ChatGPT Enterprise and Codex for Legal

ChatGPT Enterprise is OpenAI's business version of ChatGPT, an AI assistant your team reaches through chat, with admin and security controls built for organizations. Codex is OpenAI's cloud-based software engineering agent that writes, reviews, and debugs code, available to ChatGPT Business and Enterprise users.

ChatGPT Enterprise differs from the consumer version in ways that matter for a law firm or legal department. OpenAI states it does not train its models on your business data by default, encrypts data at rest and in transit, is SOC 2 compliant, and adds an admin console with SSO, SCIM, and domain verification.

Legal teams care because attorney-client privilege and matter confidentiality do not tolerate careless disclosure. AI can speed up drafting and research, but it should never handle privileged matter details without a plan for who else can see them.

What ChatGPT Enterprise and Codex Actually Are

ChatGPT Enterprise is a chat assistant your team can use to draft correspondence, summarize discovery documents, and answer research questions inside one managed workspace.

Codex is a separate coding agent for technical teams. Most attorneys and paralegals will not use it, but it can help legal-ops or e-discovery teams that build or maintain their own tooling.

• ChatGPT Enterprise: drafting, summaries, and legal research support
• Codex: a coding agent for developers, on Business and Enterprise plans
• Both run under your account and your admins' controls

How Your Data Is Handled

OpenAI states it does not use ChatGPT Enterprise business data, inputs, or outputs to train its models by default, which matters when matter details or client communications are involved.

ChatGPT Enterprise encrypts data at rest with AES-256 and in transit with TLS 1.2 or higher, is SOC 2 compliant, and offers data residency options on eligible plans.

• Business data is not used for model training by default
• Encryption at rest (AES-256) and in transit (TLS 1.2+)
• SOC 2 compliance and regional data residency on eligible plans

Privileged Work Stays With a Lawyer, Not the Tool

Decisions that turn on legal judgment — how to characterize a fact, what strategy to recommend, what a client should be told — carry malpractice and disciplinary risk. AI should not make these calls.

A less obvious risk sits in how the tool is used, not just what it outputs. Under ABA Model Rule 1.6 on confidentiality, disclosing privileged material to an outside party can waive privilege even when the vendor never reads it — the exposure comes from where the data physically goes and who is contractually entitled to it, not from human eyes. Treat any AI vendor the way you would treat outside counsel's document vendor: confirm the data-processing terms in writing before privileged matter content goes in.

Use AI to draft and summarize, then keep a licensed attorney responsible for any conclusion, filing, or client-facing statement.

• Do not let AI decide legal strategy or draw legal conclusions unsupervised
• Confirm data-processing terms in writing before privileged content goes in
• Keep an attorney accountable for every filing and client communication

Practical, Lower-Risk Uses

Start with research and drafting tasks that a lawyer will fully review before anything leaves the firm. Summarizing case law, drafting first-pass correspondence, and outlining discovery requests are good early uses.

Keep client-identifying or highly sensitive matter details out of the tool until your engagement terms and the vendor's data-processing agreement allow it, and review every client-facing output.

• Summarize case law and public filings for internal review
• Draft first-pass correspondence and discovery requests
• Outline research memos for an attorney to verify and finish
• Hold client-identifying matter details until your data terms allow it

Controls to Set Before You Roll Out

Use the admin controls in ChatGPT Enterprise to govern access by practice group and matter type.

Add a policy that draws a clear line: AI assists with drafting and research, attorneys own legal judgment, and every client-facing output gets reviewed.

• Turn on SSO and SCIM so access follows your directory
• Verify your domain and assign admin roles by practice group
• Write a policy separating AI drafting from attorney judgment calls
• Keep usage analytics on so admins can show who used the tool and when

How Layer3 Labs Helps

Layer3 Labs helps law firms and legal departments use AI for drafting and research without drifting into unsupervised legal judgment or an unreviewed privilege waiver.

We turn OpenAI's enterprise terms into a rollout plan that keeps a licensed attorney accountable for every matter while the team moves faster on the drafting and research that eats the most hours.

What you need to run ChatGPT Enterprise and Codex for legal

The first question most legal teams ask is whether their current setup can handle ChatGPT Enterprise and Codex. For the standard cloud version, the answer is usually yes: ChatGPT Enterprise and Codex runs on the provider's servers, so the computers and internet connection you already have are enough to start — there is no server to buy and nothing to install across the firm.

What you do need is two things: access (a business plan or the API) and a tool to work in. Whoever wires ChatGPT Enterprise and Codex into your workflows will move fastest inside an AI IDE — Cursor is the most popular and connects to ChatGPT Enterprise and Codex directly — while the rest of the team uses ChatGPT Enterprise and Codex's own apps day to day.

The exception is compliance. If attorney-client privilege and matter confidentiality mean client data cannot leave your systems, the cloud version is off the table and you move to a private, on-prem setup: self-hosting an open-weights model on hardware you control. In practice that is a workstation with a strong GPU (an NVIDIA RTX 4090 build) or a large-memory Mac Studio for mid-size models, or RunPod to rent the same power by the hour. Our open-weights models for business guide walks through the full build.