Is It Safe to Upload Board Papers to ChatGPT or Claude?

Board papers hold some of an organisation’s most sensitive material. This is true for listed companies, housing associations, universities, NHS trusts and other organisations. Board packs often include financial information, legal advice, patient data and tenant records.

Many teams now use generative AI tools such as ChatGPT and Claude to help with this work. However, it isn’t safe to upload papers to a free account, since free tools can store and train using your data. This guide explains the risks and what to do with board material, as of 2026.

What happens when you upload a board paper to ChatGPT or Claude?

This depends on which version you use. Free accounts can store your prompts and may use them to train future models by default, unless you turn this off. Anthropic confirms this for Claude, and OpenAI applies the same default to free ChatGPT accounts. A paper pasted into a personal account could shape answers given to other users later. The Information Commissioner’s Office has given warnings about this kind of risk.

Paid enterprise or API plans work differently. Providers can agree terms that block training on your data. A 2026 Upper Tribunal ruling said that uploading confidential documents to an open-source AI tool such as ChatGPT places them in the public domain, which breaches confidentiality and waives legal privilege. You should treat a free tool and a paid tool as different products.

Can uploading board papers to AI break legal privilege?

Yes, it can. The Upper Tribunal ruling above found that uploading confidential material to an open-source AI tool breaches confidentiality and waives privilege and said this kind of conduct should also be reported to the Information Commissioner’s Office. Board papers often carry legal advice on disputes or deals, so check the tool type first.

What does UK GDPR require before you upload board papers to AI?

UK GDPR needs a lawful basis before personal data goes into an AI tool, and in most cases a Data Protection Impact Assessment first. The Information Commissioner’s Office says AI use with personal data is usually high risk. Board papers often name people, so this matters in every sector. Article 5 of the UK GDPR sets a duty to keep data secure, and Article 32 adds a duty to use the right technical and organisational security measures.

Do board members have a duty of confidentiality that AI use could break?

Yes. Directors, trustees and governors all owe a duty of confidentiality to the body they serve. For company directors, this duty comes from common law, and it sits alongside the general duties set out in sections 171 to 177 of the Companies Act 2006, such as the duty to act in the company’s interests.

Trustees, governors and NHS board members owe similar duties under their own rules. Uploading a board paper to an open AI tool could break this duty, since you lose control of where the data goes.

What do UK governance codes require on internal controls?

Four UK frameworks now ask boards to check their risk management and information security controls. Listed companies must declare controls effective under Provision 29 of the Financial Reporting Council‘s UK Corporate Governance Code, from 2026. Universities face a similar duty under the new Committee of University Chairs Code, published 17 June 2026.

Housing boards must meet the Regulator of Social Housing’s Governance and Financial Viability Standard. NHS bodies must complete the NHS Data Security and Protection Toolkit each year, due 30 June 2026. AI use falls inside all four checks.

What should you do before you use AI on board papers?

Check a tool’s contract terms first. Ask if it uses your data to train and where it stores it, and use only paid, enterprise tools for board papers.

Run a Data Protection Impact Assessment where personal data is involved and write a short AI use policy that sits alongside your wider cyber security policies. Keep a list of approved tools. This does not mean avoiding AI. It means knowing which version you use and why.

Conclusion

Board papers are not ordinary files, in any sector. Free AI tools bring real risks around data storage, training and legal privilege. UK GDPR, director duties and the new governance codes for companies, universities, housing bodies and the NHS all point the same way. Check a tool’s terms before you upload a single board paper.

How can boards use AI without losing control of board papers?

Convene gives your board a closed, secure Document Library, minutes and votes. Your data stays inside a controlled system, so you do not need a public chat tool.

Convene also has AI features built into the portal itself, so board papers never need to leave this secure system to get AI support. Convene includes AWS hosting, AES-256 encryption, multi-factor authentication, SOC 2 accreditation and ISO 27001, 27017 and 27018 certified hosting facilities, alongside GDPR compliance. This gives your board the speed of digital tools without the risks this guide has covered.

To see how this works for your board, book a demo today.

FAQs

Is it safe to upload board papers to ChatGPT?

No, not on a free account. Free ChatGPT can store and train on what you upload, so use an enterprise tool instead.

Does uploading a document to AI break legal privilege?

Yes, it can. A 2026 Upper Tribunal ruling found that uploading confidential material to an open-source AI tool such as ChatGPT breaches confidentiality and waives privilege and said this should be reported to the Information Commissioner’s Office.

Does Convene stop AI tools from using board data?

Yes. Convene does not put your board papers through a public AI tool, so there is no risk of your data shaping an outside model. This is one of the main risks this guide has raised about free ChatGPT and Claude accounts.

Who can access board papers stored in Convene?

Only people you approve. Convene uses access controls and audit trails, so you can see who viewed or changed a board paper and when.