ChatGPT and OpenAI for your contracts: what you can hand them, and on what terms

What ChatGPT genuinely does well on a contract

Let us start with what works, because it is a lot, and because ignoring these uses would mean depriving yourself of a useful tool.

Producing a first draft. Ask it for a services agreement outline, a non-disclosure agreement, an amendment, a price-revision clause. In seconds, you get a structured, coherent starting point written in correct English. That first draft is never publishable as is, but it clears the blank page, which remains the real starting cost of a contract.

Explaining a clause in plain language. You have inherited a contract drafted by the other side, with a limitation-of-liability clause written in dense jargon. ChatGPT explains it in plain language, in three sentences. To prepare a discussion with a finance or sales lead, that is valuable.

Exploring alternatives. “Give me five ways to phrase an early-termination clause that protects the client.” You get a spectrum of options you might not have considered. It is a thinking tool, not a decision tool.

Spotting the obvious anomaly. An inconsistent date, a reference to a clause that does not exist, an obligation that contradicts another. On surface errors, a good model catches them quickly.

Preparing a negotiation outline. Summarising the friction points of a deal, listing what is at stake for each side, anticipating objections.

Converting one document type into another. Turning a briefing note into a contractual clause, or the reverse.

On each of these uses, ChatGPT delivers a real service. Claiming otherwise would be dishonest, and you are not the only ones using it: nearly every legal team we meet already does, often without having formalised it, which is precisely where the problem starts.

But none of these uses touches what makes contract work genuinely hard in a company.

The four structural limits of a general-purpose model

These limits are not flaws in ChatGPT. They are the logical consequences of what it is: a general-purpose model, with no knowledge of your company, no memory of your decisions, and no mandate to commit your liability.

1. It does not know your playbook

Your company has a contractual position. You know which liability clause you accept, which cap is negotiable, which indexation clause you refuse, what counts as a red line. That playbook exists, often implicitly, in the heads of two or three people, sometimes in a Word document nobody has re-read in eighteen months.

ChatGPT does not know it. It applies a market average. A clause it presents as “balanced” may be entirely unacceptable under your policy, and conversely, it will flag as risky a clause you have always accepted because your business justifies it.

A general-purpose model gives you the market’s view. It does not give you your company’s view.

2. It traces nothing

This is the most serious limitation in practice, and the least discussed.

When a lawyer asks ChatGPT to review a contract and then signs off, what happened? Nothing is recorded. No version, no timestamp, no approver’s name, no rationale. If a dispute two years from now turns on that clause, you will not be able to show who approved what, when, and on what basis.

In contract matters, traceability is not an administrative nicety: it is your means of proof. A chat is not an audit trail.

3. It does not know your other contracts

A contract does not live alone. It has dependencies: a master agreement, attached purchase orders, an exclusivity clause signed with another partner, an earlier amendment. Contradictions between contracts are a major source of risk, and often invisible until the dispute.

ChatGPT processes one document, or the documents you paste into the conversation. It has no memory of your contract portfolio.

4. It cannot be held responsible for a legal error

A generative model produces plausible text. “Plausible” and “legally accurate” are not synonyms. On a statutory reference, a case citation or a regulatory wording, a convincing answer can be wrong. This is exactly why it matters to understand how an AI is governed and what data it was trained on.

The rule is simple and non-negotiable: on a contract, no content produced by a model should commit the company without explicit, traced human validation. That holds for ChatGPT. It holds for PactAI. It holds for every tool on the market.

The question that stops most teams: can I send my contracts to ChatGPT?

This is where the real decision plays out, and it is far more nuanced than what you usually read.

Not all offerings are equal

An essential starting point, and one that is often muddled: there is a major contractual and technical difference between consumer use of ChatGPT and the offerings built for organisations.

OpenAI distinguishes, on one side, individual and free use; on the other, the offerings designed for businesses (ChatGPT Business, ChatGPT Enterprise, ChatGPT Edu) and access via the API. These two worlds do not provide the same guarantees.

On the enterprise offerings and the API, OpenAI states explicitly, in its own documentation, that your organisation’s data remains your property, that it stays confidential, and, this is the key sentence, that by default, your business data is not used to train the models. That covers both prompts and outputs.

On individual access, the frame is different: conversations may be used to improve the models, with settings and opt-out available. This is precisely the gap many organisations discover too late, once an employee has already pasted a client contract into a personal chat window.

The DPA: available, but not everywhere

A DPA (Data Processing Addendum) is the agreement that frames the relationship between you, the controller, and your provider, the processor. Without a DPA, the processing of personal data by a supplier is legally precarious.

OpenAI offers a DPA for its Business, Enterprise and API offerings. It does not offer one for free use.

Practical consequence: if you process personal data in a contract, and that is the case for nearly every employment contract, every services contract involving individuals, every subcontracting agreement, then using the free version will not stand up in light of your record of processing. The enterprise version, with a signed DPA, is. This is also why teams increasingly track their DPAs as first-class contractual obligations.

