2. Classify the Data

 Mark your data as one of these:

• Public / Non-sensitive (e.g., marketing copy, website text)
• Internal (e.g., staff memos, training material)
• Confidential / Client Data (e.g., contracts, financial info, HR records)

🔹 If Confidential → Use only secure AI platforms or avoid uploading altogether.
🔹 If Internal / Public → Continue to Step 3.

3. Verify Security & Vendor Controls

Before using any AI tool, confirm it meets these checkpoints:

✅ Data encrypted in transit & at rest (TLS 1.2+ / AES-256)
✅ Vendor has SOC 2 / ISO 27001 certification
✅ Data not used to train public models
✅ Option to delete data on demand
✅ U.S. based data storage (preferred)

➡ Approved Tools: Microsoft Copilot for 365, ChatGPT Team/Enterprise, or internal AI servers.
➡ If tool fails any checkpoint → Do NOT use for client data.

Why ChatGPT Pro Is Not Approved for Sensitive or Client Data

While ChatGPT Pro includes access to GPT-4/5, it is still under the consumer terms of service, which are not designed for professional compliance environments (like ABA confidentiality, FTC Safeguards, or HIPAA).

Key limitations of ChatGPT Pro:

1. Data can be used for model improvement unless you explicitly disable history/training — but disabling it removes the ability to save or organize conversations.

2. No enterprise-level admin control or audit logs — meaning your firm cannot track or enforce data-handling policies.

3. No data residency or confidentiality assurances — the service doesn’t specify where or how long data is stored.

4. No SOC 2 Type II compliance certification — which is often required for vendors handling regulated or client data.

In short, ChatGPT Pro is designed for individual convenience, not compliance.

4. Create an AI Use Policy (AUP)

Document what’s allowed and who can approve usage.

Policy should include:

• ✅ Approved AI tools

• 🚫 Prohibited actions (e.g., uploading client or financial data)

• ⚖️ Review process before client delivery

• 📅 Quarterly review and staff refresher training

5. Human Review & Oversight

🧠 Always keep “human in the loop.”

Before using AI output:

•  Review for accuracy, bias, and confidentiality.
• Approve by attorney or subject-matter expert.

Never send AI output directly to a client or publish online without review.

6. Monitor, Audit, and Improve

📊 Every quarter:

• Review logs of AI use (what, who, when) 
• Update your approved-tool list
• Measure ROI (hours saved, quality improved) 
• Update your AUP if needed