Aureus Sovereign › Briefings

Can a confidential board pack go into ChatGPT?

It is the first question a director asks, and it has a definite answer. Four things decide it, and all four are checkable before the next pack arrives.

Published 14 September 2026

The short answer. Not the ordinary consumer product, and not without settling two of the four questions below. On a business or enterprise agreement, with the processing location known and the category of material established, it is frequently permissible — and the organisation should be able to say which of those applies before anybody submits anything.

What follows is the sequence that settles it. None of it requires technical knowledge, and all of it can be answered by the technology function, the vendor's contract, or the company secretary.

1. Which product, on which terms

The distinction that matters is not the brand. It is the tier. Consumer and business tiers of the same service routinely differ on two points that decide this question entirely: whether submitted content may be used to train the provider's models, and how long it is retained.

The questions to put to whoever holds the agreement:

• Does the agreement exclude submitted content from model training? Business and enterprise agreements commonly do. Consumer terms commonly do not, and a personal account used for work sits under consumer terms regardless of who is typing.
• What is the retention period, and can it be set to zero? Retention for abuse monitoring is ordinary. Indefinite retention is a different proposition when the material is a draft transaction.
• Who at the provider can read it, and under what circumstances? There is usually an answer, and it is usually narrower than people fear and broader than they assume.

An organisation that cannot answer these three has not yet established whether it may use the service at all, which is a procurement question rather than an AI question.

2. Where it is processed

Material submitted to a service is processed somewhere, under that jurisdiction's law and that provider's obligations to its own regulators. For a Hong Kong organisation the relevant questions are which jurisdiction, whether the agreement permits it to change without notice, and whether any onward transfer occurs.

This is the question most often skipped, because the answer is rarely visible in the interface. It is in the contract, and the contract is usually available.

3. What the material actually is

"Confidential" covers several categories that carry different consequences and, importantly, different decision-makers. A board pack frequently contains more than one.

4. What the organisation has already promised

The most common reason the answer is no has nothing to do with data protection law. It is that the organisation has already given somebody an undertaking about how their material would be handled, in an engagement letter, a non-disclosure agreement or a client agreement signed years earlier, and nobody has read it against this question.

Those undertakings usually predate these services entirely. That does not make them inapplicable; it makes them unexamined.

The two errors that recur

Treating the question as binary. It is not whether the organisation "uses AI". It is which material, on which tier, processed where. A pack that cannot be submitted whole may be perfectly submittable once an annex is removed, and that distinction is worth establishing rather than defaulting to no.

Asking the technology function to decide it. Three of the four questions above are legal, contractual or disclosure questions. The technology function can answer where it is processed and on what terms; it cannot decide whether submitting an unannounced result is appropriate.

Where the answer is no regardless

Some matters cannot be submitted to an external service under any terms: a live transaction, a regulator's file, material under privilege where counsel has advised against it. Where that applies, capable models can be operated on equipment held at the organisation's own premises with no network path out, so that processing occurs within the room the material is held in. It is not required for most work, and where it is not needed the practice says so.

What to settle before the next pack

• Establish the tier and read its terms on training and retention. One question to procurement.
• Establish the processing jurisdiction. One question to the same place.
• Have the company secretary mark which categories a typical pack contains. An hour, once.
• Have somebody read the standing undertakings against this question. This is the one that produces surprises.

An organisation that has done those four can answer the question in a meeting rather than deferring it, which is the actual objective. Most cannot, and the deferral is usually mistaken for caution.

This briefing sets out questions, not requirements. What the Personal Data (Privacy) Ordinance, a listing obligation or a contractual undertaking requires of a particular organisation is a matter for that organisation's own advisers.