AI and professional secrecy: what each profession can share with ChatGPT, Claude or Copilot

ChatGPT and professional secrecy: why is an online AI a problem?

ChatGPT, Claude, Le Chat, Gemini and Copilot are services run by third-party companies. Everything you type or attach in the conversation is sent to them. The guide of the Conseil national des barreaux (CNB, the French national bar council) puts it this way: every request sent to a generative AI transmits data to the company that runs it, which stores and processes it, sometimes to improve its models.

Yet professional secrecy forbids precisely this: disclosing to a third party what you learned in the course of your work. Article 226-13 of the French Criminal Code (Code pénal) punishes the disclosure of secret information by a person who holds it through their profession “with one year of imprisonment and a fine of 15,000 euros” (our translation). This provision applies to all six professions in this article, each through a cross-reference in its own statute. In-house counsel fall under a different regime.

None of these texts mentions AI. But their logic is the same everywhere: a document pasted in plain text into an online assistant has left the firm, the office or the practice. Hence a question to ask before every request: does the AI need to know who the client is to do what I am asking? Almost never.

Case law is starting to say so, outside France. In February 2026, in United States v. Heppner, Judge Jed Rakoff of the U.S. District Court for the Southern District of New York held that a defendant's exchanges with Claude, Anthropic's consumer assistant, were not protected by attorney-client privilege. This is U.S. law, with no effect in France, but the reasoning is the same: a chatbot is a third party. Details in our article ChatGPT for lawyers.

What professional secrecy applies to each profession using AI?

Secrecy text, penalty, the professional body's position on generative AI, the tool it offers and our detailed guide, for seven French professions, according to the texts and guides listed in the sources (as of October 14, 2026).

The wording changes from one text to another, and so does the scope. But none of these professions can hand a file in plain text to a service it does not control. Patent attorneys face an additional risk of their own: disclosing an invention before it is filed, covered in our article on patents and AI. For in-house counsel, Law No. 2026-122 says nothing about AI tools; the employer's trade secrets and the GDPR lead to the same caution: see anonymize a contract before ChatGPT.

What do the French professional bodies say about AI?

Lawyers: the CNB guide of April 2026

Adopted by the general assembly on March 12 and 13, 2026, the guide “La déontologie et l'intelligence artificielle” (Ethics and artificial intelligence) starts from a strict principle: “never communicate data relating to one's files or clients to generative artificial intelligence” (our translation). It does not close the door, though: “The solution lies in pseudonymizing or anonymizing the data.” It adds that any risk of re-identification must be removed, whether through amounts, internal project names or the way a contract is drafted. Point by point: the CNB guide on AI.

Notaries: the guide of the CSN's IEJ

Published in December 2025 by the Prospective and Digital section of the Institut d'études juridiques of the Conseil supérieur du notariat (CSN, the French notaries' council), the guide “Introduction à l'intelligence artificielle” recalls three principles, according to its presentation: “absolute respect for professional secrecy,” “control over the processing of personal data” and “full and entire responsibility for the notarial deed.” Among “private AI” solutions, it cites programs that anonymize documents locally, without any transmission, before the AI processes them. On July 9, 2026, the CSN also announced an 18-month partnership with Mistral AI and the French hosting provider Scaleway, which notaries remain free to use or not: see Mistral, the CSN and privacy.

Chartered accountants: the Ordre's booklet

The booklet “IA et IA générative adaptées à la profession du chiffre” (AI and generative AI for the accounting profession, August 2025) makes data protection its first good practice, which ends with: “Pseudonymize or anonymize the data you give the AI.” The national council's notice “Comment utiliser ChatGPT ?” (How to use ChatGPT?, 2024) specifically names client e-mails, FEC files (French statutory accounting exports) and DSN payroll filings that have not been anonymized, which must not be uploaded to services the firm does not control. The Ordre also provides ExpertCHAT, a chatbot reserved for chartered accountants, available through Comptexpert, which answers only from the resources of its private website: a tool for standards and practice, not for client files.

Patent attorneys: the CNCPI guide

The guide of good practices for the use of generative AI (July 2026) recommends keeping confidential information out of requests, replacing proper names with pseudonyms and “industrial property title numbers with codes,” clearing the request history, informing the client and obtaining their prior consent.

