AI and professional secrecy: what uses are allowed?
Yes, you can use generative AI in a profession bound by professional secrecy, as long as no protected information leaves the environment you control. In practice: no client or patient file in a consumer tool, and yes to work on anonymized data or inside a contractually secured environment. This article explains where the line sits, profession by profession, and how to write it into an AI policy.
It is aimed at law firms, accounting and consulting practices, healthcare professionals, and any organization that handles information entrusted in confidence. It builds on the complete guide to AI in business for SMEs and on the article about data confidentiality with AI.
Why professional secrecy changes the game with AI
Professional secrecy is a criminal-law obligation, not a mere good practice: breaching it as a person bound by it is punished under article 226-13 of the French Criminal Code. The text provides for up to one year of imprisonment and a 15,000 euro fine, on top of the disciplinary consequences specific to each profession.
What makes AI tricky is the mechanism. When you paste a text into an online assistant, you send it to a third-party provider, often outside the European Union. Depending on the plan and settings, that provider may store the exchange, have humans review it for safety, or even use it to train its models. Your client never authorized that. From a secrecy standpoint, this is a disclosure, even if nobody ever reads the message.
The trap is that the gesture feels harmless. Rewording a letter, summarizing a procedural document, formatting meeting notes: each takes thirty seconds, and each can contain a name, a diagnosis, an amount, a strategy.
What secrecy actually covers (and what it does not)
Secrecy covers everything a client or patient has entrusted to you, and also what you saw, heard or understood while practicing your profession. It is not limited to documents marked "confidential".
In a law firm, that includes the documents, but also the client's financial situation, their intentions, and the very fact that they consulted you. In a medical practice, the mere fact that someone is followed by a practitioner falls under secrecy. The exact boundaries depend on the profession: the secrecy of a lawyer, a doctor, a notary or an accountant differs in source and in exceptions.
What secrecy does not cover: your own generic content. A contract template without names or amounts, an article outline, a presentation structure, or a tracking table without personal data can go through an AI tool without particular difficulty.
Allowed uses, uses that need precautions, uses to rule out
The right lens is the data, not the tool: the same assistant can be acceptable for one use and off-limits for another. Here is a working reference, to adapt to your profession.
| Use | Example | Position |
|---|---|---|
| Content with no entrusted data | Standard letter template, internal training outline, article ideas | Allowed |
| Truly anonymized data | Clinical or legal case where identification is impossible | Allowed, with a method |
| Identifying data in a secured tool | Business contract with contractual guarantees and controlled hosting | Possible after analysis |
| Identifying data in a consumer tool | Pasting a client file into the free version of a chatbot | Rule out |
| Health data outside a suitable framework | Patient report submitted to a general-purpose assistant | Rule out |
The catch on the "anonymized" row: removing the name is not enough. A file that mentions a small town, a rare profession and a precise date remains identifiable. Serious anonymization means generalizing details, not just deleting names. If in doubt, treat the data as identifying.
Lawyers, healthcare, accountants, consultants: how professions differ
Each profession has its own regime, and professional bodies are gradually publishing their own guidance on generative AI. The French National Bar Council adopted a guide on ethics and artificial intelligence on 17 March 2026, which notably restates the protection of professional secrecy and compliance with the GDPR. Read it directly for the operational detail.
In healthcare, the French National Authority for Health and the CNIL opened a consultation in February 2026 on a draft guide on the use of AI in care settings, with dedicated sheets on governance and generative AI. It was a provisional version: check whether a final version has been published before relying on it. Health data also falls under the special categories of data in the GDPR, with stricter requirements, notably on hosting.
For accountants and consulting firms, the subject is less governed by a single text than by the combination of secrecy, confidentiality clauses signed with clients, and the GDPR. The client contract often sets the strictest rule: reread your engagement letters and non-disclosure agreements before deciding.
How to frame AI use in your organization
The most reliable method comes down to four written decisions: which tools, which data, who decides, and how you check. In a small organization, it fits on two pages.
- List the AI tools actually in use, including those that team members installed on their own. This is the shadow AI issue, and it is usually where the main risk sits.
- Sort your data into three levels: free, confidential, covered by secrecy. Only the first level can go unconditionally into a consumer tool.
- Choose one or two approved tools, with a professional contract that specifies data retention, location, no training on your content, and a GDPR data processing agreement.
- Appoint a lead, even part-time. AI governance in an SME does not need a committee; it needs one person who answers when a colleague hesitates.
For verification, remember that AI sometimes produces wrong answers stated with confidence, what is called a hallucination. In a regulated profession, reviewing and validating every output remains mandatory: the tool assists, it does not replace your professional responsibility.
The most common mistakes
Secrecy breaches with AI rarely come from a decision; they almost always come from a habit. A few typical cases:
- pasting an excerpt of a file "just to reword it", with the client's name still visible;
- using a free personal account because the company tool feels too slow;
- uploading a client meeting recording to an unapproved transcription service;
- keeping the conversation history without knowing where it is stored or who can access it;
- assuming a "paid" tool is automatically confidential, without reading the terms.
Conversely, an organization that bans everything often gets the opposite effect: the uses continue, but hidden. A clear and usable framework beats a ban nobody enforces. On the ownership of generated content, see also the article on AI and intellectual property.
Frequently asked questions
Can I use ChatGPT, Claude or Gemini with client files? Not in their consumer versions with identifying data. A professional plan with contractual guarantees can change the analysis, but the decision comes after reading the terms and, depending on your profession, your professional body's guidance.
Does anonymizing lift the secrecy? Only if the person can no longer be identified, including by cross-referencing. Removing the name is not always enough. If in doubt, treat the data as identifying.
Can the client authorize AI use on their file? In some cases an informed, written agreement from the client can help, but it does not waive the GDPR or the rules of your profession.
What if a team member has already pasted confidential data into a tool? Document what was sent, delete the history if the tool allows it, check the provider's retention terms, and consult your data protection officer or your counsel. Depending on the data, a notification may be required.
Does an AI assistant hosted in Europe solve the problem? It reduces some risks, notably around data transfers, but it does not remove the duty to control what is sent to it, nor the need for a contract with the provider.
Should teams be trained? Yes, it is the most effective lever: most slips come from not knowing what happens to a text pasted into an online tool.
How GrowthPerf can help
GrowthPerf is a Qualiopi-certified training organization. For organizations bound by secrecy, we work in two stages: an audit of AI usage to identify what really circulates, then team training, such as the AI for business training or the operational AI course, with practical cases built on your own confidentiality rules. To put the topic back into a global approach, revisit the guide to AI in business.
If you want to frame AI use in your organization, book a 30-minute call with GrowthPerf to review your tools and your data.