AI in professional firms and Section 203 StGB: protecting client confidentiality

Why the GDPR is not enough for law firms

For most companies, the central question when using AI is: is it GDPR-compliant? For tax advisors, lawyers and auditors there is a second layer on top. The GDPR regulates data protection as a minimum standard, with supervisory, fine and liability risk. In addition, § 203 StGB applies: client confidentiality is protected by criminal law. Anyone who passes client data to an IT or AI service provider without proper integration can commit a criminal offence — both the person acting and the professional.

This is the decisive difference from a pure data protection view: a measure can be defensible under data protection law and still open to attack under professional law. AI is not the problem; uncontrolled AI is the problem.

Who falls under § 203 StGB?

The criminally enforced duty of confidentiality under § 203(1) no. 3 StGB applies in particular to:

• Lawyers and patent attorneys
• Tax advisors and authorised tax representatives
• Auditors and sworn bookkeepers
• Notaries

§ 203 StGB is supplemented by the confidentiality duties under professional law: § 57 StBerG (German Tax Advisory Act) for tax advisors, § 43a BRAO (German Federal Lawyers' Act) for lawyers and § 43 WPO (German Public Auditors Act) for auditors.

The legal route: § 203(3) and involvement as a contributing person

Since the 2017 reform, § 203(3) StGB expressly permits so-called other contributing persons, such as IT service providers, cloud providers and AI providers, to be included in the duty of confidentiality. Involvement is subject to several conditions:

• check_circle Involvement is necessary for the activity
• check_circle Careful selection of the service provider
• check_circle Obligation to confidentiality in text form, under the relevant provisions: § 62a StBerG, § 43e BRAO, § 50a WPO
• check_circle Arrangements for any sub-processors
• check_circle Depending on proximity to the individual engagement: consent of the client

Information with right to object, or express consent?

Clients must be informed transparently about the use of AI. How far this must go depends on the use case:

• General engagement handling: Information with a right to object may be sufficient.
• Services with a direct link to the engagement: Here § 62a(5) StBerG, § 43e(5) BRAO and § 50a(5) WPO regularly require the client's express consent.

Technically, this means an objection and a missing consent must be treated and enforced differently, not just a blanket opt-out.

What the architecture must deliver

For the legal requirement to become a reliable setup, three building blocks that work together are needed:

• Structural separationThe AI has no direct full access to files or DATEV. A controlled integration layer releases only the necessary data extracts for each request.
• Contract chain for auxiliary personsEvery service provider involved is bound to confidentiality in text form, supplemented by a data processing agreement under Art. 28 GDPR.
• Audit-ready auditEvery access is logged in a traceable way, so that the firm can prove in an emergency who queried what and when.

The technical implementation typically runs via a controlled DATEV MCP server; we cover separately how this looks concretely in a tax firm.

Retention of AI audit logs

How long an audit trail is kept depends on purpose and data class, not on a blanket period. For transactions relevant to accounting, § 257 HGB (German Commercial Code) and § 147 AO (German Fiscal Code) provide guidance: accounting vouchers 8 years, books and annual financial statements 10 years, commercial letters 6 years. For logs containing personal data with no accounting relevance, the GDPR's storage limitation also applies, so shorter deletion periods should be examined.

And the EU AI Act?

Alongside § 203, the GDPR and professional law, the EU AI Act applies as a horizontal legal framework for AI. A short check is worthwhile for law firm workflows: is there a high-risk use case (for example an automated individual decision with legal effect)? Does a human approve every result (human-in-the-loop)? Are use cases and the model and tool register documented? The EU AI Act also requires providers and deployers to ensure sufficient AI literacy among the people involved (Art. 4).

A typical scenario from everyday law firm work

Anonymised, realistic sketch, not a specific engagement. A case handler wants to have an annual financial statement quickly checked for plausibility and copies it into a public AI tool with which no contract compliant with § 203 exists. What looks like a data protection issue is relevant under professional and criminal law. With a controlled architecture, by contrast, the AI only queries clearly delimited tools, real names stay out, and every access is logged. The case handler stays in charge of the decision: the AI makes the proposal, the human approves.

Frequently asked questions

Can tax advisors, lawyers and auditors use AI?

Yes, provided the AI providers are involved only to the extent necessary under § 203(3) StGB and are bound to confidentiality in text form under § 62a StBerG, § 43e BRAO or § 50a WPO, supplemented by consent depending on proximity to the engagement. The assessment of the individual case rests with your in-house counsel.

Is it enough if an AI tool is GDPR-compliant?

Not on its own for professionals bound by secrecy. The GDPR is the minimum standard, and § 203 StGB adds criminal liability on top. Both have to fit together.

Do I need my clients' consent?

It depends on the use case: information with a right to object for general handling, express consent for services with a direct link to the engagement (§ 62a(5) StBerG, § 43e(5) BRAO, § 50a(5) WPO).