Is It Safe to Upload Legal Documents to ChatGPT?

It is not safe to upload legal documents to ChatGPT on a personal account by default if they hold client information. OpenAI's help pages say content on its services for individuals may be used to train models unless you opt out, and files are kept with the chat. Business plans differ, and so do the risks.

This post reports what OpenAI's own pages said in copies archived in September and October 2026. Policies change, so read the current terms yourself before you rely on any of it. Nothing here is legal advice, and ethics rules vary by jurisdiction.

What happens to a document uploaded to ChatGPT?

A document uploaded to ChatGPT is stored with your account, read by the model to answer you, and kept until you delete it. On a personal plan it may also be used for model training unless you have switched that off. Deleting starts a removal window of up to 30 days. It is not instant.

Here is what each of those points rests on, taken from OpenAI's help center pages as archived in September and October 2026.

Storage. The File Uploads FAQ says files uploaded to ChatGPT "are saved in your account up to the retention period of the corresponding chat", and chats "are saved in your account until you delete them." The page on chat and file retention policies adds that files uploaded in a conversation are saved to a Library where that feature is available, and that "deleting a chat does not delete files saved to Library." So a document can sit in two places inside one account.

Deletion. The same retention page says a deleted chat is removed from your account at once and "scheduled for permanent deletion from OpenAI systems within 30 days", unless it has already been de-identified and disassociated from you or OpenAI must keep it longer for security or legal obligations. Those two exceptions matter to a lawyer. You cannot tell from the outside whether either applies to a given file.

Training. OpenAI's page on how your data is used to improve model performance says: "When you use our services for individuals, such as ChatGPT and Codex, we may use your content to train our models." The File Uploads FAQ confirms that content "may include files that are uploaded." You can opt out, which the next section covers.

Scanned pages. One practical point catches people out. The File Uploads FAQ says that outside ChatGPT Enterprise, document files "only support text-based retrieval", meaning ChatGPT "will extract digital text from the file and discard any images." A scanned contract is nothing but images. If your PDF is a scan, read about what an image-only PDF is before you assume the chatbot read every page.

Does the answer change between consumer and business plans?

Yes. OpenAI's pages draw a line between its services for individuals and its business offerings. On individual plans training is on unless you turn it off. On ChatGPT Business, Enterprise and Edu, and on the API, OpenAI says it does not train on inputs or outputs by default. Retention and access controls differ as well.

Each row comes from OpenAI's data controls page, the model performance page linked above, or its enterprise privacy page, as archived in September and October 2026.

Three details are easy to miss.

• The opt-out has limits. It applies to new conversations, and a conversation you rate with thumbs up or thumbs down may be used for training even after you have opted out. The post on OCR that does not train on your data quotes OpenAI's wording on both.
• Temporary chats are still kept for a while. They do not appear in history and are not used to improve models, but they "may be retained for up to 30 days for safety purposes."
• A business plan adds readers inside the firm. The enterprise privacy page says ChatGPT Business workspace admins "can view, access, export, and delete end user conversations in the workspace." That is a control for the firm and an ethical-wall question for the matter. The same page says OpenAI's own access is limited to authorized employees for engineering support, abuse investigation and legal compliance, and to contractors bound by confidentiality who review for abuse.

"By default" appears throughout those pages. A default can be changed by an admin, by an opt-in feedback feature, or by a later edition of the terms. Check the settings on the account you will really use. A firm policy that says "we have the business plan" does not help the associate who is signed in to a personal account on a phone.

What do bar ethics opinions say about generative AI?

Bar ethics opinions say you may use generative AI, but you must protect client information when you do. The American Bar Association's Formal Opinion 512 tells lawyers to read the tool's terms and privacy policy first and, for tools that learn from inputs, to get the client's informed consent before entering information about the representation.

ABA Formal Opinion 512, issued July 29, 2024, puts the baseline this way: "all lawyers should read and understand the Terms of Use, privacy policy, and related contractual terms and policies of any GAI tool they use to learn who has access to the information that the lawyer inputs into the tool." It also says that general boilerplate in an engagement letter is not enough to obtain informed consent.

State guidance runs the same way. The State Bar of California's practical guidance on generative AI says a lawyer "must not input any confidential information of the client into a generative AI solution that may present material risks to confidentiality or security, absent informed client consent." The D.C. Bar's Ethics Opinion 388 warns that lawyers who put client information into generative AI products, "especially 'free' ones", risk violating their confidentiality rules.

