Key takeaways
- OpenAI may use content from personal ChatGPT accounts to train its models unless the user turns that setting off; Business and Enterprise data is not used for training by default.
- California Business and Professions Code section 6068(e) requires attorneys to preserve client secrets, which includes trust and settlement details.
- State Bar of California guidance says confidential client information must not go into AI tools that lack adequate confidentiality and security protections.
- ABA Formal Opinion 512 calls for informed client consent before matter information goes into a self-learning AI tool.
- Microsoft Purview includes built-in detection for U.S. bank account and ABA routing numbers that can block pastes into unmanaged AI apps in Edge for Business.
- Drafting with placeholders keeps real figures inside the trust accounting system.
Why is trust account and settlement data a special risk in AI prompts?
Because it combines the two things a law firm is least able to take back: confidential client information and the details needed to move client money. A settlement statement pasted into a public AI tool such as a personal ChatGPT account can carry the client's name, the settlement amount, lienholders, and the trust account and routing numbers in one block of text.
California lawyers owe a duty under Business and Professions Code section 6068(e)(1) to maintain inviolate the confidence and preserve the secrets of the client. Rule 1.15 separately governs how funds held for clients are safeguarded and recorded. A prompt that carries trust data touches both.
Is ChatGPT confidential enough for client trust data?
Not on a personal account. OpenAI's help center says it may use content from Free, Plus and Pro accounts to train its models unless the user turns off "Improve the model for everyone" in data controls. OpenAI's business privacy commitments state that data from ChatGPT Business, ChatGPT Enterprise and the API Platform is not used for training by default.
Training settings are only part of the test. The State Bar's guidance also asks lawyers to review the terms of use, confirm the provider does not share inputs with third parties, and consult IT or cybersecurity professionals about security and retention before confidential information goes in. Even an approved business tool is the wrong place for account and routing numbers that the draft does not need.
What do the ethics rules say about putting client information into AI tools?
They allow AI use, but only with tools and practices that protect confidentiality. ABA Formal Opinion 512 says lawyers must evaluate the risk that information relating to a representation will be disclosed or accessed by others through a generative AI tool, and that a self-learning tool generally requires the client's informed consent before such information goes in. The opinion adds that boilerplate in an engagement letter is not enough.
The State Bar of California's practical guidance on generative AI is direct on the point: a lawyer must not input confidential client information into any generative AI solution that lacks adequate confidentiality and security protections. Settlement figures, lien details and client bank information all relate to the representation, so firms should apply that guidance to them.
What client data should never go into an AI prompt?
Anything that identifies a client's money or would let someone move it. For most firms that list is short and specific:
- Trust (IOLTA) and operating account numbers and routing numbers.
- Client bank account details collected for disbursement.
- Settlement amounts tied to a named client or matter.
- Lienholder names and payoff figures, including medical lien details.
- Client Social Security numbers and tax identification numbers.
- Wire instructions of any kind, including ones received from opposing counsel (how to verify trust account payouts).
California's breach statute also treats a financial account number combined with a code or password that permits access as personal information (Civil Code section 1798.82), so an exposure of these elements can become a notice question as well as an ethics one.
How can a firm still use AI on settlement work?
Use an approved business-grade tool and strip identifiers before anything is pasted. Most of the value in settlement work comes from drafting and checking: a release, a closing letter, a disbursement summary template. None of those need the real account numbers or the client's name to be drafted well.
A workable pattern is to have the AI draft with placeholders such as [CLIENT], [AMOUNT] and [TRUST ACCOUNT], then fill the real figures inside the firm's practice management or trust accounting system. The final numbers never pass through the AI tool, and the records stay in the system the firm already reconciles each month.
The same discipline applies to AI features built into software the firm already licenses. If a practice management or document platform adds an AI assistant, check whether it can read trust ledgers or settlement folders before turning it on, and whether its terms allow the vendor to retain or train on that content. A tool that is approved for drafting may still be the wrong place for disbursement records.
Can DLP block bank account numbers from AI tools?
Yes, if browser data loss prevention is set to recognize financial data. Microsoft Purview includes built-in sensitive information types for a U.S. bank account number (6 to 17 digits within 300 characters of words such as "checking account" or "bank account") and an ABA routing number. Firms using Edge for Business on managed Windows devices can block that text from being pasted or uploaded to unmanaged AI apps.
Built-in types are only a starting point. Add a custom pattern for the firm's own trust account numbers, which are known in advance and should never appear outside the trust accounting system. Pair DLP with blocking personal AI accounts on firm devices, so the approved tool is the only one in reach. Our guide to DLP for client and matter numbers walks through the custom pattern approach.
Who should own AI rules for trust account data?
The partner responsible for trust accounting, with IT carrying out the controls. California's Client Trust Account Protection Program requires licensees who hold client funds to register their accounts and complete an annual self-assessment of their trust account practices. AI use around trust data belongs in that same review.
Staff who handle disbursements, often paralegals and bookkeepers, are the people most likely to paste a settlement sheet into a chatbot to "clean it up." Training them by name matters more than a firmwide memo.
What should the firm do this quarter?
- Write the no-prompt list above into the firm's AI policy, in plain words, with examples.
- Turn on DLP rules for bank account and routing numbers in the browser and in Microsoft 365.
- Add a custom DLP pattern for the firm's own trust and operating account numbers.
- Block personal AI accounts on firm devices and confirm the approved tool's terms exclude training on firm content.
- Give disbursement staff a placeholder template for AI-assisted settlement drafting.
- Add an AI question to the annual trust account self-assessment review.
How can s90 help?
s90 manages IT for law firms in Los Angeles and Orange County, including the DLP rules, AI tool controls and sign-in policies that keep trust and settlement data where it belongs. We document those controls so the managing partner can answer a client questionnaire or a State Bar inquiry with evidence. If you want to check whether your current setup would stop a settlement sheet from reaching a public AI tool, we are happy to look.
