AI in the Law Firm: What § 43e BRAO Permits and What It Does Not

In brief: German lawyers may use AI services with client data, but only within the limits of Section 43e BRAO: the provider may be given access to client secrets only as far as the task requires it, it must be carefully selected and bound in a contract in text form, with a briefing on the criminal consequences, to confidentiality and to acquiring knowledge only as far as performing the contract requires. The contract states whether the provider may involve further persons; if so, the provider must bind them in text form as well. If the service is performed abroad, the protection of secrets there must be comparable to that in Germany, and if a service directly serves a single engagement, it may receive client secrets only with the client's consent. For language models such as ChatGPT, the German Federal Bar (BRAK) already considers the transmission of client secrets unnecessary, at least for the freely available versions (as of December 2024); no references to a matter therefore belong in those versions, not even client names or the fact that an engagement exists. Chatbots and phone assistants in contact with clients are, according to the Bar, subject to a higher standard of care, and since 2 August 2026 they must identify themselves as AI unless that is obvious.

Whether a German law firm may use external services that get to see client secrets has been settled in principle since 2017. Section 43e of the Federal Lawyers' Act (BRAO) has applied since 9 November 2017, inserted by the Act on the Protection of Secrets When Third Parties Assist Persons Bound by Professional Secrecy (Federal Law Gazette I p. 3618). It allows lawyers to involve service providers in the work of the firm without their clients' consent and attaches conditions to this; only for services that directly serve a single engagement is consent still required. The explanatory memorandum expressly names IT service providers, external systems, applications and installations, and office services such as telephone services (Bundestag printed paper 18/11936). The German Federal Bar (BRAK) expressly counts providers of AI solutions among these IT service providers in its guidance on the use of AI of December 2024.

The open question is therefore not whether, but how. This article goes through the conditions of Section 43e BRAO subsection by subsection, puts the BRAK guidance into context and shows what additionally applies to chatbots and phone assistants in contact with clients. Which ways of obtaining a language model are open to professionals bound by secrecy at all is covered in the article on LLM hosting under Section 203 StGB, and the position of tax advisers under the almost identically worded Section 62a StBerG in the article AI in the tax firm. For transparency: ArkeonTech is itself a provider of AI chatbots, phone assistants and automations and thus a potential service provider within the meaning of Section 43e BRAO.

What does client confidentiality cover?

Everything that has come to a lawyer's knowledge in the exercise of the profession, except facts that are common knowledge or do not require secrecy given their significance (Section 43a(2) BRAO). According to the BRAK guidance, this also includes the names of clients and even the fact that an engagement was given at all.

Under Section 2(1) of the Rules of Professional Practice (BORA), the duty continues after the engagement ends, and a lawyer who without authorisation discloses another person's secret that was confided to them or otherwise became known to them commits an offence under Section 203(1) no. 3 of the Criminal Code (StGB), punishable by imprisonment of up to one year or a fine. For the use of AI this has a consequence: it is not only about the content of a file. A phone assistant taking a call already learns who is calling and what it is about. A chatbot on the website reads a prospective client's account before any engagement exists; under the wording of Section 43a(2), all that matters is that the information became known in the exercise of the profession.

What does Section 43e BRAO require before an AI provider sees client data?

The firm may give an AI service access to client secrets only once access is necessary for the service, the provider has been carefully selected and a contract in text form is in place. In it, the provider must be bound, with a briefing on criminal liability, to confidentiality and to acquiring knowledge only as far as performing the contract requires; the contract must also state whether the provider may involve further persons, and if so, the provider must bind them in text form. For services performed abroad and services for a single engagement, subsections 4 and 5 come on top. The table shows all eight subsections of the provision.

Three points decide the matter in practice.

Necessity first. The explanatory memorandum demands strict standards when assessing necessity and refers to the case law of the Federal Constitutional Court on the relationship of trust between lawyer and client. Technical access restrictions count: anyone who merely rents storage space may as a rule not give the provider access to client secrets, because the data can be stored encrypted, so access is not necessary. The BRAK draws a strict line for language models: for models such as ChatGPT, transmitting client secrets is not necessary by the current state of the art, because they can be used without that data and passing it on would entail incalculable risks for clients; this applies at least to the freely available operating models (as of December 2024). Where possible, the Bar advises abstract prompts that do not allow any inference about a particular engagement even in context, and documents that have been fully anonymised beforehand. Removing names and addresses is regularly not enough if information about the matter can emerge from the context.

