No part of this blog post constitutes legal advice.
A common question that came up at the two expert witness conferences which I attended in 2026, was
What kind of data are we safe to put into an AI model?
I have been asked this question by expert witnesses from all walks of life and professions. The question is often relating to very sensitive data, which could be legally privileged communications between an instructing solicitor and an expert witness, or medical notes in the case of a medico-legal expert witness engagement, but could apply to any non-public data. In this blog post, I am referring to cloud-hosted AI models - that is, AI tools which you access over the internet and which need internet connectivity to function.
First of all, if you are using a free version of any cloud hosted AI tool, such as the free version of ChatGPT, Gemini, or Claude (or even a paid consumer-grade version of these tools):
This is for a number of reasons:
The above confidentiality-related reasons are in addition to the general risks of using an AI model, such as hallucinations and misunderstanding of technical issues.
I would extend this advice to say:
It is often said that if you are not paying for something, then you (or your data) is the product, and that is definitely true for AI tools.
First of all, if you work for an organisation which has an IT department, I would hope that they have issued some AI guidance and they have an AI policy and AI governance.
The organisation may have provided an AI tool, such as a subscription to Microsoft Copilot, as well as rules on what kind of data can be put into that tool. You should only use the tool while logged in and check what data you are allowed to upload.
If in doubt, your IT department or the person in charge of AI governance should be able to clarify. You can ask your IT department to direct you to the person in charge of AI governance.
Whatever you do, please do not be tempted to bypass these rules and upload data into a free AI tool.
Also, be aware that whatever you upload into the tool can be recorded and your company may have access to your chat logs.
Many organisations have already been using Sharepoint before the advent of AI models. So it is quite possible that anything that has been uploaded to your organisational Sharepoint is accessible to the AI tool.
If you are self-employed, as is the case for many expert witnesses, you may not have the luxury of an IT department taking responsibility for your AI tools, and you will need to set up your own solution if you want to upload sensitive documents into an AI tool.
As I stated above, the free AI tools are not suitable for uploading sensitive data. However, having a paid account with an AI provider does not necessarily make you safe either.
The process of configuring an AI tool to be able to handle sensitive data is complex, as the AI tool often comes with a broader document management tool such as Sharepoint or Google Drive. So you need to ensure that your document system is safe and you are allowed to upload sensitive documents there.
It also depends what kind of sensitive data you are dealing with:
To use the chatbot Gemini with sensitive documents, you need an enterprise account on Google Workspace. Do not just create a personal account, even a personal account with a paid subscription (a paid consumer account does not guarantee protection of your data). You can then go to your admin console at https://admin.google.com/ and check that Gemini Enterprise is enabled. You can allow Gemini to have access to your documents in Google Drive and you can read the Terms of Service. You will see that the privacy assurance section states that:
Gemini Enterprise chats and uploaded files are not reviewed by human reviewers or otherwise used to improve generative AI models
If the data that you are uploading includes sensitive personal data under GDPR, then you will need to be aware of your obligations under GDPR. GDPR compliance covers your organisation’s entire handling of personal data. So just paying for Gemini Enterprise will not cover you, unfortunately. For example, if you are in the UK, you may need to register as a Data Controller with the Information Commissioner’s Office (ICO) and pay the annual fee. Check the ICO’s website and FAQs, or contact them, if you are unsure of your obligations in this area.
If you use Google Workspace with Gemini, Google acts as a Data Processor. You would need to execute a Data Processing Addendum (DPA), configure data residency (i.e. ensure that data is not stored or sent to the US), and use customer-managed encryption keys (CMEK). You will also need to ensure that all other steps that you are taking with your sensitive data are GDPR compliant. You need to take precautions that your Google Drive is configured correctly.
In the United States, healthcare data is covered by HIPAA. HIPAA compliance requires an executed Business Associate Agreement (BAA) with Google Cloud/Workspace, so you will need to sign the BAA, configure data residency, and ensure that your entire operations remain HIPAA compliant.
If you are using Microsoft products, you may have documents in Sharepoint which you want to query. In this case, you cannot use a personal or consumer Copilot account. You need to set up a Microsoft 365 enterprise plan and Microsoft 365 Copilot licenses or Microsoft Azure OpenAI Service.
Your enterprise Copilot or ChatGPT will be able to access the documents uploaded to your Sharepoint. Of course, you should have already checked that you are allowed to upload the documents in question into Sharepoint.
As with Gemini, GDPR and HIPAA require you to execute legal agreements: the Data Processing Addendum (DPA) in the UK, or the Business Associate Agreement (BAA) in the USA. But this is only part of the story: you need to set all the settings such as data residency on the Copilot subscription.
If you are interested in setting up a computer coded solution - for example, building an app that uses OpenAI on sensitive data as part of its workflow - then you can set up an account on Microsoft Azure to use OpenAI via its API, or an account on Google Cloud Console to use Gemini via API.
If this is sensitive data covered by GDPR or HIPAA, you will also need to sign the the Data Processing Addendum (DPA) or Business Associate Agreement (BAA), configure residency, and take steps to ensure compliance throughout your processes.
I have written a guide on how to set up a technical solution involving APIs here.
If you are in an organisation with an IT department that has taken responsibility for AI governance, take care to familiarise yourself with your organisation’s guidance and don’t try to bypass their restrictions on AI tools. The restrictions are there for a reason: to keep compliance and to keep sensitive documents private.
Without a professional IT department taking on responsibility for AI governance, it is possible to set up an enterprise subscription to an AI tool yourself and configure it so that you can upload sensitive data. However, this is a complex process and easy to get wrong.
Once you start handling very sensitive data such as healthcare records, you need to execute a number of legal agreements, and configure data residency to ensure that your data stays within the correct national territories. You also need to ensure that all steps within your organisation are GDPR or HIPAA compliant, as well as the AI tool itself.
Ready to take the next step in your NLP journey? Connect with top employers seeking talent in natural language processing. Discover your dream job!
Find Your Dream Job
There is ongoing debate around the question of whether AI can be used in court documents. A number of high profile cases have been reported where litigants, advocates, or expert witnesses have been admonished or even penalised by the courts for undeclared or inappropriate use of AI. In this blog post, I will focus on AI use in England and Wales, although I have covered some other jurisdictions in an earlier blog post on the topic.
Thomas Wood, director of Fast Data Science, appeared today as a panelist at the Bond Solon Expert Witness Conference on 6 November 2026 at Church House, Westminster in London. This follows Thomas’s appearance at the Ireland’s Expert Witness Conference on 20 May 2026.
What we can do for you
