California’s new rule for lawyers using generative AI takes effect January 1. Here is what I’d tell a law firm running Claude Team or ChatGPT Business.
TL;DR: SB 574 doesn’t care whether a tool is “enterprise.” It asks who can get at what you type, and whether those people are authorized by you and bound to keep it confidential. As I read it, the Claude Team and ChatGPT Business contracts can support compliance, as long as the firm puts its authorization on paper and checks its setup. Turning off training in a consumer account doesn’t get you there. The work before January is paperwork, workspace settings and a firm rule for the most sensitive material.
In the three weeks since the Governor signed SB 574 on September 30, several of the law firms I work with have asked me some version of the same question. Most of them do family law. All of them run their AI work through a paid business account, Claude Team or ChatGPT Business, and they’ve been putting actual client material into it: declarations, bank statements, custody evaluations, the long email chains that turn into motions. They want to know if they have to stop. My answer: no, but there’s work to do before January.
I went in with a view. I read SB 574 myself, along with the current business terms from Anthropic and OpenAI, expecting the business tiers to be fine because the vendors don’t train on customer data and because everyone on the vendor side who could touch that data is bound by confidentiality. I still believe the conclusion holds. But my initial reasoning was off in two places, and those two places are where the work is. First, this provision doesn’t test training. It tests access. Second, it isn’t enough that the vendor’s people are bound by confidentiality. They also have to be people you’ve authorized. You can’t approve them one by one, but you don’t have to: the data processing addendum you accepted helps document authorization. A line in your firm’s AI policy can make that authorization explicit, provided it matches the vendor’s terms and actual access.
I’m not giving legal advice here. This is the homework I’d want done before a conversation with ethics counsel. To do it, I also put the legal question to three AI research systems, Claude (Fable 5.1), GPT (Astra) and Gemini (4 Argon). Each one worked it separately from the primary sources and critiqued the other two memos, and then all three signed a consensus, with me as referee.
What the law tests
SB 574 adds section 6068.1 to the Business and Professions Code, effective January 1, 2027. You can’t delegate the practice of law to generative AI (I say a version of this in every training session!). You have to take reasonable steps to verify what it produces and correct anything wrong or hallucinated. And you have to disclose your use of it to the court for documents you submit. A companion change to Code of Civil Procedure section 128.7 says briefs, pleadings, motions and other papers filed in court can’t contain a citation the responsible attorney hasn’t personally verified. Section 128.7 still doesn’t apply to discovery, so discovery papers fall outside that rule.
The confidentiality provision is the one my clients ask about. An attorney may not enter “confidential, personal identifying, and other nonpublic information into a generative artificial intelligence system for which access to confidential, personal identifying, or other nonpublic information the attorney inputs into the system is not restricted to the attorney and persons authorized by the attorney under obligations to protect the confidentiality of the information.”
Read that twice. The test is about people. Who can get at what you typed, and whether they’re people you’ve authorized who are bound to keep it confidential. You authorize them as a group, not by name, and I’ll show you how below. It says nothing about training, and nothing about consumer versus enterprise products.
The statute’s definition of personal identifying information reads like a family-law file. It lists driver’s license numbers, dates of birth, Social Security numbers, the addresses and phone numbers of parties, victims and witnesses, medical or psychiatric information, financial information and account numbers, and anything sealed by court order or deemed confidential by court rule or statute. If your practice touches custody or domestic violence, every matter has this material in it.
How the Legislature got to “access”
The bill started somewhere else. The January version borrowed a phrase from the Judicial Council’s AI standard for courts and barred entering client information into a “public generative artificial intelligence system.” The bill never said what public meant. Its first supporter, Oakland Privacy, later told an Assembly committee that it meant systems “like Chat GPT, Gemini, Claude or many others,” a reading that would have swept in the business tiers.
On June 22 the Assembly added a definition. A public system was one that let anyone other than the attorney, or a person the attorney authorized, access the data, or one that used the data to train a model without the attorney’s authorization. At the Assembly Privacy and Consumer Protection Committee hearing on July 1, Assemblymember Jacqui Irwin asked whether the bill could instead require enterprise systems, “where all the data stays in the model and it’s not being used to train the model for other people’s purposes.” Senator Umberg, the author, answered that “virtually everything that’s filed is accessible to the public” unless it’s under seal.
The next day’s amendments struck the definition and the training prong and wrote in the access test, confidentiality requirement included. By mid-August the word public was gone too. The Legislature swapped a label for a description of what the system does with your data. That’s good drafting, and it’s the first place my reasoning was off. I’d focused on training, but this provision has no separate training ban. Under it, training matters because it’s one way unauthorized people could end up with access to your material. Training can still raise confidentiality questions under other rules, so the no-training terms are still worth having.
Why the business tiers can pass
Both vendors’ commercial contracts line up with that test. Anthropic’s Commercial Terms say it “may not train models on Customer Content from Services,” treat your content as your confidential information, and limit sharing to employees, agents and advisors who need to know and are bound by confidentiality at least as protective. OpenAI’s Services Agreement says it “will not use Customer Content to develop or improve the Services, unless Customer explicitly agrees,” and limits your confidential information to affiliates, employees, contractors and agents who need to know and are bound by obligations at least as restrictive.