Access means opportunity. According to the BRAK guidance, it does not matter whether the AI provider actually takes note; it is enough that it has the opportunity to do so. A service that stores inputs for abuse detection and has staff review conspicuous ones opens up such access. How the large model providers handle this and where the chain of obligations breaks there is described in the article on LLM hosting under Section 203 StGB.

Two sets of rules, not one. The data processing agreement under Article 28 GDPR governs data protection; the obligations under Section 43e(3) govern professional secrecy. Whether they are set out in a separate agreement or in separate clauses of the same contract is left open by the law. According to the explanatory memorandum, text form means Section 126b of the Civil Code: a legible declaration on a durable medium that names the person making it; a signature on paper is not required.

Are a Section 203 StGB agreement and an ISO certificate enough?

Not on their own. An agreement that contains all points of Section 43e(3) in text form fulfils the contractual duty, and a certificate helps with the careful selection but does not replace it. Client data, whether personal or not, still belongs in the service only if access is necessary for the task, the protection of secrets is comparable where the service is performed abroad, and consent has been given for services that directly serve a single engagement; for personal data, the data protection rules apply in addition.

The explanatory memorandum expressly names certifications and other evidence of qualification as an aid to selection; if doubts about reliability are known or recognisable, the provider may not be engaged. An ISO/IEC 27001 certificate attests to an information security management system. It does not answer whether the provider's staff can read inputs, in which country processing takes place and which subcontractors are involved. Four questions therefore need to be settled before the first upload:

• Does the task need the data in plain text, or is an anonymised version sufficient?
• Is the service performed in a country whose protection of secrets is comparable to Germany's?
• Does the service directly serve this one engagement, so that the client must consent?
• Is everything settled under data protection law, from the data processing agreement to the transfer to a third country?

When does the firm need the client's consent?

When the service directly serves a single engagement and the provider gets access to client secrets in doing so (Section 43e(5) BRAO); according to the explanatory memorandum, this is likely to be the case as a rule. It gives as examples the engagement of an expert, a private investigator or a translator. In its view, what matters is not primarily how the contract is structured, but whether there is a particular need for the service in the individual engagement; flat-rate fees for regular engagements do not change this.

For AI, this yields a distinction that the law does not draw expressly but that follows from this standard. A tool that the firm keeps available for all of its work, such as an assistant for drafts and summaries, is a general working tool; subsections 1 to 4 apply to it, but not subsection 5. If, on the other hand, the firm commissions an external service because of a particular engagement, such as the translation or the AI-assisted analysis of the documents in exactly this case, the particular need lies in the engagement, and consent is required. Where the line is unclear in the individual case, consent provides certainty.

Subsection 6 closes a gap: even with consent, careful selection and a contract in text form remain mandatory unless the client expressly waives them. According to the explanatory memorandum, such a waiver requires that the client knows what they are waiving.

In practice, the rule therefore belongs in the engagement agreement: which AI services the firm uses, for what, and consent for services that directly serve a single engagement. The BRAK does not currently see a professional duty to inform clients about every use of AI. It does, however, recommend transparency and, in case of doubt, a contractual provision, and points out that duties to inform can arise from contract law or the Act against Unfair Competition.

May the AI provider be based abroad?

Yes, if, alongside the other conditions of Section 43e BRAO, the protection of secrets where the service is performed is comparable to that in Germany (Section 43e(4) BRAO); this can only be dispensed with if the protection of the secrets does not require it. For the other EU member states, the explanatory memorandum assumes that this is generally the case: protection against state interference is recognised in EU law as a general principle of law where professional secrecy obligations exist, and lawyers' confidentiality is recognised in principle in all member states. For all other countries the firm has to check it case by case.

