Questions
Questions about AI, client confidentiality and PDFs
Answers come first and cite the rule or policy they rely on, with the date it was checked.
Can lawyers put client information into ChatGPT?
Not without care. Canadian law societies tell lawyers not to input confidential or identifying client information unless the tool has adequate safeguards. Ontario says to redact identifying information and obtain informed consent when anonymizing cannot protect confidentiality. British Columbia prefers omitting identifying information, and Alberta says never to include it in prompts.
Is anonymizing a document enough before using AI?
It is a strong first step, not a finish line. Removing names and identifiers reduces what the AI provider receives, yet the remaining facts can still identify someone: the Law Society of Ontario warns that “anonymizing is not perfect.” And if you keep a key to restore the names, the copy is pseudonymized, not anonymous. Reduce the residual risk by removing indirect identifiers, sharing only what the task needs, and reviewing the full copy.
Does Claude train on your conversations?
For consumer Claude accounts, it is your choice. Anthropic’s August 2025 terms update gives users “the choice to allow their data to be used to improve Claude.” If you allow it, data retention extends to five years; if you decline, Anthropic keeps its 30-day retention period. Claude Team and Enterprise content is not used for training by default.
Is it safe to upload documents to ChatGPT or another AI?
It is reasonably safe for documents without personal or confidential information, and risky for client, patient, employee or financial documents. The AI provider receives and stores what you upload, and whether it trains on it depends on your plan and settings. For sensitive documents, remove identifying details first and share only what the task needs.
Can immigration consultants use ChatGPT with client files?
No CICC rule specifically permits or prohibits RCICs using ChatGPT as of September 2026; we found no published College guidance on generative AI. Your existing confidentiality duties and Canadian privacy principles apply, so keep client identifiers such as names, UCI and passport numbers and dates of birth out of AI tools, and review everything the AI produces.
Can tax preparers use AI with client tax return information?
Carefully. IRC §7216 makes it a misdemeanor for tax return preparers to knowingly or recklessly disclose information furnished for preparing a return, or use it for other purposes, unless an exception or consent applies. Sharing return data with an AI service can be a disclosure, so remove client identifiers and return details, or follow the consent regulations first.
Why does my PDF say “Please wait… If this message is not eventually replaced…”?
That message is a placeholder page inside an Adobe XFA form. Viewers that cannot run XFA, including macOS Preview, show the placeholder instead of the form. Open the file in Adobe Acrobat Reader to fill it in. The file is not damaged; your viewer simply cannot draw that kind of form.
Can you submit a flattened or printed-to-PDF IRCC form?
Not for IRCC forms with a Validate button. IRCC says you must always click Validate on 2D barcode forms, whether you apply online or by mail. Online, it says “Do not print the 2D barcode form” and to upload the validated form; on paper, print it including the barcodes. A flattened copy has no working barcodes, so keep it for records only.
Can a flattened PDF be edited?
Not as a form: flattening removes the fillable fields, so nobody can retype, clear or reset the answers. But a flattened PDF is not locked like a password-protected file. Anyone with a full PDF editor can still change the page content, as with any PDF. Flattening prevents casual changes and display problems; it does not prevent deliberate tampering.
Can ChatGPT read local files without uploading them?
Partly. The ChatGPT desktop app can connect to a local MCP server, a program on your computer that reads files and returns their content when ChatGPT calls it, so you do not attach the file. But the content a tool returns becomes part of the conversation and is processed by OpenAI, just like an upload. ChatGPT on the web cannot use local servers. The protection comes from what the tool is allowed to return.
Do I need a privacy impact assessment to use AI in Quebec?
Often, yes. Section 17 of Québec's private-sector privacy act says: "Before communicating personal information outside Québec, a person carrying on an enterprise must conduct a privacy impact assessment." Most AI services process data outside Québec, so sending client personal information to one generally triggers it, along with a written agreement. Section 3.3 separately requires an assessment for projects to acquire or develop an information system involving personal information. Confirm the analysis for your organization with counsel.
Is it an ethics violation to use ChatGPT if the client data is redacted?
Redacting first is what much of the guidance asks for, but it does not settle the question on its own. Canadian law societies tell lawyers to remove identifying client information before using generative AI, and Ontario adds informed consent where anonymizing cannot protect confidentiality. Florida Bar Opinion 24-1 recommends informed consent when AI use would disclose any confidential information. Redaction reduces what you disclose; competence, supervision and your own confidentiality judgment still apply.