MCP in the Tax Firm: Connecting DATEV and AI Securely

The real problem is not the AI — it is the data-silo landscape

In most tax firms, knowledge is spread out: accounting and reports in DATEV, individual clients in Lexware or Lexoffice, the firm’s own payroll and HR world in Personio. Each system is good on its own. The friction arises in between — in manual collating, in copy-paste, in explaining the same matter again in three interfaces.

General AI tools do not solve this, because they cannot see these systems at all. A chatbot knows nothing about the client master data, does not know the open items and cannot pull a report from accounting. It can formulate — but not access your data. The Model Context Protocol (MCP) closes exactly this gap: it is an open standard through which an AI agent accesses defined functions of your specialist systems in a controlled way.

How MCP differs from DATEV Copilot

In February 2026, DATEV made its own Copilot available for testing in the KI-Werkstatt (AI workshop) — a horizontal assistant for text drafts, document analysis and research. It is a sensible building block, but it is a generic assistant around the DATEV world, not a tool that orchestrates your firm-specific processes across several systems.

An MCP connection serves a different purpose. You define concrete tools — such as “retrieve a client’s open items”, “pull the firm’s own HR report”, “pre-code a batch of documents” — and an agent of your choice uses them in a targeted way. The two do not exclude each other: the Copilot can help in everyday DATEV work, while MCP builds the bridges between DATEV, Lexware, Lexoffice and Personio. Which providers are MCP-compatible, you can read in the MCP tool cluster.

How an MCP firm works day to day

The following sketches are anonymised and deliberately realistic — not a specific reference, but typical patterns as they arise in mid-sized firms.

1. Client question answered in one go “How is client Müller doing right now?” The agent pulls open items and key figures from accounting, adds the latest documents from Lexoffice and delivers a compact overview — as a draft that you review before it goes to the client.
2. Documents pre-coded instead of sorted by hand A batch of documents lands in the inbox. The agent recognises suppliers and amounts, suggests SKR03 or SKR04 accounts and prepares a DATEV-compliant posting — the clerk checks and approves.
3. Own HR world via Personio “How many holiday days are still open in the team, who is available next week?” Via the Personio connection, the agent answers internal capacity questions without anyone having to export lists. Details in the MCP server for Personio.
4. Month-end close as a guided routine Documents checked? Bank reconciliation done? Unusual accounts? The agent creates a short checklist per client and marks where something is still missing — the professional assessment stays with the human.

What the architecture looks like

The picture stays deliberately lean, so that the chain of responsibility stays traceable:

AI agent ↔ MCP server (your EU host) ↔ DATEV / Lexware / Lexoffice / Personio

• DATEV access: Via established routes such as DATEVconnect, structured exports or online interfaces — depending on the existing infrastructure. The market already has first, partly open-source MCP servers for DATEV data structures; these are not official DATEV products, which is why we check maturity and contractual position in advance.
• Lexware & Lexoffice: for client-side documents and invoices, connected cleanly via API. In more depth: MCP server for Lexoffice.
• Personio: for the firm’s own internal HR and capacity view.
• Read before write logic: By default the agent only creates drafts. Posting, sending or finalising requires human approval.
• Complete logging: Every action is logged with timestamp, triggering person and data change.

You will find detailed instructions for the DATEV side in the guide to the MCP server for DATEV.

Confidentiality: why the GDPR is not enough here

For tax firms, the GDPR is only half the story. The professional duty of confidentiality under § 203 StGB (German Criminal Code, professional secrecy) is a separate layer of obligations that an ordinary data processing agreement under Art. 28 GDPR does not cover. The German Federal Chamber of Tax Advisors (Bundessteuerberaterkammer) explicitly requires additional agreements — every service provider who comes into contact with client data must be bound to confidentiality.

An MCP architecture helps make this requirement manageable, because it keeps the chain short and transparent. In practice we pay attention to:

• EU hosting of the MCP server (such as Hetzner or the Azure Germany West Central region), no US edge in the data path.
• AI provider with EU data residency: Claude via AWS Bedrock in the EU region Frankfurt, alternatively Google Vertex AI (EU), OpenAI Enterprise EU or Azure OpenAI in Germany.
• Obligation compliant with § 203 of the service providers involved — beyond the DPA.
• Data minimisation via tool schemas: The agent sees only the fields a task really needs, instead of blanket access.
• Client separation & roles, so that access stays cleanly delimited per client.

What a realistic start looks like

It makes sense to start with a single, clearly defined use case — usually document pre-coding or the client-related status enquiry. This produces a reliable picture of effort, data paths and approval logic before further systems are added. The guide MCP integration agency describes how an agency structures such a project.

Frequently asked questions

Does MCP replace DATEV Copilot?

No, the two have different jobs. DATEV Copilot has been tested in the KI-Werkstatt since February 2026 and is a horizontal assistant for texts, document analysis and research. MCP connects your own AI agents to exactly those workflows that go beyond DATEV — for example linking with Lexware, Lexoffice or Personio in a single process.

How does MCP fit with the duty of confidentiality under § 203 StGB?

The GDPR alone does not cover professional confidentiality. In addition to the data processing agreement, a § 203-compliant obligation is needed for every service provider in the chain. An MCP architecture supports this because it keeps the chain short and controllable: EU hosting, tightly defined tools and an AI provider with EU data residency.

Are there already MCP servers for DATEV?

Yes, first, partly open-source MCP servers exist on the market that connect AI agents to DATEV data structures such as EXTF exports or the SKR03/SKR04 charts of accounts. These are not official DATEV products. For productive use in a firm, we check maturity, hosting and contractual position individually.

Which firm systems can be combined?

Typically DATEV as the core, supplemented by Lexware and Lexoffice for client-side documents and Personio for the firm’s own HR world. Via MCP, an agent brings these sources together in a single process, instead of someone switching between the tools.

Do the AI models see client data?

Only to the extent a task really requires. Through the tool definitions you control which fields an agent may retrieve. Write actions are created as drafts by default and only posted or sent after human approval.