For language models this is not a side issue, as many providers are based in the USA. Whether the data protection level there can be relied on is, in the BRAK's view, not conclusively settled; it advises preferring providers with servers in Germany or Europe where possible. For third countries such as India or China, where there is no comparable level of data protection either, Section 43e(4) requires special safeguards according to its guidance. The GDPR rules on transfers to third countries apply alongside (Article 44 et seq.).

What applies to chatbots and phone assistants in contact with clients?

A stricter standard than for internal use. According to the BRAK guidance, the requirements of care rise with the degree of automation, and anyone who uses AI towards clients, for instance for automated communication, auto-responders or chatbots that take on new matters, must meet a higher standard of care. The impression must not arise that a lawyer's review and advice in the individual case are unnecessary.

Section 43e BRAO applies to the technology behind it as to any other tool. The explanatory memorandum expressly counts typing, telephone, postal and printing services among the services covered by the provision; an AI phone assistant that answers the firm's calls is one of them. Whoever operates speech recognition or the language model for its provider must be included in the obligation as a further person under subsection 3 no. 3. A separate rule applies to the communication channel itself: under Section 2(2) BORA, a channel that carries risks for confidentiality, such as unencrypted email, is permitted in any case if the client agrees, and agreement is presumed if the client proposes or starts the channel and continues it after an at least general warning about the risks. This rule concerns the channel, not the service provider processing the messages.

Three duties outside professional law come on top:

• AI notice. Since 2 August 2026, chatbots and phone assistants must make it clear that people are interacting with an AI, unless this is obvious to a reasonable user (Article 50 AI Act); the European Commission's guidelines expressly do not regard a customer service chatbot as obvious. Anyone who has a bot developed specifically and puts it into service under their own name is, according to the European Commission's guidelines, a provider and must ensure the disclosure. In sensitive conversations, for example on legal matters, the guidelines consider it likely to be necessary to repeat the notice (paragraph 40). What the notice looks like is described in the article on the AI disclosure duty under Article 50.
• Liability for what the bot says. The Higher Regional Court of Hamm ruled on 12 May 2026 that the answers of an AI chatbot are commercial acts of its operator (4 UKl 3/25); invented specialist medical titles were misleading under Section 5 of the Act against Unfair Competition (UWG). For a law firm the parallel is obvious: if the bot names a specialist lawyer title that nobody in the firm holds, that is a statement by the firm. When a human must additionally take over in customer contact is covered in the article AI in customer service.
• Impact assessment. In its list of processing operations requiring a data protection impact assessment, the German Data Protection Conference names the use of AI to control the interaction with data subjects and lists customer support using AI as a typical field of application (no. 11). Taking on a new matter often involves health data or information on criminal offences, for which Articles 9 and 10 GDPR lay down special rules.

The BRAK also names an economic risk: beyond a certain degree of automation it can become questionable whether the work is still a lawyer's activity or already a commercial one, with tax disadvantages and the risk that the professional liability insurer refuses cover in a liability case for lack of a lawyer's activity.

What applies to briefs and research with AI?

Responsibility remains entirely with the firm. From the duty to practise conscientiously (Section 43 BRAO), the BRAK infers that AI may only support a lawyer's work, not replace it, and that every result must be reviewed on the lawyer's own responsibility before it goes into a brief or advice.

How necessary this is was shown by an order of the Local Court of Cologne of 2 July 2025 (312 F 130/25): in custody proceedings, the court found that a lawyer had cited requirements and references that had evidently been generated by artificial intelligence and were entirely invented. Such submissions made it harder to find the law and misled the uninformed reader; the court pointed out that knowingly spreading untruths violates the duty of objectivity in Section 43a(3) BRAO. Whether that applies to AI texts adopted without checking is an open question: experts in professional law already disagree on whether the provision establishes a duty of truthfulness, and according to the beck-aktuell report, a knowing spread of untruths has so far mostly been held to require direct intent. A Stanford University study, which the BRAK also relies on, found hallucination rates of 69 to 88 percent for three widely used language models (GPT-3.5, Llama 2 and PaLM 2) in January 2024, for specific questions about decisions of US courts.

