Anonymize a contract before giving it to ChatGPT: the checklist

Why anonymize a contract before ChatGPT?

In a few pages, a contract concentrates everything that identifies a deal: who commits, to whom, at what price, for which asset or service. It also names individuals: legal representatives, signatories, contacts, sometimes employees named in a non-solicitation or key-person clause.

Yet AI is valuable on a contract: reviewing a liability clause, comparing two versions, spotting a contradiction between the body of the contract and a schedule, summarizing each party’s obligations, preparing a note for an operational team. None of these tasks requires knowing who the parties are. That is the whole point of anonymization: keep the reasoning, remove the people and the companies.

The Conseil national des barreaux (CNB, the French national bar council) recommends exactly this to lawyers in its April 2026 guide: before giving contracts to an AI, the firm “pseudonymizes or anonymizes the parties (names, addresses, phone numbers)” (p. 20, our translation). It adds that details such as “amounts, internal project names, the way a contract is drafted” can be enough to recognize a client (p. 20).

What should you mask in a contract before ChatGPT? The checklist

Here are the elements to remove from a commercial contract, an NDA, a services agreement or an amendment, with what AnonymFiles detects on its own and what you mask in one click during review.

This table describes detection, not a guarantee: no automatic detection is perfect, hence the review of each document. The same company keeps the same placeholder in the contract, its amendments and its schedules: the client company becomes [ORGANISATION_1] everywhere.

Schedules, often the most identifying part

The body of a template contract says little about the parties; the schedules say a lot. A statement of work names sites, projects and teams. A price schedule reveals the commercial policy. A list of transferred staff names employees. An attached company register extract (Kbis) or bank details contain everything you should not send. First question to ask: does the AI need this schedule for the task? If not, do not attach it.

Indirect clues

A contract without names can still point to a deal: the name of a product, project or brand, a very precise place of performance, an unusual amount, a narrow sector. During review, ask yourself a simple question: would a competitor or a colleague in the sector recognize the deal?

What should you keep so ChatGPT can analyze the contract?

Masking too much makes the copy useless. For the AI to review and compare, keep:

• The clauses themselves: purpose, obligations, liability, termination, non-compete, confidentiality, governing law.
• The structure: article numbering, cross-references between clauses, definitions. A stable placeholder such as [ORGANISATION_1] lets the AI follow who commits to what.
• Relative periods and deadlines: “three years”, “thirty days after receipt”, “six months’ notice”. They identify no one.
• The parties’ roles: “the service provider”, “the client”, “the seller”. They state the role without stating the identity.
• Legal references: an article of the French Civil Code or Commercial Code cited in a clause stays visible.

For amounts, it all depends on the task. Rephrasing a cap clause does not require the figure; checking an indexation formula does. An order of magnitude is often enough.

What traces does a contract’s Word file hide?

A negotiated contract circulates as a .docx, and the file remembers the negotiation. Before sending it, check:

• Tracked changes: deleted passages stay in the file until the changes are accepted or rejected. They reveal each party’s positions.
• Comments: “do not concede”, “check with the client”, the name of the partner reviewing.
• Document properties: author, company, last modified by, original template.
• Hidden text and fields: a note formatted as hidden text remains readable to anyone who knows where to look.
• Headers and footers: logo, internal reference, file name, “Draft by firm X”.
• The file name: “Framework agreement Dupont SA v7 annotated.docx” already says it all.

Our guide to anonymize a Word document explains how to clean these elements by hand, on Windows and on a Mac.

Is ChatGPT confidential for a contract?

Not in the sense a confidential contract requires: everything you paste into ChatGPT is sent to OpenAI and kept, at least for a while. What changes from one plan to another is reuse and the contractual framework:

A business plan reduces the risk, but the contract still leaves the company. An anonymized copy no longer reveals the parties or the deal. The plans and their guarantees in detail: ChatGPT and GDPR and, for law firms, which ChatGPT plan for a lawyer.

Trade secrets, NDAs, GDPR: what does the law say?

