Is ChatGPT Legal to Use for Client Documents in Ontario?

Every week, more Ontario lawyers are using ChatGPT to summarize contracts, draft client letters, and research legal issues. It's fast, it's cheap, and it feels like a superpower.

But there's a problem most lawyers haven't thought through: every time you paste a client document into ChatGPT, you may be violating your professional obligations under the Law Society of Ontario's Rules of Professional Conduct.

The Rule You Need to Know

LSO Rule 3.3-1 requires lawyers to "hold in strict confidence all information concerning the business and affairs of a client acquired in the course of the professional relationship."

ChatGPT is operated by OpenAI, an American company. When you submit a document to ChatGPT, that data is processed on US servers. Under the US CLOUD Act (Clarifying Lawful Overseas Use of Data Act), the US government can compel American companies to produce data stored on their servers — regardless of where the user is located.

That means a client's confidential information submitted to ChatGPT could, in theory, be accessed by a foreign government without your client's knowledge or consent.

What This Means Practically

You don't need to be working on a high-profile case for this to matter. Every time you paste any of the following into ChatGPT, you're potentially breaching confidentiality:

• A client's name combined with the nature of their legal matter
• Contract terms from a client agreement
• Details from a family law file
• Anything from an immigration matter
• Financial information from an estate file

The LSO hasn't issued a formal opinion banning ChatGPT specifically. But Rule 3.3-1 and Rule 3.1-2 (which requires competent use of technology) together create a clear obligation: if you're using an AI tool, you're responsible for understanding where your client's data goes and who can access it.

The Specific Risk: OpenAI's Data Practices

OpenAI's default settings (as of 2025) retain conversation history and may use it to improve their models. While OpenAI offers a "Team" plan with some data protections, these are not equivalent to the protections required for solicitor-client privileged information under Canadian law.

There is no Data Processing Agreement between OpenAI and individual lawyers using the consumer or even team version of ChatGPT. There is no guarantee that data stays in Canada. And there is no audit log showing who at OpenAI accessed your client's information.

What Compliant AI Use Looks Like

For Ontario lawyers to use AI legally for client work, the tool needs to:

1. Store all data on Canadian servers
2. Provide a Data Processing Agreement
3. Never use client data to train AI models
4. Maintain audit logs of all access
5. Isolate data per client matter

These aren't arbitrary requirements — they're what it takes to satisfy your confidentiality obligations while still getting the benefits of AI. (See how Surface meets each one on our compliance page.)

The Bottom Line

ChatGPT is an incredible tool for general legal research, drafting templates for public content, and brainstorming. But for anything involving actual client information, you need a tool built for the Canadian legal environment.

The risk isn't hypothetical. It's a professional conduct issue that could result in a complaint to the LSO.

Surface was built specifically for this problem — AI that knows everything your firm knows, runs on Canadian servers, and offers a DPA available on request. Try it free for 14 days.