ChatGPT Business Export Limits Create Discovery Risks for Law Firms

This article is for legal-operations and procurement analysis, not legal advice. It reflects materials available as of July 25, 2026. ChatGPT plan names have also moved underfoot: OpenAI has used “Team” and “Business” in ways that are not always cleanly separated in public discussions, so the tier discussed here as Business/Team refers to the law-firm workspace plan positioned between individual subscriptions and Enterprise.

The procurement mistake is easy to make. A law firm rejects Free, Plus, or Pro accounts because lawyers should not be putting client material into consumer software. It sees ChatGPT Business as the prudent middle tier: workspace administration, commercial terms, and no-training-on-customer-data language. Then the discovery question arrives: can the firm export the chat history it may need to preserve, review, and produce?

The answer is the problem. OpenAI’s native export position, as reported in coverage of the issue, is that “Export Data is not available for ChatGPT Business or Enterprise workspaces,” while individual Free, Plus, and Pro users can export a ZIP file from data controls; the same reporting described an unofficial “scrapemychats” workaround and noted that it may violate OpenAI’s terms of service.[1] For law firms evaluating ChatGPT Business export and chat-history use, that is not a minor usability footnote. It is the line between a managed workspace and a collectable record.

The Tier Comparison That Should Come Before Purchase

Price does not track discovery readiness. Neither does the presence of an admin console. A subscription can be commercially sensible, privacy-improved, and still leave the records team without a native export path when a litigation hold is issued.

The Business/Team row is the one that deserves the red ink. Free, Plus, and Pro are visibly wrong for most confidential law-firm work because they are individual consumer tools. Business is more subtle. It supplies enough governance language to pass a quick procurement screen, but not the export capability that a litigation-support manager will need when the question changes from “Is the tool approved?” to “Collect everything responsive from these users for this period.”

Export Is a Preservation Control, Not a Convenience Feature

In a law-firm setting, chat history is not just a user preference or productivity artifact. It may record client facts pasted into a prompt, attorney work product, research paths, drafting instructions, privileged strategy, or nonprivileged business communications. Some of that material should never have entered the tool. Some of it may still become relevant once it has.

Federal discovery does not ask whether a vendor dashboard looked compliant during procurement. Rule 26 frames the scope and proportionality of discovery, while Rule 34 requires a party to produce electronically stored information in a usable form when it is within the party’s possession, custody, or control. ABA Model Rules 1.1 and 1.6, and ABA Formal Opinion 512’s emphasis on reasonable efforts to prevent unauthorized disclosure when using generative AI, make the same operational point from a professional-responsibility angle: lawyers need enough technical understanding to protect client information, not just a signed subscription order.[2]

That is why “we can subpoena OpenAI if we ever need it” is not a collection strategy. The Stored Communications Act limits what a provider can disclose in response to a civil subpoena for user content, and trial-court decisions such as Flagg v. City of Detroit and Al Noaimi v. Zaid are commonly cited for the practical consequence: parties generally must obtain and produce their own cloud-held communications rather than expecting the service provider to hand over content directly in civil discovery.[5] No U.S. court of appeals has turned that into a ChatGPT-specific discovery rule as of July 2026, but the procurement lesson does not need an appellate AI-chat case. If the firm cannot collect its own records, the gap is already operational.

The NYT v. OpenAI preservation order adds another caution, but not a clean answer. The May 13, 2025 SDNY order required OpenAI to preserve output log data for certain consumer, Plus, and Team categories, including deleted chats, while Enterprise was treated differently in public analysis of the order.[3] That is a preservation obligation on OpenAI in a particular lawsuit, not a general-purpose production service for law firms using ChatGPT. It also undercuts a comfortable assumption: deletion, retention, and legal hold behavior can change under litigation pressure.

Why Business/Team Creates False Confidence

Business/Team is attractive because it answers the first questions procurement usually asks. Is there a workspace? Are users centrally managed? Is customer data excluded from model training by default? Are we avoiding the consumer-account problem? The Oklahoma Bar Association’s 2026 discussion of ChatGPT’s Business Plan and confidentiality treated subscription assessment as a concrete professional-duty exercise rather than a marketing comparison, and that is the right frame.[2]

But a confidentiality improvement does not become a discovery workflow. A workspace admin may be able to invite and remove users, but removal is not collection. A no-training term may reduce one category of confidentiality risk, but it does not produce a Rule 34-ready archive. A clean vendor answer about data use may still leave the records team with screenshots, manual copying, or an unofficial scraper when the firm needs a defensible export.

The unofficial scraper is useful only as evidence of demand. The Register’s July 23, 2026 coverage described a GitHub tool built to pull chats where OpenAI did not provide export, while warning that the workaround may violate OpenAI’s terms and could be blocked.[1] A law firm should not build its preservation policy around a tool whose defensibility depends on scraping a user interface the vendor can change.