Certifications: an objective checkpoint

OpenAI publicly documents a compliance baseline that includes SOC 2 Type 2, the ISO/IEC 27001, 27017, 27018 and 27701 standards, and the CSA STAR certification. These frameworks cover information security, cloud security, protection of personal data in the cloud, and privacy management.

This is verifiable, and it is exactly the kind of thing to ask of any AI provider that touches your contracts: the exact, dated state of its certifications, and its trajectory when a standard is in progress. For symmetry, here is our own situation: at Pactolane, ISO/IEC 27001 certification is in progress; SOC 2 Type 2 and CSA STAR are not held to date. The good practice is not to demand a ticked box, but to get a precise, verifiable answer from each vendor, and to walk away from the one that stays vague or evasive.

Data location

This is the least documented and most sensitive point for an organisation governed by continental European law. The data processed may be hosted or processed in the United States, where OpenAI is headquartered; GDPR compliance for residents of the European Economic Area and Switzerland is handled by its European subsidiary, OpenAI Ireland Limited.

That arrangement is lawful and framed. But it remains a point of diligence to examine, in particular on transfers outside the European Union and the associated contractual guarantees. A company that handles strategic contracts must be able to answer the question “where is my data” without calling IT. It is a requirement of your clients, your auditors and your record, and it maps directly onto how you keep control of what you actually send to a model.

The EU AI Act: do not forget it

The European regulation on artificial intelligence entered into force in August 2024, and its obligations roll out in stages. It introduces a notion that concerns you directly: that of deployer. Any organisation that uses an AI system in a professional setting falls into this category, with obligations that vary by the system’s risk classification: transparency and information of individuals in most cases, and, for high-risk systems, enhanced documentation, human oversight and, where applicable, an impact assessment.

In other words: when you deploy ChatGPT in an organisation, you are not a mere end user. You are a regulated actor. Anticipating this timeline is part of a sound roadmap for the EU’s AI and data regulation.

Data protection authorities and the impact assessment

Data protection authorities across the EU, and the CNIL in France in particular, have published guidance on the use of generative AI systems, setting out how to reconcile these tools with the GDPR. For uses that present a high risk to individuals’ rights, a data protection impact assessment (DPIA) is required.

The subject goes beyond the strict scope of the contract, but it touches every HR use, every candidate-screening mechanism, every processing operation that affects an individual. An organisation that puts an undocumented AI use in place exposes itself to a blind spot that always surfaces at the worst moment.

Trade secrets

The GDPR only covers personal data. A contract between two companies also contains confidential information that is not personal data: negotiated prices, volumes, margin levels, product plans, client lists, commercial terms. This information is protected as trade secrets, and the consequences of disclosure are not measured in administrative fines, but in competitive advantage lost, sometimes for good.

This is the argument that, in real life, weighs more heavily than all the regulatory considerations combined.

A note on method before going further: the points above on OpenAI’s offerings reflect the vendor’s public documentation and the European regulatory framework as they stand at this page’s last-verified date. Both evolve regularly; check the version in force of OpenAI’s terms and of the texts cited before you decide.

The trade-off in one sentence

This is where the decision is made, and it comes down to one question: which type of contract are you talking about handing to an AI tool, and for what purpose?

A public contract, a standard contract, a generic template you are looking to for drafting inspiration: the confidentiality stake is low.

Your strategic master agreement with your first client, your exclusive distribution contract, your negotiated terms with your critical subcontractor, the employment contracts of your leadership team: the stake is maximal, and there is no version of “it is probably risky but let us try”. For that category, the real question is one of an AI review of confidential contracts handled in Europe.

Most organisations do not make this distinction. They swing either into a blanket ban, which drives shadow use, the worst scenario, or into blanket authorisation, which exposes everything without distinction.

How to combine ChatGPT and a contract platform

This is probably the most useful part of this guide, because it answers the question no one frames correctly.

ChatGPT is excellent where you need thinking. A contract platform is necessary where you need traced execution.

These are not two competing answers to the same need. They are two links in the same chain.

The ChatGPT link is exploration. Finding a wording, understanding an adverse clause, generating a variant, preparing an outline. No trace is needed because nothing is decided. You are in the draft, use is individual, the stake is low.

The platform link is the decision. Confronting each clause with your playbook, with four position levels (preferred, acceptable, fallback, red line) and a compliance score. Detecting missing clauses, not only the ones that are present. Surfacing risk areas and the best available alternative. Automatically blocking what exceeds your threshold: that is the role of the guardrails you configure on contract AI.

Then execution, which neither ChatGPT nor any model alone can carry: approval by the right people under defined rules, negotiation with a third party invited by secure link and without needing to create an account, electronic signature compliant with the eIDAS Regulation at the simple level (SES), with signer identification and a time-stamped audit trail, tracking of obligations and deadlines with automatic reminders, archiving.

The tipping point is simple: as soon as content commits the company, it must leave the chat and enter a system that keeps a record.

