Client data and AI
Can I put client data into ChatGPT, Copilot, Claude or Gemini?
The short answer: not on a personal plan. The plan you are on matters more than the brand.
Vendor terms checked October 23, 2026. Vendors change these often, so check the sources below before you rely on them.
Educational information, not legal or compliance advice. Confirm with your chief compliance officer before acting on it. Read the full disclaimer.
Can I put client data into ChatGPT?
It depends which ChatGPT. On personal plans (Free, Plus, Pro), OpenAI can use your chats to train its models unless you turn off "Improve the model for everyone" under Settings → Data controls. On ChatGPT Business and Enterprise, OpenAI says it does not train on business data by default. Either way, only use a tier your firm has approved, and leave out identifiers the task does not need.
Is Microsoft Copilot safe for client data?
Only when you are signed in with your work account. Microsoft 365 Copilot and Copilot Chat on a work or school account come with enterprise data protection: Microsoft says prompts and responses are not used to train its foundation models, and your IT admin can audit them. Copilot on a personal Microsoft account is a consumer product without those commitments, so check which account you are signed in to.
Can I put client data into Claude?
On personal plans (Free, Pro, Max), a Model Improvement setting in your privacy settings decides whether your chats can be used to train Claude, so check it. Claude Team, Enterprise and the API run under Anthropic's commercial terms, which say Anthropic may not train models on customer content unless the customer opts in to share it. Use a commercial plan your firm has approved.
Can I put client data into Google Gemini?
Not on a personal Google account. In the Gemini app on a personal account, human reviewers can read conversations and Google can use them to improve its models while Keep Activity is on, which it is by default for adults; reviewed chats are kept for up to three years. Google itself asks users not to enter confidential information. Gemini in a Google Workspace account your firm manages is different: Google says that data is not used to train models or reviewed by humans.
If the AI vendor does not train on my data, is my firm compliant?
No. Training is one question among several. Under the amended Regulation S-P, firms need written safeguards, oversight of service providers such as AI vendors, and an incident response program that notifies affected customers within 30 days of certain breaches. Larger firms had to comply by December 3, 2025 and smaller ones by June 3, 2026. Client communications drafted with AI are also records like any others, and FINRA has said its rules apply regardless of the technology used.
What should a firm write down about AI and client data?
At minimum: which tools and which tiers are approved, what client data may go into each, who reviews AI output before it reaches a client, and how prompts and outputs are kept as records. Then run each approved vendor through a due-diligence review covering training, retention, SOC 2, access controls and incident response.
My firm has no AI policy yet. What is the safe default?
Keep client personal information out of every personal-plan AI tool. If you need AI for client work, use a business tier your firm has approved and remove names, account numbers and Social Security numbers the task does not need. For anything you are unsure about, ask your chief compliance officer before you paste.
Check a vendor yourself
Sources
Disclaimer
FinSay LLC ("FinSay") is an educational platform. FinSay is not a law firm, registered investment adviser, broker-dealer or compliance consultant, and this page is not legal, compliance, regulatory, tax or investment advice. Using it does not create an attorney-client, advisory, fiduciary or other professional relationship with FinSay.
Laws, regulations, regulatory guidance and vendor terms change. The information here reflects FinSay's review on October 23, 2026, and FinSay does not undertake to update it. Statements about AI products summarize each vendor's public documentation on that date; confirm current terms with the vendor. FinSay is not affiliated with or endorsed by OpenAI, Microsoft, Anthropic or Google; product names are trademarks of their respective owners.
Your firm remains solely responsible for its own compliance and for any policy it adopts. This content is provided "as is", without warranties of any kind, and your use of it is governed by the FinSay Terms of Service, including their disclaimers and limitation of liability.