The naming instability makes this worse. A firm may have purchased “Team,” renewed into “Business,” or read help-center language that uses one label while a community thread uses another. The verification question should therefore be phrased without relying on the label: for this workspace, can an authorized firm administrator export user chat content and metadata in a reviewable format without user-by-user cooperation or an unsupported workaround?

Enterprise Has to Be Verified, Not Assumed

Enterprise is the only ChatGPT workspace tier in these materials that can support a serious preservation-and-production workflow through the Compliance API. That sentence is deliberately narrow. Enterprise purchase alone does not preserve anything. It gives the firm a feature set that still has to be enabled, scoped, permissioned, monitored, and archived.

Public legal and workplace-analytics discussions describe the Enterprise Compliance API as a route to JSONL activity logs, with near-real-time or minutes-level availability, SOC 2 Type II context, and a limited retrieval window that can be as short as 30 days unless the organization exports and stores the records elsewhere.[3][4] That 30-day window is not a technical curiosity. Once a litigation hold is reasonably anticipated, a firm that waits for a quarterly governance review may already have allowed responsive AI-chat records to disappear from the available API window.

The Verification Workflow

Before procurement, renewal, or firmwide rollout, the verification meeting should produce evidence, not assurances. The right artifact is a short record showing who tested the workflow, what was pulled, where it was stored, who can access it, and how often it repeats.

1. Confirm that the Compliance API is enabled for the actual Enterprise workspace, not merely available in the plan description.
2. Run a test export and identify whether the firm receives conversation content, metadata, or both.
3. Decide whether routine archiving should collect content logs or metadata-only records; Worklytics’ July 2026 guidance recommends metadata-only export in some workplace analytics contexts to reduce retention, access-control, and GDPR exposure, but discovery needs may require a different choice.[4]
4. Assign access rights before the first real hold: records, litigation support, security, and designated legal reviewers should not be negotiating credentials after a complaint arrives.
5. Schedule periodic archiving inside the available retention window and log failures as compliance incidents, not ordinary IT noise.

The hardest decision is usually export scope. Content logs may be necessary when prompts and outputs are themselves relevant, but they also create a sensitive internal repository of client facts, privileged material, and lawyer work habits. Metadata-only records reduce some exposure, but they may not answer a later request for what was actually submitted to or generated by the model. That choice belongs in a records and discovery policy, not in an engineer’s unreviewed integration script.

Law firms updating litigation-hold practices for generative AI have begun treating AI chat logs as a category that may need explicit preservation rather than a novelty outside the hold process.[6][7] The hold notice should therefore name the approved AI systems, identify the relevant users and matters, suspend ordinary deletion where possible, and trigger the archive workflow immediately for any system with a short retrieval window.

The API Tier Is a Design Question

The API tier should not be confused with ChatGPT Business or Enterprise workspaces. It is a way to build applications against OpenAI models, which means the firm’s own architecture determines much of the preservation posture. OpenAI has described API inputs and outputs as excluded from training since March 2023, and zero-data-retention options may be available for eligible API customers.[2]

For discovery purposes, zero retention can be useful for confidentiality and dangerous for preservation if the firm has not created its own logs before data disappears. The verification question is not “Do we have zero data retention?” It is “Where are the records we are legally required to preserve, and can we collect them without recreating the application from memory?”

A Procurement Gate for Law Firms

The gate should be simple enough to use before enthusiasm hardens into firmwide habit. If the proposed tier cannot pass it, the issue should be recorded as a governance exception before lawyers begin using the workspace for client-related work.

On the materials available now, Business/Team is not discovery-ready for a law firm that needs native export of workspace chat history. Enterprise is not discovery-ready merely because the invoice says Enterprise. Enterprise with an enabled Compliance API, verified export scope, controlled access, and periodic archiving can support preservation and production. A firm already using Business/Team should treat the export gap as an immediate governance issue, not a feature request.

References

1. OpenAI won't let some customers export their chats, but this tool will, The Register, July 23, 2026.
2. ChatGPT's Business Plan and Confidentiality, Oklahoma Bar Association, 2026.
3. What AI Tools and Features Are Available in ChatGPT Enterprise for Lawyers, Debevoise Data Blog, July 15, 2025.
4. How to Export & Analyze ChatGPT Enterprise Usage Data, Worklytics, July 2026.
5. Ediscovery for ChatGPT and LLMs: The Complete Guide, CS Disco.
6. Your Next Litigation Hold Should Cover AI Chat Logs, Faegre Drinker, May 2026.
7. Updating Litigation Hold Policies for the Age of Generative AI, Shipman & Goodwin.