And on the data side, the rule we have set for ourselves at Pactolane is deliberately strict: personal data is removed before any processing by our AI, PactAI, and your contracts are never used to train a shared model. Data residency is in France and Belgium, within the European Union, on Google Cloud infrastructure that we state transparently. A data processing agreement is available on request, and the detail of our security architecture answers a DPO’s or a CISO’s questions point by point, as our note on the security architecture of an AI for DPOs and CISOs sets out. These are not marketing arguments: they are the answers your DPO, your CISO and your auditor will ask for.

The checklist: ten points before putting AI on your contracts

Use it as is in committee, whether you go with ChatGPT, a CLM, or both.

1. Is the scope written down? Which contract types can go through AI, which are excluded. A vague policy will be worked around.
2. Which offering are you using? Individual use or an enterprise offering. The answer changes everything contractually.
3. Is the DPA signed? If there is personal data and no DPA, the file is incomplete.
4. Where is the data? Can you answer without calling IT?
5. Are the certifications enforceable? SOC 2 Type 2, ISO 27001, 27017, 27018, 27701. Ask each AI vendor you evaluate for the attestations and their date.
6. Who validates, and how do you prove it? On each sensitive clause, an identified human, a time-stamped validation.
7. Is there an explicit contractual playbook? If your playbook is not written, no tool can apply it.
8. Is the AI system kept in a separate register? The AI Act expects a register of systems, distinct from the GDPR record of processing.
9. Has an impact assessment been carried out? As soon as a use presents a high risk.
10. Are staff trained? Shadow use is the number-one risk, and it is addressed through training, not through prohibition.

The bottom line: the right question is not “ChatGPT, yes or no”

ChatGPT is a remarkable tool, widely adopted, and it would be absurd to do without it on the uses where it excels: exploration, rephrasing, first drafts. A team that uses it well works faster.

The useful question is not whether ChatGPT is a good tool. It is knowing what you hand it, under what conditions, and what you can prove afterwards.

For everything that is exploration: go ahead, set a framework, train people.

For everything that commits your company: you need a playbook, a trace, an enforceable signature and archiving. That is what we build at Pactolane: a platform that applies your playbook, traces every decision and hosts your contracts in Europe, with a data processing agreement available and published pricing.

And if you want to see concretely how we combine the two, that is the best use of a demo.

These notes are general and do not constitute legal advice. On a specific case, in particular on the qualification of a processing operation or the scope of an obligation, rely on your lawyer or counsel.

Last updated: September 2026

Frequently asked questions

Can I use ChatGPT to draft a contract? Yes, to produce a first draft or explore wordings. No, for a document that commits your company without review: a general-purpose model knows neither your contractual playbook nor the specifics of your market, and it leaves no trace of its contribution. The first draft saves time; the decision must stay with a competent person and be traced.

Are my ChatGPT conversations used to train the model? It depends on the offering. On the enterprise offerings (Business, Enterprise, Edu) and via the API, OpenAI states in its public documentation that your organisation’s data is not used, by default, to train the models. On individual use, the frame is less protective, which is why an explicit internal usage policy matters. As these terms can change, check the version in force before you set your policy.

What is a DPA and why does it matter? A DPA is the agreement that frames the relationship between you, the controller, and your provider, the processor. OpenAI offers a DPA for the Business, Enterprise and API offerings, not for free use. Without a DPA, the processing of personal data by a supplier is legally precarious: it is the first document an auditor or your DPO will ask for.

Is ChatGPT GDPR-compliant? The question is decided by use, not in the abstract. OpenAI’s practices are designed to allow compliance, with a DPA, SOC 2 Type 2 and ISO certifications, and a processing framework handled in Europe by OpenAI Ireland Limited. The compliance of your processing then depends on your own documentation: legal basis, record, information of individuals, and an impact assessment if the risk is high. In other words, no tool is “compliant” in your place.

Am I covered by the AI Act if I use ChatGPT in my company? Yes. The European regulation on artificial intelligence, in force since August 2024, treats any organisation that uses an AI system in a professional setting as a “deployer”. The resulting obligations depend on the system’s risk classification: transparency and information of individuals most of the time, and, for high-risk systems, enhanced documentation and human oversight, with the timeline rolling out in stages.

What is the difference between a CLM and ChatGPT for contracts? ChatGPT is a general-purpose thinking assistant: it generates and rephrases, with no knowledge of your company, no memory of your portfolio and no traceability. A CLM applies your contractual playbook, traces validations, manages approvals, eIDAS-compliant electronic signature, deadline tracking and archiving. The two complement each other more than they compete: one explores, the other executes and proves.

Is it safer to use ChatGPT or a European CLM for a confidential contract? For a confidential contract, safety does not turn on the quality of the model but on the framework: where the data is hosted, who can trigger an analysis, what is removed before processing, and what the audit trail records. A European contract platform built for this use addresses these points by default, whereas a consumer tool leaves the responsibility to each user. The good practice remains to keep high-stakes documents in an environment that traces and documents the processing.