These are three bodies out of many, and the ABA's opinions are advisory. Your own bar's rules and opinions control. The post on attorney-client privilege and AI tools goes through the duties and the privilege question in detail.

Match the plan on the screen to the terms of service before a file is attached. Generative artificial intelligence can retain a prompt that restates strategy even when no document was uploaded. The duty of competence is the pause to confirm the account. Client confidentiality and attorney-client privilege are separate questions, and the privilege question is one to raise with the lawyer responsible for the matter.

Documents that should never go into a general chatbot

Some documents should stay out of a general-purpose chatbot whatever the plan or setting. The test is what happens if the text is retained, read by a stranger or disclosed. Where the answer is serious harm to a client or a breach of an order, a changeable default is not enough protection.

Treat these categories as off limits unless your firm has approved a specific tool for them in writing:

• Privileged communications. Emails, letters and memos between lawyer and client. In United States v. Heppner, a federal court in New York ruled in February 2026 that a client's own exchanges with a consumer AI platform other than ChatGPT were not privileged. The privilege post linked above explains that ruling and its limits.
• Work product. Draft briefs, strategy memos, witness outlines, and prompts that reveal your theory of the case.
• Material under a protective order or confidentiality agreement. Read the order. Many limit who may receive designated documents, and a chatbot vendor is unlikely to be on the list.
• Sealed, expunged or juvenile records, and anything a court has restricted.
• Medical, financial and identity records. Charts, tax returns, bank statements, passports. Other laws may govern these on top of your ethics rules, so check which apply to you.
• Trade secrets and unreleased deal terms. Their value depends on secrecy.
• Anything a client's outside counsel guidelines forbid.

Stripping names is a weaker fix than it looks. D.C. Opinion 388 cautions that the more detail you supply, the easier it becomes to "connect the dots" back to the client, especially when the matter is on a public docket.

What is left? Documents that are already public, such as a published opinion or a recorded deed, your own firm's forms with no client facts in them, and questions that need no document at all.

Safer ways to get the same work done

You can usually get the result without handing a client file to a general chatbot. Ask the question without the document, use a workspace your firm controls and has vetted, or use a tool built for the single task you need, after reading its terms the same way.

Ask without uploading. "What should a commercial lease say about holdover rent?" needs no client lease. Opinion 512 notes that informed consent is not required when the lawyer is not inputting information relating to the representation.

Use a firm-approved workspace. If the firm has a business plan, confirm the training, retention and admin-access settings yourself, and learn which matters may go in. The post on law firm AI policy rules for document uploads offers a template for that decision.

Separate reading the document from reasoning about it. Sometimes the only reason to upload is to turn a scan into text: a faxed order to quote from, a table to total. That is conversion, and an OCR tool does it. Schema Law is one. It reads a PDF, PNG or JPEG into text and tables and exports them, and its site states that "Your documents are never used to train an AI model." Hold that promise to the standard you would apply to any other vendor. The post on how to verify a no-training claim lists the questions, and you should put them to Schema Law too. The commitments are set out under security on the homepage.

Do it by hand when the stakes say so. A two-page privileged memo does not need summarizing by software.

A short decision rule before you upload

Before you upload, answer five questions in order. A single "no" or "I don't know" means stop. The rule takes about a minute once you know your account's settings, and it works for any chatbot.

1. Is this document free of client information, or already public? If yes, upload. If no, continue.
2. Am I signed in to an account my firm has approved for client material? Look at the account name on screen. A personal login fails this step.
3. Have I, or someone at the firm, read the current terms for this plan? You need to know whether content is used for training, how long it is kept and who can see it.
4. Does anything bar this document from leaving the firm? Consider a protective order, a client instruction, outside counsel guidelines and any statute that covers the record.
5. Does my jurisdiction require the client's informed consent for this use, and do I have it? A general clause in the engagement letter may not be enough.

A worked example

A paralegal has a 40-page scanned settlement agreement and wants a summary of the payment terms. Question 1: it is full of client information. Question 2: she is signed in with a personal account. Stop.

The task has two parts. Converting the scan to text is one. Summarizing eight paragraphs of payment terms is the other. She can convert the scan with a tool the firm has vetted, then read the payment section herself, or use the firm's approved workspace if the remaining questions are answered. Either way the agreement never reaches a personal chatbot account.

If you remember only one thing from this rule, make it question 2. The account you are signed in to decides which terms apply to the upload.