Trade secrets

Article L. 151-1 of the French Commercial Code (Code de commerce) protects as a trade secret any information that meets three criteria: it is not “generally known or readily accessible” to people in the sector, it “has commercial value, actual or potential, because it is secret”, and its lawful holder has taken “reasonable protective measures” (our translation). A price list, a development plan or the terms of a partnership can qualify.

The third criterion matters here: handing sensitive clauses to an online service without precautions can weaken the protection. Anonymizing before sending is one of the reasonable measures a company can demonstrate.

Does an NDA prohibit sending a contract to ChatGPT?

Many contracts prohibit disclosing their content to a third party without consent. Depending on its wording, the clause may also cover a provider such as an online AI vendor. Read it before any use: an anonymized copy, which no longer allows the parties to be identified, greatly reduces the risk, but the clause remains the reference.

GDPR: data minimization

The representatives, signatories and contacts named in a contract are individuals: their names, email addresses and phone numbers are personal data. Article 5 of the GDPR requires them to be “limited to what is necessary” for the purpose of the processing. To review a clause, the AI does not need them. The obligations attached to the various ChatGPT plans are detailed in ChatGPT and GDPR: can you put client data into it?

How to analyze a contract with ChatGPT: tasks and prompts

Once the copy is anonymized and reviewed, ChatGPT is useful for five tasks. First paste an instruction asking it to keep the placeholders intact, then one request at a time:

• Review a clause: Review article 9 (liability). Point out ambiguities and anything unfavorable to [ORGANISATION_1], without changing the placeholders.
• Compare two versions: Compare the attached version 6 and version 7: list each clause that was changed, added or deleted, with its number.
• List the obligations: Make a table of [ORGANISATION_2]’s obligations: obligation, article, deadline, stated sanction.
• Spot contradictions: Check consistency between the body of the contract and schedule 2: time periods, definitions, cross-references.
• Prepare a note: Summarize in ten lines, for a non-lawyer operational manager, what [ORGANISATION_1] must do and by when.

What ChatGPT does not do for you: check the applicable law, approve a clause or decide to sign. Every reference it cites is checked at the source, and the in-house lawyer or attorney stays in charge. These rules are worth writing down in an AI use policy.

How to anonymize a contract with AnonymFiles, step by step

Here is the method with AnonymFiles, French document anonymization software: a desktop app coming soon for Apple silicon Macs and Windows, designed for in-house counsel and DPOs as well as for firms (see our anonymization software for lawyers).

1. Gather the file. The contract in Word (.docx) or PDF, its amendments, the useful schedules, the negotiation emails (.eml or .msg) if the AI needs to take them into account. Scanned PDFs, such as a signed version, are read by local OCR. The originals are never modified.
2. Run detection. Names of people, organizations, addresses, email addresses, French-format phone numbers, IBANs, private dates and ID numbers are replaced with stable placeholders, such as [ORGANISATION_1] or [PERSONNE_2], the same across all documents.
3. Review side by side. Each original is shown next to its copy. One click masks what detection missed: SIRET numbers, order references, prices, a project name. You approve document by document; nothing is exported without approval.
4. Export. A .docx contract comes out as a .docx redacted in place, layout preserved, plus a text copy for the AI. The archive is rebuilt from an allowlist: comments, tracked changes, hidden text, fields, images, macros and properties are removed, never copied over. In a PDF, masked text is truly deleted, not hidden under a black box. File names become neutral.
5. Work with the AI. Paste the instruction provided by the app so the AI keeps the placeholders intact, then ask: review the liability clause, compare version 6 and version 7, list the service provider’s obligations.
6. Re-inject and review. Paste the answer into the app, or import it as Word or PDF: the real names come back in place of the placeholders, on the computer. The mapping table never leaves the computer.

On the network side, the app works with no account and no telemetry, and the license is checked on the computer, with no network call. On a Mac, the detection models are included; on Windows, they are downloaded once, at the first processing run, without any document text. Pricing: €290 excl. VAT per seat per year for one or two seats, €240 excl. VAT per seat from three seats, quote above twenty seats. The published detection benchmark and the comparison of anonymization software help you place the tool.