ChatGPT for Lawyers (2026): What a Small Firm Can Safely Use It For, and the Settings That Matter

ChatGPT for lawyers: the short answer

As of September 2026, a small firm can use ChatGPT for intake summaries, letter drafts, deposition outlines, clause comparison, research starting points, and client FAQs, provided the account is one OpenAI doesn't train on and a lawyer reviews everything before it leaves the office. On Free, Go, Plus, and Pro, OpenAI says it "may use your content to train our models" unless you turn off one setting. On a ChatGPT Business seat ($20 a user a month billed annually), it doesn't train by default. Every product claim below comes from OpenAI's pricing pages and help center, and every ethics statement from the ABA's release on Formal Opinion 512 or Texas Opinion 705, all read on September 15, 2026.

I install AI for owner-led businesses, and law firms are the group that asks the best question first: "What happens to what I paste in?" This page answers that before it gets to the prompts.

The confidentiality line: which plans train on your inputs

OpenAI's help center splits its products into two groups. For "services for individuals such as ChatGPT and Codex," it says "we may use your content to train our models." For business products, it says "by default, we do not train on any inputs or outputs from our products for business users, including ChatGPT Business, ChatGPT Enterprise, and the API."

The consumer opt-out takes ten seconds. On the web: profile icon, Settings, Data Controls, turn off "Improve the model for everyone." On mobile: side-bar menu, profile icon, Data Controls, same toggle. OpenAI says the setting applies to the whole account and that a "Do not train on my content" request in its privacy portal does the same job; you don't need both.

Two more facts from the same pages. A Temporary Chat on any plan is not used for training, doesn't create memories, and is deleted after 30 days, though OpenAI says it "may be reviewed only to monitor for abuse." And Business isn't only a training setting: OpenAI's enterprise privacy page says workspace admins control retention, can view, export, and delete member conversations, that deleted conversations are removed within 30 days, and that ChatGPT Business completed a SOC 2 Type 2 audit. A data processing addendum is available for Business too.

Why this matters to a bar committee and not just a vendor: Texas Opinion 705 (February 2025) singles out "self-learning" tools that store user inputs and may reveal them "in responses to future inquiries by third parties," and calls that "obviously unacceptable." Its precaution list is short: understand how the tool works, review the terms of service, learn the data-security protections, and train lawyers and staff. The table above is the first two items. The vendor-neutral view of the same question is on AI for lawyers; the Anthropic-side version is on Claude for lawyers.

Six things a small firm can use ChatGPT for today

Each of these runs on a Business seat with the firm's own templates in a shared project. Each prompt is one I'd hand a paralegal on day one. Names and facts in the examples are placeholders.

1. Intake summaries

Paste the intake form or the call notes, get a one-page summary the attorney reads in 90 seconds.

Prompt: "You are summarizing a new-client intake for a small employment-law firm. From the notes below, produce: (1) a three-sentence summary of what happened, (2) a dated timeline, (3) the parties and their roles, (4) documents the client mentioned having, (5) open questions the attorney should ask on the first call. Do not offer legal conclusions. Notes: [paste]."

2. Letter drafts

Engagement letters, status updates, records requests, demand letters. Give it the firm's prior letter as the model, never a blank page.

Prompt: "Using the attached letter as the template for tone and structure, draft a records request to [entity] for [documents] covering [date range], under [statute or agreement, if any]. Keep it under 300 words. Leave bracketed placeholders for anything you'd need to verify."

3. Deposition prep outlines

Not the questions themselves. The map: topics, the documents each topic depends on, and the admissions you're after.

Prompt: "I'm deposing [role] in a [type] case. From the summary below, build an outline with: topic headings in a logical order, the two or three documents I should have ready for each topic, and the specific facts I need this witness to confirm or deny. Flag any topic where the summary lacks the facts to write good questions. Summary: [paste]."

4. Contract clause comparison

Two versions of a clause, side by side, with the differences in plain English. ChatGPT is good at this because the whole answer is in front of it.

Prompt: "Compare these two indemnification clauses. Produce a table with rows for scope, triggers, carve-outs, caps, defense obligations, and notice requirements, and a column for each version. Then list, in order of risk to the buyer, every way version B is worse for the buyer than version A. Quote the exact language for each difference. Clause A: [paste]. Clause B: [paste]."

5. Research starting points, with the citation warning

This is the use that got lawyers sanctioned. Texas Opinion 705 cites Mata v. Avianca (S.D.N.Y. 2023), where attorneys filed a brief citing cases ChatGPT made up, and adds that "the Committee will say it again: lawyers are responsible for the work product they submit regardless of who (or what) does the original research and drafting." So the rule in my installs is mechanical: ChatGPT names the issues and the doctrines; every authority comes from Westlaw, Lexis, or the court's site; nothing with a citation goes into a filing without a human pulling the source. Texas also notes some courts have standing orders on AI in filings (it names N.D. Tex. Local Rule 7.2), so the local rules get checked first.

