Is ChatGPT safe for insurance agency client data?

It depends on the plan, the setting and what you paste in. Until you have read the terms of your exact plan and written a staff rule, keep names, policy numbers and claim details out.

Key points

Safety depends on the plan, the settings and what staff paste in.
Business plans sit under a contract. Consumer accounts can follow different terms.
Until you have read the terms and written a staff rule, keep names, policy numbers and claim details out.
Your firm stays responsible for its clients' data, and a named person stays accountable.

Is ChatGPT safe for client data?

No general assistant is safe or unsafe in itself. Safety depends on four things: the plan you use, its settings, the terms in your contract and what staff paste into it. An agency (the UK word is brokerage) is responsible for its clients' data whichever tool touches it. This page is general information, not legal advice.

What is the difference between consumer and business plans?

Consumer plans are usually personal accounts with settings you manage yourself, and business plans are covered by a contract between the maker and your firm. Four makers' own pages show the pattern, read on 5 November 2026. Terms change, so check the date on the page.

Maker	What its page says	Source
Anthropic	It may use consumer conversations to train its models unless you opt out in settings, and its business customers' content falls under customer agreements. Policy effective 10 September 2026.	Anthropic privacy policy
OpenAI	For individual services such as ChatGPT, it may use your content to train its models unless you opt out. For business services (it names ChatGPT Team, Enterprise and the API), it says it does not train on inputs or outputs by default, and that a Data Processing Addendum, a contract on how it handles personal data for you, is available. Pages dated 8 January and 13 March 2026. Its help page on data controls, read on 5 November 2026, says that on personal Free, Plus and Pro workspaces data sharing is on by default, you can turn off “Improve the model for everyone” under Settings, Data controls, and thumbs up or down feedback may send the whole conversation for training. The page lists exceptions, so read it.	OpenAI enterprise privacy, how data improves models and data controls in ChatGPT
Microsoft	For Microsoft 365 Copilot, "Prompts, responses, and data accessed through Microsoft Graph aren't used to train foundation LLMs."	Copilot privacy page
Google	For Workspace, "Your data is your data, and it’s not used to train Gemini models or for ads targeting."	Workspace AI page

Anthropic's consumer policy has an opt-out, but it says conversations flagged for safety review or reported to Anthropic can still be used. None of these pages answers "is it safe for my client data". They answer the narrower question of whether the maker trains on it. You still have to think about who inside your firm can see the data, where it is stored, and whether you may share it at all.

What should staff never paste into an AI tool?

Staff should never paste anything that identifies a client or reveals their circumstances into a tool the firm has not approved.

Names, contact details and dates of birth
Policy numbers, claim numbers and bank details
Health, financial or claims history details about a person
Passwords, login links and access codes
Insurer documents marked confidential or subject to a non-disclosure agreement

A name is not the only identifier: an unusual address, date and loss can identify a person. When in doubt, describe the situation in general terms.

What do these words mean?

These are the terms this guide uses, in plain words.

Personal data: Any information that identifies a living person, or could be used to. US law usually says personal information.
Professional indemnity: Insurance for claims that your advice or work was wrong. The closest US cover is errors and omissions (E&O), though the two are not identical.

What does a short staff policy look like?

A short staff policy fits on one page and answers who, what, where and what to do when something goes wrong.

Use only the AI tools on the approved list, on the business plan the firm pays for. No personal accounts for work.
Do not enter client names, contact details, policy numbers or claim details into any tool that is not on the list.
Check every AI output against the original document before it goes to a client or an insurer. The person who sends it is responsible for it.
Do not use AI to make or announce an insurance decision. A named person does that.
Tell the office manager at once if something sensitive was pasted by mistake.
The owner reviews the list of approved tools and their terms every six months, and whenever a maker changes its terms.

What do the rules say, and who should I ask?

The rules say that your existing duties still apply when AI is involved, and that a named person stays accountable. This section is not a full legal map, so take it to someone qualified.

United Kingdom. The FCA, which regulates UK financial firms, says on its page on its approach to AI (first published 8 September 2025): "We do not plan to introduce extra regulations for AI. Instead, we'll rely on existing frameworks, which mitigate many of the risks associated with AI." Data protection questions go to the Information Commissioner's Office (ICO), the UK data protection regulator, or your data protection adviser. The ICO publishes guidance on AI and data protection, updated on 15 March 2023, which it now says is under review because of the Data (Use and Access) Act. On accountability it says overall accountability for data protection compliance lies with the controller, your organisation, and that you cannot delegate these issues to data scientists or engineering teams.

European Union. The GDPR (the EU data protection law) applies to personal data in any tool. Its Article 28 says that when a firm (the "controller") has another party (the "processor") handle personal data for it, the firm must use only processors that give sufficient guarantees, and a contract must govern the work. An AI maker handling client data for you is usually a processor, depending on the arrangement. EIOPA, the EU insurance supervisor, published an opinion on AI governance and risk management on 6 August 2025. It is addressed to national supervisors, not to firms. Ask your data protection officer or your national data protection authority how it applies to you.

United States. Insurance is regulated state by state. The National Association of Insurance Commissioners (NAIC) publishes a model bulletin on insurers' use of AI, and its AI page links a map of which states have adopted it. That page says that when insurers use AI, "they remain responsible for complying with insurance laws, regulations, insurance standards, and consumer protection rules." The NAIC adopted the model bulletin on 4 December 2023. It is addressed to insurers, so it does not bind a broker directly, and it is a model for a jurisdiction to issue. It asks insurers to cover AI systems developed by a third party in their AI programs. Whether and how your state has adopted it varies, so ask your state regulator or your compliance adviser. Insurers you place business with may ask you about your AI use (our inference, not a rule in the bulletin).

Who to ask: your compliance officer or compliance consultant, your professional indemnity insurer or broker, your trade body, a solicitor who knows data protection, and the maker of the tool.

Should I tell clients we use AI?

Often yes, but whether a rule requires it depends on how you use the AI and where you work. Where AI handles a client's personal data in the EU, Article 13 of the GDPR says you must tell the person, when you collect it from them, the purposes of the processing and "the recipients or categories of recipients" of the data. An AI maker that handles the data for you is a recipient (our reading), so your privacy notice should say so.

In the UK, the ICO's transparency guidance says you need to be transparent about how you process personal data in an AI system. Your privacy information should include your purposes for processing, your retention periods and who you will share the data with. If you collect data directly from people, give it to them at the time you collect it, before you use it to train a model or apply a model to them. From other sources, give it within a reasonable period and no later than one month.

For US firms, and for AI that talks to clients or helps decide something about them, the rules differ by country and state. Ask your compliance contact. Our view, as sensible practice and not a rule: say in your privacy notice that you use AI tools, what they do and that a person checks the work, and tell clients plainly when they are talking to a machine.

What do I do next?

Write the one-page staff rule, list the tools your team already uses (including personal accounts), and read each one's terms. Our 90-day AI plan for a small agency places this step before any trial. For safe first uses with no client data, see the guide to using AI in an insurance agency. The main guide to AI for insurance brokers links the rest.

Where Navicade fits

Navicade builds and runs AI systems that do work the office does by hand. A free 30-minute call and a free operations map of where your hours go come first, and we take on one agreed task at a time. Insurance decisions stay with your team, and the system checks its work on every run.

A beginner may not need us yet. A written rule and a business plan with terms you have read are the first steps and cost little. When you are ready to talk about a repeating job, ask for the free call and map.