ChatGPT and client data: what Swiss wealth managers may and may not do

ChatGPT in the daily work of a wealth manager is unproblematic as long as no client data is involved. With client data, it belongs only in an environment with a business contract, a verified data location and a clear rule across the team. A blanket ban does not work, because employees use the tools anyway. What works: three clear rules and a secure alternative. This article covers both.

An example, fictional but close to everyday reality: an advisor receives an emotional email from a client after a weak month on the markets. He pastes the email, including the name and portfolio value, into ChatGPT and asks for a more diplomatic reply. The reply is good. The question remains: where does the data from that email sit now, and who else may read it?

Why does a ban not work?

Because it ignores reality. In the July 2026 study by the Lucerne University of Applied Sciences and Finup, 49 percent of surveyed wealth managers say they use AI, and 66 percent of those applications remain experiments, often with public tools (AI Use Cases and Crypto Assets in External Asset Management, July 2026). At the same time, 85 percent name data protection as the biggest hurdle. This combination means: the usage is already there, the rules are missing. A ban on paper changes nothing. It merely shifts usage to private devices and private accounts, where you see it least.

So my advice after many first conversations: govern the usage instead of banning it. That does not require a forty-page policy. It requires a simple classification every person on the team can apply, plus a secure alternative that covers the legitimate need behind the usage. And the need is real: less time on wording, faster summaries, better first drafts.

Which data may go where?

The most practical classification is a traffic light with three levels:

Level	What may go into the tool	Examples
Green	Public information and texts without personal reference	Market reports, statutes, professional articles, a LinkedIn post from your firm, your own writing without client reference
Yellow	Fully anonymised content	An email with the name, portfolio, institution and every combination of attributes that would allow identification removed
Red	Identifiable client data	Names, portfolio values, account statements, ID documents, tax records, meeting notes with personal reference

This traffic light works well as an office poster: one page, three rows, no exception debates.

Two remarks on the yellow level. First, anonymising is harder than it sounds: "my client, 58, an entrepreneur from Zug, is selling his company" identifies a person even without a name. Yellow means that even the combination of attributes must not reveal anyone. Second, checking whether a text is truly anonymous belongs to a second person, or at least to a second look with some distance. Whoever wrote the text overlooks their own clues.

Red, by the way, does not mean "AI forbidden." Red means: this data belongs exclusively in a protected environment, not in a public consumer tool. What that means in practice follows below.

Why is the free version delicate?

Three reasons, phrased carefully because provider terms can change and vary by plan and setting:

• Training: with free versions, your inputs may, depending on the provider and your settings, be used to improve the models. Whatever ends up in training is beyond your control.
• Storage location: processing typically happens on servers abroad. For client data from a wealth manager, that is delicate, because it raises the question of a disclosure abroad.
• Contract: a free account usually comes without a data processing agreement, the kind Swiss data protection law provides for when third parties process personal data (revised Federal Act on Data Protection, Fedlex).

The point is not that any particular provider is untrustworthy. The point is: with a free account you hold neither the contract, nor the data location, nor the training exclusion in your own hands. For green content, that does not matter. For everything else, it does.

What are the secure alternatives?

Three levels, in order of effort:

1. Business or enterprise plans from the well-known providers. These plans usually exclude training on your inputs by contract and include a data processing agreement. Check the current terms before signing, because they change. For many small teams this is the pragmatic first step, including for yellow content: because complete anonymisation can hardly ever be verified without gaps, a contractually secured setup pays off already at this level.
2. Models in Swiss data centres. Language models can now run in Swiss cloud regions, for example on Microsoft Azure in the Zurich North region. That keeps the data in the country, and the question "where does my data live?" gets a short answer. A comparison of the three hosting variants is in AI hosting in Switzerland.
3. Your own protected environment. An application that connects to your systems, controls access by role and logs every action. At this level even red content becomes possible, because contract, location and control sit with you.

Our own solution runs in a protected Swiss cloud on Microsoft Azure in Zurich North. "Where does my data live?" is guaranteed to come up in conversations with financial service providers, and it deserves a precise answer rather than a platitude.

How do large institutions secure their assistants?

In my advisory work with additiv I experience how insurers and neobanks set up internal assistants. The pattern is the same everywhere: the assistant does not run in the public tool but inside the institution's environment. Access follows the existing roles: whoever may not see a client in the CRM may not see that client in the assistant either. And every action is logged, so audit and supervision can later reconstruct what happened.

The small version of this for a five-person firm: a business plan instead of private accounts, a short written rule, a shared account with clear rights, and the agreement that client data only flows through the protected environment. That is decided in an afternoon and costs a fraction of what a single data incident would cost. How FINMA frames these expectations on governance and risk management, and which minimal version is enough for a small team, is explained in FINMA guidance 08/2024 explained.

From my practice: The most valuable step is rarely the technology but the honest conversation within the team. Once it is openly on the table who uses ChatGPT for what, the shadow usage disappears on its own, because there is a permitted, better alternative. In every firm that has had this conversation, the same surprise emerged: usage was more widespread than the management thought.

Five rules to take away

1. No client name, no portfolio value, no statement in a public tool. No exceptions, not even "just quickly."
2. Business use only under a business contract. A business or enterprise plan, data processing agreement, verified data location.
3. One written rule on a single page. What is green, yellow, red, and who decides in case of doubt. A template for exactly that: AI policy for financial SMEs to download.
4. Anonymous means truly anonymous. Check combinations, not just names, and when in doubt let a second person read it.
5. Review provider terms once a year. Providers change plans and data usage; one calendar entry is enough.

Note: We are not a law firm. All statements on legal and regulatory topics are subject to change and do not replace legal advice. For specific questions, please consult a lawyer.

Conclusion: your next step

Schedule a meeting with your team within the next two weeks and put the traffic light on the table. Ask openly who uses what today, without turning it into a reproach. Then adopt the five rules and the business plan. With that you are ahead of the majority of the industry, which, according to the study, is still in experiment mode. How to move from there to productive use cases is covered in AI for independent wealth managers: 7 use cases that work today. And if you would like to see a protected environment that keeps client data in Switzerland: on AI for wealth managers we show what that looks like in practice.

FAQ

Are we allowed to use ChatGPT at all?

Yes, for public content and texts without personal reference. It becomes delicate with client data: that belongs only in an environment with a business contract, a verified data location and training excluded. Which variant fits your firm depends on your setup; see the note above.

What does this mean for professional secrecy?

This is where it gets serious: professional secrecy for financial service providers is criminally protected. Under Art. 69 FinIA, a breach can carry up to three years of imprisonment. As soon as client data leaves your control, for example on servers outside your contract, exactly that question arises. How far the duty reaches for your firm in detail depends on your legal form and activity. Clarify this with a specialist before approving data flows.

Is deleting the name enough?

Usually not. Combinations of age, location, industry and event identify people reliably. Anonymising means removing every possible clue, not just the name.

What does a secure variant cost?

A business plan sits in the double-digit franc range per person per month. Your own protected environment is a project; the orders of magnitude are in the article What does AI cost for financial service providers?.

Do I have to inform my clients when I use AI?

That depends on what the AI does with which data. Processing personal data through third parties can trigger information duties; the FDPIC publishes guidance on this (edoeb.admin.ch). The ten most important duties at a glance: revFADP checklist for financial firms. For your specific case, the note above applies: legal questions belong with a lawyer.