The Associate Who Pasted a Client Contract Into ChatGPT

The fourth tab

The document on the shared screen is clause 9 of a share purchase agreement, the seller's warranties, in English because the buyer's counsel sits in London. Paula, a second-year associate, is walking Henrik through her changes on a Teams call. Along the top of her browser are four tabs. The fourth is ChatGPT, and its sidebar lists her recent conversations. The newest carries the client's name and the words "warranty cap".

Henrik asks what is in it. The whole of clause 9, pasted in the night before with a request for tighter English, on the personal account Paula pays for herself. She does it most weeks, she says, and so does nearly every associate on her floor. She is not being defiant. She is being fast, and the firm has given her nothing faster.

The firm has 90 lawyers and about 200 staff in Hamburg and Düsseldorf, mostly M&A, shipping and real estate. Eighteen months ago the partners banned public AI tools for client work, in a two-page memo every lawyer signed. Henrik's first reflex after the call is a second memo, stricter, with a block on the firewall. Before he sends it, he books a call with me.

What the first memo did

Henrik, Paula and their firm are invented; the steps are the ones I would take with any firm in their position. Before any talk of software, I ask for three things: the memo, a count of visits to public AI sites from the firm's network over the last four weeks, aggregated and never per person, and a three-question anonymous survey asking which tools, how often and for what.

The count comes back in the thousands a week, and it misses everything done on phones over mobile data. The survey is more interesting. The most common use is not legal advice. It is English: polishing letters and clauses for foreign counsel, translating, and turning a 40-page judgment into one page. The memo stopped none of it. It moved it to places the firm cannot see.

I also say what the problem is not. Nothing here suggests the provider does anything wrong with what Paula sends. The problem sits on the firm's side: consumer terms it never signed, settings each person chooses, no record of what was sent, a history that leaves with the employee, and, for a German lawyer, a provider who was never bound to confidentiality the way § 43e BRAO requires.

Then the cheapest answer. ChatGPT Enterprise, Claude's Team and Enterprise plans, Microsoft 365 Copilot Chat and Mistral's Le Chat Enterprise all offer single sign-on, admin controls and business terms under which the firm's data is not used for training. If one of them covers what the partners need, they should license it, write a clear policy and stop there. But the partners want, in one place, what no single vendor offers: client names replaced before anything leaves, takeover work on a model the firm hosts itself, a record of AI use by matter, and a budget per team. That is a gateway.

Signed before anything launches

The rules come before the software, signed by the partners, the data protection officer and the works council. Ordinary work, with names replaced, may go to a frontier model on an EU endpoint, under a data processing agreement and business terms. Any matter the responsible partner flags as confidential stays on an open model the firm runs on rented EU GPUs. Secrets go nowhere.

The harder conversation is logging, and Ute, who chairs the works council, opens it with the right question: will partners be able to see who asked what? A system able to monitor behavior or performance needs the works council's agreement under § 87(1) no. 6 BetrVG, and GDPR requires telling staff what is kept and why. So the gateway logs metadata by default: a pseudonymous user, the team, the matter number, the model, tokens, cost and how many items were redacted. Prompt text is kept for 30 days, for security investigations only, opened under a documented procedure. Partners see AI use per matter. Nobody gets a ranking of people.

Clause 9, through the firm

Here is the same paste through the firm's own chat app. Paula signs in through Entra ID, which tells the gateway her team, its budget and the models she may use. She picks the matter from the practice management system and pastes clause 9. Before any model sees it, fixed rules run, and then Microsoft Presidio with a small entity-recognition model inside the firm's network, for the names the rules miss.

The matter is not flagged confidential, so the request goes to the default model on its EU endpoint. The answer comes back with placeholders, and the gateway swaps the names back inside the firm, so Paula reads a normal clause and the provider never sees the client's name. Had the paste contained a password or an API key, the request would have stopped with a message saying why.

The last row is the one I show the partners. Anyone who knows that market knows who the client is. Redaction is good at names and numbers and poor at descriptions, so it reduces exposure and nothing more. The real control is the routing: this matter may use that model because the firm has a data processing agreement and business terms with its provider, and a confidential matter would never leave the firm's own model. The policy covers what software cannot: describing a client is still disclosing one. The full flow is in the private AI gateway blueprint.

The name a scanner split in two

The pilot runs with the M&A group and the assistants who support it, about 30 people, and its job is to find whatever is slower or clumsier than the phone. The first complaints are practical: the upload limit is too small for a long agreement, and the chat forgets the matter between sessions. Both are fixed in the first week, because a sanctioned tool that is worse than the public one loses.

For the pilot only, and with the works council's sign-off, the participants agree that a sample of their prompts is reviewed for misses. The review finds one that matters. A scanned side letter, attached as a PDF, had the client's name split across a line break with a hyphen, and neither the dictionary nor the entity model matched the two halves. The name went out as written, to an approved provider under the firm's terms, which is exactly why routing and not redaction is the control.

Two rules come out of it. Text from scans is normalized before any rule runs: line-break hyphens joined, spacing collapsed, common recognition errors checked against the dictionary. And every miss a review finds becomes a test that the redaction must pass before any change to it ships.

The first department assistant follows the survey rather than a guess: English drafting with the firm's own glossary and clause library, which no public tool has.

Who draws which line

The gateway enforces rules; people own them. The responsible partner flags a matter confidential in the practice management system, and the gateway reads the flag but never decides confidentiality itself. Team leads own their budgets and get an alert at 80%, so a few heavy users cannot spend the month by the twelfth. The security team sees blocked secrets and repeated overrides, pseudonymized until an investigation is opened under the agreed procedure. Changes to the routing rules go through the partners and the data protection officer.

The gateway is also a target, because it holds every provider key. In March 2026, versions of LiteLLM, a widely used open-source AI gateway, were published to PyPI with a backdoor. So dependencies are pinned and upgraded deliberately, the gateway runs in its own network segment and can reach only approved endpoints, and its keys can be rotated in minutes.

Clause 9 of the next deal

A few weeks after launch, Paula's next agreement goes the way the last one did, only through the firm: the Teams bot, the matter picked from a list, clause 9 pasted in, tighter English back with the client's name where it belongs. The takeover the firm is advising on, still unannounced, runs on the self-hosted model, a little slower and entirely in-house. Public AI sites show a notice with a link to the firm's tool. It is a warning, not a block.

Henrik sees AI use per matter, which is what he wanted in the first place. The share of AI use that runs through the gateway, aggregated and never per person, is the number that says whether the phones are going quiet. The two-page memo is gone, and the one-page policy that replaced it has one sentence people remember: describing a client is still disclosing one.

Before the second memo

If one vendor's chat product covers your firm, license it; it is the fastest sanctioned route there is. A gateway earns its place when you want several models chosen per task, a self-hosted model on EU infrastructure for the most sensitive work, redaction before anything leaves and budgets per team, in one place. The hybrid is common: a licensed chat product for most staff, and the gateway in front of everything that calls a model through an API.

A gateway on an existing open-source interface, with one or two providers and pattern-based redaction, is a small build in the first tier of AI integration; a self-hosted model, a matter dictionary and department assistants move it up. The full blueprint has the flow, the failure modes and the rollout, and answers from the firm's own know-how come from an internal knowledge assistant behind the same gateway.

Frequently asked questions