Short answer: you can. You probably shouldn't. Let me tell you why.
People ask me versions of this question a lot. Usually not this directly, more like "is it a problem if my team uses ChatGPT to pull a BOM off a print?" It is, but not just for the reason most people assume.
First problem: it often just gets it wrong
Before we even get to where your data goes, there's a simpler question. Is the answer any good?
ChatGPT is a general-purpose tool. It wasn't built on your parts library. It doesn't know what your preferred supplier has in stock this week. It doesn't recognize the shorthand a specific customer uses on a drawing note, the kind an experienced estimator reads without thinking. It's also probabilistic by design, which means you can ask it the same drawing twice and get two different BOMs back.
None of that is a bug. It's just not what the tool is for. A stalled RFQ, a printed connector callout that's not quite standard, a tolerance note that changes what part actually fits - that's exactly the kind of thing a generic model can confidently get wrong without telling you it's guessing. And a wrong BOM doesn't fail loudly. It fails quietly: a quote that's off, a job you win at the wrong margin, or a part ordered that doesn't actually fit.
So before we even talk about security, there's a reliability problem. Fast and wrong is worse than slow and right.
Second problem: even if it's right, where did your data just go
Say it does read the print correctly. On a standard consumer account, that upload can still be stored and used to improve the model, unless you've gone into Settings and turned that off. Most people quoting under deadline pressure on a Friday afternoon have never seen that toggle. I hadn't either, before I started paying attention to this.
And that toggle only ever addresses training. It doesn't cover the fact that there's no NDA on that conversation, no audit trail, and nothing your customer's data now sits behind that resembles the terms they signed with you.
I want to be clear about that distinction, because it's an easy one to miss. Turning off model training makes ChatGPT slightly more private. It doesn't make it accurate, and it doesn't make it appropriate for a customer's proprietary drawing. Those are two separate problems, and fixing one doesn't touch the other.
Why a wire harness print is riskier than most documents
A drawing isn't just geometry and a wire list. It usually carries proprietary design choices, sourcing, and part numbers that reveal who else your customer works with, and notes that represent real engineering investment on their side. That's true whether the extraction is accurate or not, and it's a separate reason to think twice either way.
If you're in defense or government work, don't assume you know which category you're in
I'll be honest about something. When I sold my last wire harness company, we went through a CFIUS review. The business was 100% defense-related. I assumed most of it was ITAR-controlled. It turned out only two relatively small programs actually were. Almost everything else was CUI, a different and separate framework. I found that out at the worst possible time.
So here's what I'd actually tell you, not "everything's fine" and not "assume everything is classified." If a DFARS clause like 252.204-7012 is in your contract, that clause pulls any software you use, AI included, into your compliance obligations. If nothing you've received is clearly labeled, and most of what reaches shop floors isn't, ask your customer directly which category applies. Write down your reasoning either way. That's a normal question, and it's exactly the kind of record an assessor wants to see.
What I'd actually ask any AI vendor
Not "should you use AI." Use AI. Just make sure it can answer these, not just the security ones:
- Does it connect live to your suppliers for real-time stock and pricing, or is it guessing from a training snapshot?
- Does it recognize your parts library and this customer's drawing conventions, or is every quote starting from zero?
- Does it train on your data, and is that a contract term or just a policy?
- Is your data isolated from other customers?
- If you're touching CUI or export-controlled data, is there a separate environment actually built and hosted for that?
So is there a compliant option? Here's the honest answer
For anyone who read the last section and thought, "OK, so what do I use instead": if you're handling CUI or export-controlled technical data, that work belongs in an environment specifically built and hosted for it, not just a more careful version of the same commercial tool.
That's what CabletequeGov is for. I'll give you the plain status, not the polished version. It's listed on the FedRAMP Marketplace as Legacy FedRAMP Ready, Class C Moderate. That is not the same thing as FedRAMP Certified, and I'm not going to blur that line for you. We're running a full Moderate Equivalency audit now, expected to close out in November. Whether Ready status is enough for your specific contract today, or whether you need to wait for the completed audit, is a determination for you and your own compliance team to make, not something I get to decide for you.
What I can tell you plainly: AI features in that environment are opt-in, off by default, and don't train on your data, and the underlying hosting sits in U.S. regions built for this kind of work. We've laid out the full architecture, encryption, and AI governance details on our security and compliance page, and if you want the CUI and ITAR distinction explained properly, Max Aulakh of Ignyte and I went deep on the questions manufacturers actually ask us.
FAQ
Can I use ChatGPT to extract a BOM from a wire harness drawing?
You can, but I would not count on it being right. ChatGPT was not built on your parts library, does not know what your supplier has in stock, and does not recognize a specific customer's shorthand on a drawing note. Ask it the same print twice and you can get two different BOMs back. A wrong BOM does not fail loudly either. It shows up later as an off quote, a job won at the wrong margin, or a part that does not fit.
Does turning off ChatGPT's training toggle make my drawings safe to upload?
It makes the upload more private, not more appropriate. Turning off model training in Settings stops that conversation from being used to improve the model, but it does not add an NDA, an audit trail, or terms that match what you signed with your customer. Accuracy and privacy are two separate problems, and that toggle only touches one of them.
What is the difference between ITAR and CUI for wire harness data?
They are separate frameworks, and I would not assume you know which one applies without checking. When I sold my last wire harness company and went through a CFIUS review, I assumed most of the business was ITAR controlled. It turned out only two small programs actually were. Almost everything else fell under CUI instead. If a DFARS clause like 252.204-7012 is in your contract, that clause pulls any software you use, AI included, into your compliance obligations, so it is worth asking your customer directly which category applies.