Can UK financial advisers use ChatGPT with client data? FCA, Consumer Duty and GDPR explained

Yes, UK financial advisers can use ChatGPT, but not with client data on a free or personal Plus account. Financial advisers using ChatGPT stay on the right side of the FCA and UK GDPR when three things hold. The firm uses a business plan with a data processing agreement. Identifying client details are taken out before anything is sent. And an adviser checks every output before it reaches a client or the file.

This guide is for IFAs and small wealth firms. It covers what the rules say, how the ChatGPT plans differ, and a checklist you can use this week.

What advisers use ChatGPT for

The uses are ordinary. That is why they spread fast.

• Meeting notes. Turning a rough transcript into a tidy summary.
• Suitability report drafts. Wording the reasons for a recommendation.
• Client emails. Annual review invites, follow-ups, plain-English explanations.
• Research. Summarising a fund factsheet or a pension rule change.

Each one is useful. Each one also invites someone to paste in a name, a date of birth, a pension value or a health detail. That is where the risk sits.

Take a fictional firm, Ashcombe Wealth. Priya pastes her notes from a review with a client: full name, address, NI number, two pension values and a note about a recent diagnosis. She asks ChatGPT for a summary. The summary is good. But special category health data has just gone to a third party, from a personal account.

What the FCA expects from firms using AI

There is no separate AI rulebook. The FCA says it does not plan to introduce extra AI-specific regulation. It will rely on existing frameworks instead, including Consumer Duty and the accountability rules under the Senior Managers and Certification Regime (SM&CR, the rules on who answers for what).

That stance was confirmed again in September 2025. As Freshfields Risk & Compliance notes, the FCA will apply its outcomes-focused approach through Consumer Duty and SM&CR to hold firms accountable for AI outputs.

In practice that means four things for an advice firm.

Suitability stays with the adviser

A suitability report drafted by ChatGPT is still your report. If it misstates risk or invents a reason, the firm owns the mistake. Nothing in the rules shifts that to a software supplier.

Consumer Duty applies to every output

Client emails must be clear and support good outcomes. AI text can sound confident and be wrong. Fluent is not the same as accurate.

Record keeping under SYSC

SYSC, the FCA's systems and controls rules, expects firms to keep orderly records. If advice was shaped by a ChatGPT chat in someone's personal account, that record sits outside your systems. You may not be able to produce it later.

Named responsibility under SM&CR

Someone senior should own how AI is used. That is easier to show if there is a written policy and evidence it is followed.

The picture is still moving. According to a UK Parliament Treasury Committee report, in June 2025 the FCA and the ICO announced they would jointly develop a statutory code of practice for firms using AI for automated decision-making. That reflects continued uncertainty over how existing rules apply.

Use is already common. A PwC UK summary of an FCA and Bank of England survey found 75% of UK financial services firms already use AI, up from 58% in 2022. Only around a third said they fully understood how their AI systems work.

UK GDPR and client data in ChatGPT

Client names, contact details, income, pension values and family circumstances are personal data. Health details are special category data. Sending them to an AI provider is processing. You need a lawful basis, a contract with the provider and a clear idea of where the data goes.

The ICO's guidance on AI and data protection is the place to start. It asks firms to know what personal data goes into a tool, why, and what the provider does with it. On a personal account you usually cannot answer those questions well.

ChatGPT plans compared for client data

The plan matters more than the prompt. OpenAI Help Centre states that on consumer plans (Free, Plus, Go and Pro) conversation data may be used to improve its models unless the user opts out. On Business, Enterprise and Edu plans data is not used for training by default.

The contract differs too. As Usercentrics explains, personal data shared through Team or Enterprise is covered by the OpenAI Services Agreement and its Data Processing Addendum (DPA). That DPA is not available on free or personal Plus accounts. On Enterprise, workspace administrators control retention, and business data in deleted conversations is removed within 30 days unless retention is legally required.

One caveat. "Not trained on" does not mean "not stored". Strac notes that even on business tiers, OpenAI still transmits, processes and temporarily retains conversations, for example for abuse monitoring. A business plan is the floor, not the finish.

If your firm runs on Microsoft 365, the same questions apply there. Our guide on whether Microsoft Copilot is safe for client data covers that side.

How adviser meeting-note tools differ

Tools such as Jump, Zocks and Zeplyn are built for advisers. They record or transcribe meetings and produce notes and file entries. They differ from ChatGPT in a few ways.

• They sit in a fixed workflow, usually linked to your back-office system.
• They are sold to firms under business contracts.
• Many are built around US rules first.

Check each one as you would any supplier. Ask where data is held, whether there is a UK GDPR compliant DPA, how long recordings are kept and whether data trains any model. And note that staff often still open ChatGPT for the email afterwards.

A practical checklist for advice firms

Never paste

• Full names with dates of birth or addresses
• National Insurance numbers
• Bank details, policy or plan numbers
• Health information or vulnerability notes
• Whole fact-finds, client lists or spreadsheets
• Passwords or platform logins

How to redact

• Swap names for stand-ins such as "Client A".
• Round values: "pension around £400k", not the exact figure.
• Use ages, not dates of birth.
• Describe circumstances generally: "a health condition affecting retirement plans".

The question still goes. The model rarely needs the real name to help.

What to put in the firm AI policy

• Which AI tools are approved, and on which plan
• That personal accounts are not used for client work
• The never-paste list above
• That an adviser reviews every output before use
• Who senior owns AI use under SM&CR
• How staff are trained, and how often

How to evidence oversight for the compliance file

• A dated record of each person agreeing the policy
• Training records
• The DPA for each approved tool
• A short note on file where AI drafted part of a report, with the reviewer named
• Periodic records of what kinds of data were caught or blocked

Making the checklist stick

Policies help. People still paste in a hurry. This is the gap Helio Guard covers. It checks each paste, message and file upload on the AI site, on the PC, before anything is sent. NI numbers, bank details and client names are taken out or swapped for stand-ins such as "Client A", which turn back into real names when the answer is copied. We never see what your team types. It also records each person's dated agreement to your AI policy and produces a monthly record for your compliance file. Windows only for now. The details are on the pricing page if you want to see whether it fits your firm.

Related: Can solicitors use ChatGPT? SRA duties, client confidentiality and a safe-use checklist, Accountants using ChatGPT with client data: what is safe, what breaches the rules, and which plan to use, What happens to the data you paste into DeepSeek, and should you block it at work?