Two duties apply side by side to the firm's employees. Section 43a(2) sentence 4 BRAO requires binding them to confidentiality in text form and briefing them on the criminal consequences of a breach; under sentence 7, this does not apply to trainee lawyers and employees who are themselves subject to the same confidentiality requirements as the lawyer. Article 4 of the AI Act has required measures on AI literacy since 2 February 2025; since the amendment by the Digital Omnibus, in force since 27 July 2026, these measures are to support the development of staff's AI literacy. The BRAK guidance still quotes the old version. In practice both belong in a firm policy that sets out which tools are approved and which data never belong in a freely available model; what such a policy should cover is described in the article on the AI policy in the company.

According to the BRAK, there is currently in principle no duty to use AI (as of December 2024). In individual cases one can arise from the duty to maintain a properly equipped office under Section 5 BORA, for instance when handling mass proceedings.

Is AI in a law firm a high-risk system under the AI Act?

As a rule, no. According to the BRAK guidance, the category of the administration of justice in Annex III point 8(a) of the AI Act refers to judicial authorities, not to the legal profession; it also covers systems intended to be used in a similar way in alternative dispute resolution, which can matter for lawyers acting as arbitrators, provided the outcome produces legal effects for the parties (recital 61). Most AI tools including language models are, as things stood when the guidance was published, not high-risk systems. Anyone who uses an AI system in the firm on their own responsibility is generally a deployer within the meaning of the regulation.

A firm becomes a provider if it develops a system itself or has it developed and puts it into service under its own name or brand; the BRAK names larger professional practice companies as an example. If, exceptionally, a high-risk system under Annex III is involved after all, the obligations for such systems only apply from 2 December 2027 under the Digital Omnibus.

Which questions belong before the contract with an AI provider?

Seven above all: whether the provider undertakes confidentiality in text form with a briefing, whether staff can see inputs, which subcontractors are involved, where the service is performed, whether inputs are used for training, whether it provides documents for the impact assessment and whether the bot identifies itself as AI. The answers belong in text form with the contract documents. The table assigns each question its legal basis; which further evidence makes sense is shown in the article on vendor assessment under the AI Act and GDPR.

Which rules apply to a phone assistant in detail, including under Section 203 StGB, is shown in the legal table on the page on the AI phone assistant. For automated workflows, such as opening new matters or pre-sorting incoming mail, the page on AI process automation lists the other rules; for client confidentiality, Section 43e BRAO applies to these workflows as described above.

What applies in Austria and Switzerland?

The principle is the same: whoever is bound by professional secrecy must ensure that their helpers preserve it too. The rules are different.

Austria. Section 9(2) of the Austrian Lawyers' Act (RAO) obliges lawyers to keep secret the matters confided to them and the facts otherwise known to them in their professional capacity whose secrecy is in their client's interest. Lawyers must bind the assistants they call in to confidentiality and take sufficient precautions for reliable compliance with this obligation. Whether an external AI provider counts as such an assistant is not stated in the wording; the confidentiality obligation therefore belongs expressly in the contract. The GDPR and the AI Act apply directly in Austria.

Switzerland. Art. 13 of the Swiss Lawyers' Act (BGFA) subjects lawyers, without time limit and towards everyone, to professional secrecy about everything confided to them by their clients as a result of their profession, and requires in paragraph 2 that they ensure their auxiliaries preserve professional secrecy. Art. 321 of the Swiss Criminal Code punishes lawyers and their auxiliaries who disclose a professional secret, on complaint, with imprisonment of up to three years or a monetary penalty. Whether a cloud or AI provider is an auxiliary decides whether its use is permissible. An expert opinion by four authors from the University of Zurich for the Swiss Bar Association affirms this for cloud providers (summary in Anwaltsrevue 1/2019); a dissenting view in legal scholarship disagrees. The opinion requires careful selection, contractual protection of professional secrecy, use of the data only to perform the contract and reasonable monitoring. For foreign providers, the outsourcing must additionally withstand a case-by-case risk assessment according to the opinion; it refers to the US CLOUD Act, which gives US authorities access to data in the possession or under the control of a US provider, even if the data is stored abroad. As additional protection, it advises obtaining clients' consent to the use of cloud services in the engagement contract. The opinion concerns cloud services in general and predates the Data Protection Act in force since 1 September 2023; outsourcing is now governed by Art. 9 DSG and disclosure abroad by Art. 16 DSG. If a firm also targets clients in the EU, the GDPR can apply in addition (Art. 3(2) GDPR). The EU AI Act covers Swiss law firms where the output of their AI systems is used in the EU (Art. 2(1)(c)).