Commissaires de justice and insolvency practitioners

We did not find any AI guide published by their national bodies. Their texts are enough to set the course, though: the code of ethics of commissaires de justice requires means of communication that “guarantee the confidentiality of exchanges and are secure”; the rules for administrateurs and mandataires judiciaires impose secrecy on their staff “as a contractual obligation,” and the IFPPC makes the use of AI conditional on respecting secrecy and the GDPR.

In-house counsel: Law No. 2026-122

Law No. 2026-122 of February 23, 2026 adds an Article 58-1 to the Law of December 31, 1971: the advice of in-house counsel becomes confidential if they hold a master's degree in law or an equivalent degree, have taken ethics training, and the advice bears the mention “confidentiel - consultation juridique - juriste d'entreprise”. It applies from a date set by decree, no later than February 1, 2027, and cannot be invoked in criminal or tax proceedings. It says nothing about AI tools. See our document anonymization software for in-house counsel and DPOs.

Is a paid or “enterprise” plan enough?

The business plans of the major providers reduce the risk. OpenAI states, for example, that by default it does not train its models on data from ChatGPT Business, Enterprise, Edu and the API, and it offers a data processing agreement (DPA) for these plans. The plan-by-plan detail is in our article ChatGPT and the GDPR; for the Microsoft 365 assistant, see Copilot and professional secrecy.

They do not settle the secrecy question, however:

• The text has left the firm. Even without training, the provider has received it, processed it and often kept it for a while.
• The promise cannot be verified. According to the CNB guide, a vendor's commitment not to reuse data “is generally neither provable nor verifiable.”
• The CNB guide accepts only two safeguards: anonymizing or pseudonymizing the data beforehand, or a model installed on the firm's own systems.
• Not every team member has the right plan. A colleague using a free personal account cancels every safeguard of the firm's plan. Hence the usage policy the CNB recommends.

How can you use AI without breaching professional secrecy?

Pseudonymizing means replacing each name with a stable label, such as [PERSONNE_1] or [ORGANISATION_1], while keeping the mapping table separately. This is the definition in Article 4 of the GDPR: the data can no longer be attributed to a person “without the use of additional information,” kept separately. Anonymizing means making identification impossible, irreversibly. To put the real names back into the AI's answer, pseudonymization is the right tool: see the difference under the GDPR.

1. Prepare the copy on your computer, never in the AI or in an online service. The originals stay untouched.
2. Remove direct identifiers: names, organizations, addresses, e-mails, phone numbers, IBANs, ID numbers, private dates.
3. Hunt down indirect identifiers: court docket number, land registry reference, lot number, judgment date published in the BODACC, internal project name, patent number. Would a colleague in the same field recognize the matter?
4. Clean the file: metadata, comments, tracked changes, hidden text (see PDF metadata and the black box trap).
5. Proofread the copy next to the original before sending it.
6. Proofread and check the answer: references, figures, quotes. The CNB asks lawyers to “reread, check and validate every generated content.”
7. Put the real names back on your computer, never in the AI.

Guides by profession

Each profession has its own documents, indirect identifiers and texts. Our detailed guides:

• Lawyers: ChatGPT for lawyers, without breaching professional secrecy, and the checklist for anonymizing written submissions.
• Notaries: AI and notaries, what you can give ChatGPT.
• Chartered accountants: ChatGPT and chartered accountants, what you can share without breaching secrecy.
• Commissaires de justice: AI and commissaires de justice, reports and writs.
• Insolvency practitioners: ChatGPT and insolvency proceedings.
• Patent attorneys: patents and ChatGPT, without disclosing the invention.
• In-house counsel and DPOs: anonymize a contract before ChatGPT and ChatGPT and GDPR.

And to prepare the copies, profession by profession:

• document anonymization software for lawyers
• document anonymization software for notaries
• document anonymization software for chartered accountants
• document anonymization software for commissaires de justice
• document anonymization software for insolvency practitioners
• document anonymization software for patent attorneys
• document anonymization software for in-house counsel and DPOs