Can solicitors use ChatGPT?

Nothing in the SRA Code of Conduct stops a solicitor using ChatGPT. Solicitors can use ChatGPT for drafting, summarising and research, as long as client confidentiality is kept, every output is checked by a competent person, and nothing unverified reaches a client or a court. The tool is allowed. The risk sits in what goes into it and what comes out unchecked. This guide covers the rules, the data mechanics behind each ChatGPT tier, a one-page policy and a checklist for fee earners.

Can solicitors use ChatGPT under the SRA Code?

Yes. The SRA does not ban any tool. Its Code is outcome-based. You are judged on what you do, not on the software you use. Four duties matter most.

Competence

You must give a competent service. That covers AI output too. If ChatGPT drafts a letter, the solicitor who sends it owns every word. You need to know enough about the tool to spot where it goes wrong.

Confidentiality, paragraph 6.3

Paragraph 6.3 says you keep the affairs of current and former clients confidential. The exceptions are disclosure required or permitted by law, or client consent. Pasting a client's details into a public AI tool is a disclosure to a third party. Whether that breaches 6.3 depends on the account, its settings and its contract. More on that below.

Supervision

You remain responsible for work done by people you supervise. A trainee who drafts with ChatGPT is still your trainee. Supervisors need to know who uses AI, for what, and how it is checked.

Not misleading the court

You must not mislead the court or anyone else. Citing a case that does not exist does exactly that, whoever invented it.

The fake citation problem

ChatGPT can produce case names, citations and quotations that look real and are not. This is often called hallucination. It is not a rare glitch. It is how the tool works: it predicts likely text, it does not look things up.

Courts in England and Wales have now dealt with this more than once. In Harber v HMRC, a tax tribunal found that cases put forward by a litigant in person had been made up, likely by an AI tool. In R (Ayinde) v London Borough of Haringey, the Divisional Court warned lawyers that citing fictitious authorities can lead to regulatory referral and worse. The Law Society Gazette has reported on these cases and on SRA concerns about AI misuse in practice.

Rule of thumb: every case, statute and quotation from ChatGPT is unverified until a person has checked it in a proper legal source.

What the Law Society guidance says

The Law Society publishes guidance called Generative AI: the essentials. In plain terms, it asks firms to:

Understand what the tool is and how it can fail.
Protect client confidentiality and personal data.
Check outputs for accuracy before relying on them.
Think about intellectual property and the tool's terms.
Decide whether and how to tell clients about AI use.
Keep responsibility with the solicitor, not the software.

It is sensible guidance. What it does not do is explain what happens to the text once it is typed in. That is where most confidentiality risk actually lives.

What happens to text you type into ChatGPT

It depends on the account. OpenAI's terms change, so check its current pages before you rely on any of this.

Account	Used to train models?	Contract for business data?
Free and Plus (personal)	Yes by default. Can be switched off in data controls.	No. Consumer terms only.
Team or Business	No by default.	Business terms, with a data processing agreement available.
Enterprise	No by default.	Business terms, with a data processing agreement and admin controls.

Retention settings

Chats are kept in history unless deleted. Temporary chats are not kept in history and are deleted after a short retention period. Switching off training on a personal account is better than nothing. It is not a contract, and staff can switch it back on.

When a DPA is needed

Under UK GDPR, if a supplier processes personal data for you, you need a written contract with them. That is a data processing agreement, or DPA. Personal Free and Plus accounts do not give you one. So client personal data should not go into them at all. Team, Business and Enterprise offer one. Read it, sign it and keep a copy.

Legal privilege

Privilege protects confidential lawyer-client communications. Confidentiality is one of its foundations. Sharing privileged material with a third party on loose terms risks an argument that confidentiality, and so privilege, was lost. The law here is untested. A business account under contract is a much stronger position than a personal one. Taking client details out before anything is sent is stronger still.

The same questions come up with Microsoft's tools. Our guide on whether Copilot is safe for client data covers them.

A one-page AI policy for a small firm

Copy this and adjust it. Keep it to one page so people read it.

Purpose. AI is welcome here. Client data stays out of it unless this policy allows it.
Approved tools. Only the firm's business ChatGPT account, or other tools the partners list. No personal accounts for work.
Never enter: client names, addresses, dates of birth, National Insurance numbers, bank details, matter numbers, or privileged content, unless taken out or replaced with stand-ins.
Check everything. Every authority, figure and quotation is verified in a recognised legal source before use.
Court documents. No AI-drafted content goes to a court without a solicitor's line-by-line review.
Supervision. Trainees and paralegals tell their supervisor when AI helped with a piece of work.
Clients. Follow any client instruction about AI use. Tell clients where the firm's terms require it.
Incidents. If client data goes into an unapproved tool, tell the compliance officer the same day.
Agreement. Every person signs and dates this policy. It is reviewed every year.

Pre-use checklist for fee earners

Run through this before each use. It takes seconds.

Am I on the firm's approved account, not a personal one?
Have I taken out names, numbers and anything that identifies the client?
Is any of this privileged? If so, have I stripped it to the bare legal question?
Would the client be comfortable seeing what I am about to paste?
Will I check every case and quotation before relying on it?
Am I the person who will put my name to the result?

Worked example: Priya at Ashcombe Law wants help with a lease clause. She removes the tenant's name, the address and the rent. She asks only about the clause wording. The question still goes through. No client detail goes with it.

Where a tool can help

Policies rely on people remembering them on a busy afternoon. Helio Guard checks pastes, messages and file uploads on AI sites in Chrome and Edge on Windows PCs. It takes out or stops sensitive items such as bank details and National Insurance numbers, and can swap client names for stand-ins such as "Client A". Checked on the PC, with fixed rules. We never see what your team types. It also records each person's dated agreement to your AI policy. Windows only for now. No Mac.

Financial firms face a similar mix of rules, covered in our piece on advisers using ChatGPT with client data. For law firms, the order is simple: write the policy, choose a business account with a DPA, and add a safety net if you want one. Helio Guard is £1 a person a month, from 5 people, and the details are on our pricing page.

Can solicitors use ChatGPT? SRA duties, client confidentiality and a safe-use checklist