The second place my reasoning was off is the word authorized. I’d assumed confidentiality was enough, but the statute also requires that the people with access be authorized by the attorney. Both data processing addenda use that word. Anthropic’s customer “grants Anthropic general authorization” to engage the listed sub-processors. OpenAI’s customer “hereby provides a general authorization.” Each vendor must pass comparable obligations down to its sub-processors and stays liable for them, within the contract’s liability limits. That’s the kind of vendor diligence the State Bar walked through for cloud storage in Formal Opinion 2012-184, and the Bar’s 2026 Practical Guidance says reasonable efforts take more than “generalized marketing assurances” and may include reading the vendor’s terms. So when the statute asks whether the people with access are “authorized by the attorney,” most of the firm’s answer is sitting in a contract it already accepted. The firm’s own AI policy can make that authorization explicit, as I cover below. That isn’t automatic approval of any product. The statute doesn’t bless Claude or ChatGPT by name, and the firm still has to make its setup match the contract.
The consumer accounts can’t make that showing. Turning off training in a personal ChatGPT Plus or Claude Pro account changes one data use. It doesn’t give a personal account the commercial confidentiality terms or the data processing addendum, with its sub-processor authorization, that the business tiers carry. If anyone in your firm still uses a personal account for client work, fix that first.
Where the business-tier protections have limits
A business contract narrows who can see your data. It doesn’t close every door, and the gaps that remain sit right where family-law files live.
Start with the law itself. Both vendors can disclose your content when a court or the law requires it. OpenAI’s agreement adds a narrower clause: it may keep content that violates its usage policies and, if it suspends or terminates the account, share information about that content as required by law or as reasonably necessary to protect its services or third parties from harm. Everyone who handles your content in the ordinary course is bound by contract. The exceptions are compelled legal process and that safety carve-out.
Feedback is the next gap. On Claude Team, a thumbs up or thumbs down sends Anthropic the whole conversation, which it can keep for up to five years. Workspace owners can turn that off with the “Rate chats” setting, and it’s easy to miss. OpenAI handles this differently. On ChatGPT Business, feedback doesn’t permit training on the conversation, and training requires a separate signed agreement, though admins can still switch feedback off.
Flagged content is the one I’d think hardest about, because it takes a different path from everything else. Both vendors run automated safety classifiers, and the things they screen for, abuse and harm to minors among them, are what a family-law declaration describes. Anthropic says only designated members of its Trust & Safety team can see conversations, on a need-to-know basis, and it keeps flagged inputs and outputs for up to two years. OpenAI’s sub-processor list, last updated October 14, shows TaskUs and Accenture moderating content for ChatGPT Business and the API, working from samples of flagged content. For ChatGPT Enterprise, the only moderation the list shows is of custom GPTs. Those contractors are bound by confidentiality, so as I read the statute this still passes. But if I ran a firm whose files are full of unredacted abuse narratives, I’d read each vendor’s sub-processor list for outside moderators before choosing where that material goes, or I’d redact it first. On OpenAI’s list, ChatGPT Enterprise keeps ordinary content away from them.
What I’d do before January 1
I haven’t found a published court decision or State Bar opinion that resolves how this provision applies to these products, and it doesn’t take effect until January. The statute doesn’t define “access,” and the strongest counter-argument is that a vendor’s safety reviewers act on the vendor’s own policy, so a strict reader could say the attorney never authorized them. I think that reading is unlikely, and all three systems agreed. That’s why I’d add the one line to the firm’s written policy: the firm authorizes the vendor’s confidentiality-bound staff, sub-processors and safety reviewers, as a group, to process firm inputs. Then the authorization is on paper and nobody has to infer it.
The statute is also a floor. Rule 1.6 and the State Bar’s guidance on reasonable efforts and informed client consent sit on top of it. No vendor contract can authorize a disclosure that a sealing or protective order prohibits. And sub-processor lists change. Both vendors send notice of new ones, and the window to object is short, fifteen days at Anthropic and thirty at OpenAI, so someone at the firm needs to be on those notification lists.
Three moves. First, pin down the paperwork. Save the terms, data processing addendum and sub-processor list your workspace accepted, and write a one-page AI policy that names the approved tools and includes that one-line authorization. Second, set up the workspace like you mean it. Turn off chat feedback, require single sign-on or two-factor login, restrict link sharing, and delete matter chats when the work is done, consistent with your retention duties. Third, decide your rule for the hardest material. Leave out Social Security numbers, account numbers, and children’s names and birthdates unless the task needs them, keep sealed material out without an order that permits it, and decide where unredacted abuse narratives go.
None of this is hard. It’s a few hours of work, and it turns a subscription into a position the firm can defend when a client or a judge asks the question in February.
Thank you for reading. If you enjoyed this, please share it with others.
Magnus is getting a MUCH NEEDED bath on Wednesday. Can’t wait to share pictures when he’s all clean again. In the meantime - here’s a quick snap from yesterday as he hung out on the couch next to me. I BBQ’d steak for him today and we went on three long walks. Life is good. ;)
