ABA Opinion 512: can lawyers use ChatGPT with client information?
The ABA says client information can go into a self-learning AI tool only with the client's informed consent. A line in your engagement letter is not enough. Here is what Opinion 512 says, what the states say, and what to do.
You want to paste a client's file into ChatGPT, Claude or Gemini. Can you? The national starting point is ABA Formal Opinion 512. This is the short version for a lawyer in any state. It is based on the opinion itself and the state bar opinions listed at the bottom.
What Opinion 512 is
- Issued July 29, 2024 by the ABA Standing Committee on Ethics and Professional Responsibility. The title is "Generative Artificial Intelligence Tools." The full opinion is on americanbar.org.
- Covers competence (Rule 1.1), confidentiality (Rule 1.6), talking to clients (Rule 1.4), candor to the court (Rule 3.3), supervision (Rules 5.1 and 5.3) and fees (Rule 1.5).
- Reads the ABA Model Rules. Your state's own rules are what bind you. Many state bars have written their own AI opinions. The table below lists some.
The confidentiality rule
The opinion's worry is a "self-learning" tool. That is a tool that can learn from what you type and use it in answers for other people. For those tools, the opinion says:
"a client's informed consent is required prior to inputting information relating to the representation into such a GAI tool."
In plain words: before client information goes into a tool like that, the client has to say yes, knowing what they are saying yes to.
Boilerplate consent is not enough
You cannot cover this with a stock clause. The opinion says:
"merely adding general, boiler-plate provisions to engagement letters purporting to authorize the lawyer to use GAI is not sufficient."
The opinion says informed consent means telling the client why you are using the tool, the specific risks, what kinds of their information will go in, how others might use it against them, and what the tool adds to the work.
When consent is not needed
The opinion says some AI use needs no consent at all. Its example is idea generation that does not involve client information. In its words, consent is not required when "the lawyer will not be inputting information relating to the representation."
That phrase is broad. Under Rule 1.6 it covers far more than names. Case facts, strategy and the deal terms all relate to the representation. So taking out names does not by itself mean you need no consent under 512. You still read what is left.
Read the terms of every tool
The opinion also says lawyers should read and understand each tool's terms of use and privacy policy, so they know who can see what goes in.
What the states say
Here is what some state and city bars, and one state supreme court, say about client data and AI. Each line is our short summary of the source, linked below.
| Where | Source | What it says about client data |
|---|---|---|
| California | SB 574, a state law (effective January 1, 2027) | Do not enter confidential, personal identifying or other nonpublic information unless access is restricted. Our SB 574 guide. |
| New York City | NYC Bar Formal Opinion 2024-5 (August 7, 2024) | No confidential client information in a tool that shares it with third parties, without consent. Names anonymization as one way consent is not needed. Our New York guide. |
| Florida | Florida Bar Ethics Opinion 24-1 | Recommends informed consent before using a third-party AI program if it would disclose confidential information. |
| Texas | Professional Ethics Committee Opinion 705 (February 2025) | Warns that a self-learning tool may store what you enter and reveal it to others later. |
| North Carolina | 2024 Formal Ethics Opinion 1 (November 1, 2024) | Generally, avoid putting client-specific information into publicly available AI tools. |
| Pennsylvania | PBA and Philadelphia Bar Joint Formal Opinion 2024-200 | Safeguard client information, and make sure AI systems that handle it have strict confidentiality measures. |
| Kentucky | KBA E-457 (March 15, 2024) | Client consent is required if an outside AI service will receive confidential information. |
| District of Columbia | DC Bar Ethics Opinion 388 (April 2024) | Sharing confidential information with a provider whose privacy policy lets it pass on what you enter risks a Rule 1.6 breach, absent consent. |
| New Jersey | NJ Supreme Court preliminary guidelines (January 24, 2024) | The lawyer must make sure an AI system is secure before entering any non-public client information. |
The pattern is the same almost everywhere. Get the client's informed consent, use a tool that keeps your inputs protected, or keep client information out of the tool.
Three ways to use AI on client work
Option A: get informed consent
Explain the tool, the risk and what it will see, in writing, for that client. Not a stock clause. This works, but it is a conversation for every client.
Option B: use a tool you have vetted
Read the terms. Find out whether the vendor keeps your inputs, trains on them, or lets its staff see them. Keep a record of why you decided the tool is safe enough. Several bars treat tools that keep inputs inside the firm differently. That is homework you do yourself.
Option C: take the client details out before you paste
If no client information goes in, Opinion 512's consent duty is not triggered. That follows from how the opinion is worded. It does not say anonymizing is required, and it does not call it a safe harbor. The NYC Bar does name anonymization as one way to avoid needing consent.
One limit. Names are the easy part. A case can sometimes be traced from an employer, a date and a small town. So you still read the facts before you paste, and cut or reword anything that points to your client.
Five steps before you paste client work into AI
- Find your state's guidance. Start with the table above. Your state bar's website lists its own opinions.
- List the AI tools you and your staff use. Include browser extensions and AI built into other software.
- Read each tool's terms. Does it keep your inputs? Train on them? Who on the vendor's side can see them? If you cannot answer, treat the tool as one that shares.
- Choose: consent, or take the details out. For a tool you have not vetted, either get specific informed consent or remove the client details first. Then read what is left.
- Check the output and keep a note. Verify every citation yourself. Note the date, the tool, what you took out and who checked the result.
How to do step 4 with KeptPDF
Anonymize for AI looks for names, dates of birth, Social Security numbers, driver's license numbers, account numbers, addresses and phone numbers. It swaps each one for a numbered placeholder like [PERSON_1]. It runs in your browser. The file is not uploaded to KeptPDF.
It does not find everything. It does not read medical or psychiatric details, criminal ID numbers or sealed material out of your text. It does not know which case facts are confidential. You review those yourself.
- Open Anonymize for AI and drop in a PDF or Word file, or paste text.
- Review what it found. Add anything it missed, including case facts that point to the client.
- Copy the anonymized text into ChatGPT, Claude or whatever you use.
- Put the real names back. Paste the AI's answer into the restore box. Keep the tab open until you have done this.
One honest note. The cleaned text you paste does go to the AI company. That is the point. The details you took out stay behind. If a detail does not need to reach anyone, the Redact tool removes it from the PDF for good.
Sources
Every source below is the issuer's own document. Outside the short quotes above, we summarize in our own words.
- ABA Formal Opinion 512: Generative Artificial Intelligence Tools (July 29, 2024)
- NYC Bar Formal Opinion 2024-5 (August 7, 2024)
- The Florida Bar: official notice of proposed Advisory Opinion 24-1. We quote the bar's published notice. The final opinion page on floridabar.org showed no text when we checked.
- Texas Professional Ethics Committee Opinion 705 (February 2025), via the Texas Center for Legal Ethics
- North Carolina State Bar: 2024 Formal Ethics Opinion 1
- PBA and Philadelphia Bar Joint Formal Opinion 2024-200 (archived copy of the PBA's PDF). It says it is advisory only.
- Kentucky Bar Association: Ethics Opinion KBA E-457 (March 15, 2024)
- DC Bar: Ethics Opinion 388 (April 2024)
- New Jersey Courts: Preliminary Guidelines on the Use of Artificial Intelligence by New Jersey Lawyers (January 24, 2024)
- California Legislative Information: SB 574, chaptered text
This is not legal advice. It is a plain-English summary for general information. Bar guidance changes. Check your own state's rules and talk to your ethics counsel about your practice.