts under [firm domain]
Checked by / date:     T. Brandt, 9 October 2026
Terms relied on:       [document title], section [x], saved as PDF in vendor folder
Sentence relied on:    "[exact wording copied from the terms]"
Streams covered:       file yes; prompt yes; output yes; feedback NO (see open items)
Other companies:       vendor's written reply of [date], saved with this note
Settings as found:     model improvement off (screenshot); feedback button disabled by admin
Retention:             [period], per [document]; deletion by user available
Open items:            trial accounts not confirmed; asked vendor on [date]
Approved for:          [categories of document], not [categories excluded]
Review date:           9 April 2027, or on notice of changed terms

What makes the note worth having:

• Copy the sentence. A paraphrase will not help when the page has changed. Paste the exact words and keep a dated PDF of the page they came from.
• Record the gaps. A note that lists only the reassuring answers is weaker than one that shows what you could not confirm and what you did about it.
• Tie it to categories of document. "Approved" for routine contracts is a different decision from approved for sealed records or health information.
• Keep it where the next person will look. A vendor folder shared with whoever approves tools is better than one matter file.
• Update it on events. A vendor's email about new terms, a plan change, a new feature and a new user are each a reason to reopen the note.

The note also helps on a bad day. If someone at the firm sends a client document to a tool that was never checked, the first question is what that tool's terms say, and nobody will have a note to answer it. The post on accidentally uploading a confidential document to ChatGPT sets out what to do then.

Whether a tool that passes all six checks may be used on a given client's file is a further question under your jurisdiction's rules and the client's own instructions.