This section provides an overview and does not replace advice under Austrian or Swiss law.

Frequently asked questions

Conclusion

The legal framework for AI in a German law firm is strict, but clear in its essentials. Section 43e BRAO permits the use of external AI services and ties it to conditions that can be checked: necessity, careful selection, a contract in text form with a briefing and a limit on what the provider may learn, bound subcontractors, comparable protection abroad and consent for services that serve a single engagement. The BRAK interprets necessity narrowly: data should be anonymised or encrypted where possible, and it considers the transmission of client secrets to language models such as ChatGPT unnecessary, at least for the freely available versions.

Contact with clients demands the most care. From the first sentence, a chatbot or phone assistant hears information that can fall under the duty of confidentiality, it must identify itself as AI unless that is obvious, and under the line taken by the Higher Regional Court of Hamm, competition law attributes what it says to the firm. Anyone who asks the questions from the table before concluding the contract and has the answers in text form lays the foundation for every further review.

This article explains the legal position and does not replace legal advice in the individual case.

Sources

• Gesetze im Internet: Section 43e BRAO, use of services - subsections 1 to 8, in force since 9 November 2017 (Act of 30 October 2017, Federal Law Gazette I p. 3618)
• Gesetze im Internet: Section 43a BRAO, basic duties - confidentiality and binding of employees (subsection 2), duty of objectivity (subsection 3)
• Gesetze im Internet: Section 203 StGB, violation of private secrets - lawyers (subsection 1 no. 3), assisting persons (subsections 3 and 4)
• Gesetze im Internet: Section 62a StBerG, use of services - the provision with the same structure for tax advisers
• German Federal Bar: Rules of Professional Practice (BORA), as of 1 December 2025 - confidentiality and communication channels (Section 2), properly equipped office (Section 5)
• German Federal Bar: Hinweise zum Einsatz von künstlicher Intelligenz (KI), as of December 2024 - final review (2.1), higher standard of care towards clients (2.2), confidentiality and Section 43e BRAO (3.1 to 3.3), transparency (4), AI Act (5), further risks (6)
• German Bundestag: Government bill, printed paper 18/11936 of 12 April 2017 - explanatory memorandum on Section 43e BRAO (necessity, notion of service provider, selection, text form, abroad, single engagement, waiver)
• beck-aktuell: Anwalt blamiert sich vor Gericht, 8 July 2025 - Local Court of Cologne, order of 2 July 2025, 312 F 130/25
• Stanford HAI: Hallucinating Law: Legal Mistakes with Large Language Models are Pervasive, 11 January 2024 - hallucination rates of 69 to 88 percent for specific legal queries
• Higher Regional Court of Hamm: Judgment of 12 May 2026, 4 UKl 3/25 - answers of an AI chatbot as commercial acts of the operator; final according to NRWE
• EUR-Lex: Regulation (EU) 2024/1689 on artificial intelligence, consolidated version of 27 July 2026 - scope (Art. 2(1)(c)), AI literacy (Art. 4), transparency (Art. 50), administration of justice (Annex III point 8)
• European Commission: Guidelines on the transparency obligations under Article 50 AI Act, C(2026) 5054 of 20 July 2026 - provider role, repeating the notice in sensitive conversations (para. 40)
• German Data Protection Conference: List of processing operations requiring a DPIA, version 1.1 of 17 October 2018 - no. 11, customer support using AI
• Austria: Section 9 Lawyers' Act (RAO) in the Federal Legal Information System, version in force since 1 January 2025
• Switzerland: Art. 13 Lawyers' Act (BGFA), Art. 321 Criminal Code and Art. 9 and 16 of the Data Protection Act (DSG), in force since 1 September 2023
• Schwarzenegger, Thouvenin, Stiller, George: Nutzung von Cloud-Diensten durch Anwältinnen und Anwälte, Anwaltsrevue 1/2019 - summary of an expert opinion for the Swiss Bar Association