Can loan officers use ChatGPT or Claude with borrower information?
Not in a personal or consumer AI account. Borrower nonpublic personal information (NPI) should only go into an AI tool your company has approved for that purpose, with the right controls in place. You can still get a lot out of AI by using it for work that doesn't need borrower data: partner outreach, education, marketing drafts and summaries of public guideline documents.
What counts as NPI?
Under the Gramm-Leach-Bliley Act (GLBA), nonpublic personal information is personally identifiable financial information about a consumer. For a loan officer, that covers more than most people think:
- Anything a borrower gives you to get a loan: income, assets, employment, Social Security number
- Information from the transaction itself: loan amount, loan status, account numbers
- Information you get from other sources in connection with the loan, like a credit report
- Even the fact that a specific person is your customer
So "Draft a note to John Smith about his loan conditions" is already NPI, before you paste a single document.
Why consumer AI accounts are different
When you sign up for an AI app with your personal email, you agree to that plan's terms. Depending on the plan and your settings, conversations may be stored, reviewed for safety, or used to improve the product. Business and enterprise plans usually come with different data controls and agreements.
The point is not that one AI company is safe and another isn't. Your company, not you, decides which tools are approved for customer data. If there is no written approval, treat the answer as no.
The Safeguards Rule angle
Non-bank mortgage lenders and brokers fall under the FTC's Safeguards Rule, which requires a written information security program. Where customer information goes, including into AI tools, is part of that program. If your company's policy doesn't cover AI yet, that is a good conversation to start with your compliance lead.
What you can safely use AI for
Most of the time AI saves a loan officer isn't on borrower files anyway. It's on the work around them:
- Realtor and partner outreach. Follow-up texts, open house notes, co-marketing drafts.
- Education content. Plain-English explainers on escrow, appraisals or the loan process.
- Public guideline summaries. Upload an agency or investor guideline and ask for a cited summary.
- Your own planning. Weekly recaps, call lists by partner, content calendars.
How to strip a request down
A simple test: if you would black it out before emailing it to a stranger, keep it out of the chat. Replace names with roles ("the borrower," "the listing agent") and remove numbers that tie back to a person. Ask the general question, then apply the answer to the file yourself.
Instead of: "John Smith makes $84,000 at Acme and has a 2-year gap. Can he qualify?"
Try: "Using the guideline I uploaded, what does it say about employment gaps and how they're documented? Cite the section."
Quick questions
Can I use AI if I remove the borrower's name?
Removing the name helps, but other details can still identify someone. Strip anything that ties back to a person and follow your company's policy.
Is a paid plan automatically safe for NPI?
No. Paying for a plan doesn't make it approved. Your company decides which tools and agreements are acceptable for customer data.
This article is general education, not legal or compliance advice. Rules vary by company and situation. Talk to your compliance team or counsel before changing how you handle customer data or partner relationships.