Prompt: "I'm researching whether [issue] under [jurisdiction] law. List the legal doctrines and elements likely to control, the kinds of authority I should look for (statute, regulation, leading appellate cases), and the search terms I'd use in a legal research database. Do not cite specific cases or statutes by name or number; I will pull those myself."

6. Client FAQ

The ten questions every new client asks, answered in the firm's voice, reviewed once by the attorney, then reused for a year.

Prompt: "Write a client FAQ for a small [practice area] firm in [state]. Ten questions new clients ask in the first week, each answered in under 80 words, plain English, no legal advice about the reader's specific situation, and a line at the end of each answer telling them to raise it with their attorney if it applies to them. Match the tone of the attached engagement letter."

The three things never to paste into ChatGPT

1. Anything sealed, under a protective order, or received under someone else's confidentiality agreement. The other side's NDA doesn't have an AI exception, and neither does the court's order. This holds on every plan, Business included.
2. Protected health information. OpenAI's Business overview says BAAs need "a contracted offering instead of self-serve ChatGPT Business." If your practice touches medical records, read is ChatGPT HIPAA compliant before the first paste; the short version is that no self-serve plan comes with a BAA.
3. Client-identifying facts into a personal account. A Plus login with "Improve the model for everyone" still on is the exact "self-learning" scenario Texas Opinion 705 describes. If someone at the firm insists on a personal account, they use the toggle above or a Temporary Chat, and the firm's matter work stays on the Business workspace.

Texas adds one more layer: if confidential information will go into a generative AI tool at all, the lawyer "should consider informing clients about the associated risks and may need to secure client consent," and it notes the ABA and Florida Bar opinions go a step further and suggest informed consent. One sentence in the engagement letter handles it. Check your own state bar for the current position.

What ChatGPT Business costs a firm

The published prices, from openai.com/business/pricing on September 15, 2026: a Standard seat is $20 a user a month billed annually or $25 monthly; a Premium seat is $100 annually or $125 monthly and gets "5x more usage than standard, with no 5-hour limit." The page lists no training on your business data by default, SAML SSO and MFA, centralized billing, usage analytics, and spend controls, and says the plan is "for teams of 2–200 employees."

A workspace needs at least two seats, so a solo pays for two: $40 a month on the annual plan. A three-attorney firm with a paralegal and an office manager is five Standard seats, $100 a month annual, and I'd only move an attorney to Premium after the first month shows who actually hits the limits. The full seat math, and what forces a contracted Enterprise deal, is on ChatGPT Business pricing.

On fees: the ABA's summary of Formal Opinion 512 says a lawyer who spends 15 minutes inputting information into a generative AI tool may charge for that time and for reviewing the output, but "in most circumstances, the lawyer cannot charge a client for learning how to work a GAI tool." Texas says hourly billers can't charge for time the tool saved. So the subscription is overhead, the review time is billable, and the learning curve is on the firm.

The 30-minute setup

1. Minutes 0 to 5: buy the seats. ChatGPT Business, annual billing, Standard for everyone. Name the workspace after the firm.
2. Minutes 5 to 10: lock the door. Turn on MFA for every member, and SSO if you run Google Workspace or Microsoft 365. Set the owner and admin roles to the managing partner and whoever runs IT, and nobody else.
3. Minutes 10 to 15: set retention and spend. OpenAI says workspace admins control how long data is retained and can set spend controls; pick a retention window that matches the firm's document policy, and cap credits before someone finds the limit for you.
4. Minutes 15 to 25: one shared project, not a pile of chats. Load the engagement letter, the standard records request, the intake form, and the client FAQ into a single project so every prompt above starts from the firm's own documents.
5. Minutes 25 to 30: the one-page policy. Approved account only; the three never-paste items; the citation rule (every authority pulled by a human); who signs off on exceptions; the consent sentence in the engagement letter. Texas Opinion 705's fourth precaution is training staff, and this page is the training.

If you'd rather follow the workspace side click by click, including roles, domain verification, and the mistakes I see in week two, it's on the ChatGPT Business setup guide. The legal-specific part is the policy in step five, and it fits on one page.

Where I'd start this week

Run the six prompts on material that isn't privileged at all: a closed matter with names changed, a public filing, the FAQ. Time each one against how long it took last month. In my installs the intake summary and the clause comparison pay for the seats in the first week, and the research starting point is the one that needs the most supervision. Keep it that way.