Insights · Private AI
Why your client files should never go to ChatGPT: what to run instead
Every week, a well-meaning business owner pastes a client's document into ChatGPT to "just get a quick draft". If you have any duty of confidentiality, that one habit can become your biggest compliance risk. The plain-English version of why, and the fix that lets you use AI on everything without the worry.
The problem in one sentence
When you type or upload something into a cloud AI tool, it leaves your building. It travels to a company's servers, where, depending on the plan and the settings, it may be stored, reviewed, or used to improve their models. For a lot of businesses that's harmless. For a solicitor, an accountant, a doctor or a financial adviser, it can mean handing a third party information you're legally obligated to protect.
"We can't put client files in the cloud" is the single most common sentence I hear from professional firms. They're right to be cautious, and it's why so many of them have switched AI off entirely.
Why "it's probably fine" isn't good enough
The usual reassurance is that the big providers now offer settings that stop your data being used for training. That's genuinely better than it was. But "trust the toggle" is a thin defence when your obligation is to your client, not to a tech company's terms of service. Consider what's actually at stake:
- Legal privilege. Sending a privileged document to a third party's servers is exactly the kind of disclosure that can put privilege at risk.
- Privacy obligations. Under the Australian Privacy Principles, and for health providers AHPRA and health-records rules, you're accountable for where personal information goes. "The AI had it" isn't a defence.
- Client trust. Even where it's technically permitted, would your client be comfortable knowing their matter went through a US cloud service? Trust is hard to win and easy to lose.
The uncomfortable truth: most small firms have no real visibility into what happens to a file once it's uploaded. And "we didn't realise" is not where you want to be if it ever matters.
The fix: bring the AI to your data, not your data to the AI
You don't have to choose between using AI and protecting your clients. The alternative is private, on-premises AI: the same kind of drafting and summarising ability, but running on hardware you control, in your own office.
With a private setup, an open AI model is installed on a capable computer or a small server on-site. It reads your documents, drafts your letters, and answers questions from your own files, and none of it is transmitted anywhere. It can run completely offline. Your data never leaves the building, and it never trains anyone's model, because there's no "anyone else" involved.
What that lets you actually do
- Draft standard letters, emails and documents from your own templates and matter details.
- Summarise long files, threads and transcripts down to the answer you need.
- Ask questions across your own knowledge: policies, precedents, past work.
- Transcribe recordings and meetings on-site, not through a cloud service.
All the productivity your competitors are getting from ChatGPT, without the part that keeps you up at night.
Isn't running your own AI complicated and expensive?
Less than you'd think. The heavy lifting is a one-off setup: the right hardware, the right models, and connecting it to your documents. After that, the ongoing cost is closer to electricity than to a per-seat cloud subscription, and you're not renting your own productivity back month after month. For a firm that would otherwise pay for several AI seats and carry the compliance risk, private AI often works out cheaper as well as safer.
The short version
If a data leak would breach your obligations or lose a client's trust, don't paste it into a cloud chatbot. Bring the AI in-house instead. You get the same day-to-day usefulness, and your clients' information stays exactly where it belongs, with you.
Handle sensitive data and want AI you can actually trust? Tell me what you'd want it to help with and how sensitive your data is, and I'll come back the same business day with whether private AI is the right fit and what it would take.