ChatGPT for Business Use: Information Governance Considerations

ChatGPT has generated enormous interest since OpenAI released it in November 2022. By providing a user-friendly and conversational interface to an LLM (i.e., a large language model -- a form of generative AI technology), ChatGPT has put a powerful but not-yet-fully-understood technology into potential widespread use.

This situation replays a scenario we saw earlier in 2022 with the release of AI image generators such as DALL-E, Midjourney, Stable Diffusion, and others. The ability of ChatGPT to generate fluent natural language prose, however, makes it more likely to be used in a business context, perhaps sometimes beyond its capabilities.

As a result, company and organization general counsel and chief legal officers, compliance departments, and records and information management professionals now have a new information governance challenge: managing the business use of ChatGPT within their organization.

Some of the issues with ChatGPT are common to the use of any LLM in a business setting:

• Does the organization know who is using ChatGPT and for what business functions?
• Do employees using ChatGPT to generate documents understand the limitations of the technology (in particular, its tendency to generate fluent but factually incorrect text)?
• What data is (or should be) retained in the organization’s systems about documents that were created using ChatGPT? For how long?

Other concerns are particular to ChatGPT and its conversation-style user interface:

• What information, if any, does OpenAI retain about queries made to ChatGPT?
• Can historical chats be associated with our employees in the future?
• Is information given to ChatGPT confidential?
• What are the privacy implications of using ChatGPT, especially for users in states with comprehensive data privacy laws?
• How secure is the information at ChatGPT?
• Are ChatGPT sessions subject to discovery in litigation?
• Are there issues particular to the use of ChatGPT by lawyers?

Organizations may conclude that their internal policies do not fully address these or other issues particular to their company or industry. ChatGPT may be the first broadly accessible LLM tool, but other such tools, and new forms of generative AI, are expected to rapidly follow, bringing with them new issues. For example, indications are that Microsoft may soon begin incorporating OpenAI technology into widely used tools such as M365.

The lawyers and advisors at our Firm and our colleagues at Redgrave Data stand ready to assist companies and other organizations in developing policies designed to address the information governance issues associated with ChatGPT and other generative AI tools. For more information please contact Dave Lewis at dave.lewis@redgravedata.com, Chris King at cking@redgravellp.com, or Amanda Moeller at amoeller@redgravellp.com.

The views expressed in this article are those of the authors and not necessarily those of Redgrave LLP or its clients.

By Dave Lewis, Redgrave Data, and Staci Kaliner, Chris King and Amanda Moeller, Redgrave LLP