--- title: "AI for law firms: confidentiality, data flows and dedicated servers" description: "What German law firms need to assess: professional secrecy, providers, local models, cloud APIs and the current AI Act." author: "Matthias Meyer" published: 2026-03-08 updated: 2026-09-30 updates: - date: 2026-09-30 note: "Clarified confidentiality, provider assessment, data flows and current AI Act dates." language: en tags: ["ai-server", "anwaelte", "kanzlei", "mandantengeheimnis", "dsgvo"] canonical: "https://studiomeyer.io/en/blog/ai-for-law-firms" markdown_versions: ["https://studiomeyer.io/de/blog/ai-for-law-firms.md", "https://studiomeyer.io/en/blog/ai-for-law-firms.md", "https://studiomeyer.io/es/blog/ai-for-law-firms.md"] publisher: "StudioMeyer, https://studiomeyer.io (llms.txt: https://studiomeyer.io/llms.txt)" --- # AI for law firms: confidentiality, data flows and dedicated servers ## The Dilemma: Using AI While Preserving Client Confidentiality Drafting briefs, researching case law and summarizing files are useful preparatory tasks for AI. The firm remains responsible for the output and for protecting client information. Cloud AI is neither automatically prohibited nor automatically permitted. The task, necessary information, provider agreement and actual data flows all matter. A personal chat account is different from a reviewed business service. A dedicated server's location does not answer these questions on its own. This article concerns German professional rules. It was reviewed on 30 September 2026 and does not authorize a particular law firm's deployment. ## The Legal Framework: What Lawyers Need to Know ### Duty of Confidentiality Under § 43a(2) BRAO (Federal Lawyers' Act) The duty of confidentiality for lawyers is enshrined in § 43a(2) of the Bundesrechtsanwaltsordnung (BRAO, Federal Lawyers' Act) and specified in § 2 of the Berufsordnung für Rechtsanwälte (BORA, Professional Code for Lawyers). It is one of the fundamental professional obligations and protects the relationship of trust between lawyer and client. This obligation is comprehensive: it covers everything that becomes known to the lawyer in the exercise of their profession. This includes not only the content of conversations and legal briefs, but even the fact that a client relationship exists at all. ### § 203 StGB (German Criminal Code): Criminal Liability for Violations Section 203 penalizes unauthorized disclosure of client secrets. Paragraph 3 allows necessary involvement of other contributing persons under specified conditions. Confidentiality obligations and any further service providers must also be considered. Sending information to an AI provider may give third parties access to secrets. Whether that access is lawful depends on the actual deployment and legal conditions. A promise of no training does not settle questions of processing, access or retention. ### § 43e BRAO: Involvement of Service Providers Section 43e requires necessary access, careful selection and an agreement in text form covering confidentiality, limits on access and further service providers. Services performed abroad require comparable protection of secrets. Additional case-specific conditions cannot simply be replaced with a standard provider agreement. The BRAK guide of December 2024 takes a critical view of disclosing client secrets to language models: under the circumstances it examined, access was generally unnecessary where the technology could be used without those secrets. This is an important assessment criterion, not blanket permission for cloud AI. Data protection duties apply separately. ### The BRAK Guidelines (December 2024) The guide recommends abstract queries that cannot identify a case and, where possible, fully anonymized documents. It discusses reviewing outputs, provider agreements and adequate AI literacy. It also states that BRAO and BORA did not, at its publication date, create a general duty to tell clients about every use of AI. Other disclosure obligations may arise from contracts, data protection or other rules. Transparency can be useful but does not replace legal assessment. Adequate AI literacy depends on the task and people involved; there is no single mandatory training format for every use. ### EU AI Act The AI Act applies in stages. According to the European Commission's guidance reviewed on 30 September 2026, AI literacy obligations apply from February 2025 and relevant transparency rules from August 2026. Revised high-risk deadlines fall in December 2027 or August 2028, depending on the category. A law firm is not a high-risk deployer simply because of its industry. The legally defined intended use matters. Documentation and labelling requirements cannot be assigned to every drafting task indiscriminately. ## The Problem with Anonymization An abstract query without case details may be enough for general legal questions or text templates. Anonymizing real files is harder: changing names does not suffice if places, industries or unusual circumstances identify the people involved. This can limit the usable context. It does not make anonymization pointless or remove the need for safeguards on a dedicated server. Establish which information the task needs first, then assess the processing route for any remaining information. ## A Dedicated AI Server as One Possible Architecture A [local AI system](https://studiomeyer.io/en/services/ki-systeme/lokal) can avoid transmitting inputs to an external model provider. This is a practical advantage for sensitive files, not a compliance guarantee. ### How It Works Technically **Dedicated server with a cloud model:** Documents and knowledge may reside on your machine, while selected passages and inputs are sent to a model API. Training use, retention and processing location depend on the service, agreement and configuration. Brief processing or no training does not mean no retention. **Dedicated server with a local model:** Model inference runs on your own hardware. Email, messaging, search, backups, maintenance and logs still require separate assessment. A hosting provider or administrator may also have access. ### What This Means for Client Confidentiality Necessary access, confidentiality, permissions and deletion must be demonstrably managed. GDPR Article 25 concerns protection by design; Article 44 and following concern possible international transfers. Local inference can avoid one data flow, but it does not satisfy these duties automatically. Provider and maintenance arrangements matter as much as the model. ## Practical Examples: AI in the Law Firm ### Drafting Briefs In an approved system, the firm can use a case description and selected briefs as the basis for a draft. Only necessary information should be included. Local inference keeps model processing on your hardware; a cloud API receives the passages transmitted to it. Templates can support tone and structure. The lawyer must check the legal substance against the file and reliable legal sources. ### Deadline Management Missed deadlines can create liability. A configured system can help identify possible deadlines in incoming documents, connect them to the file and prepare reminders or suggested next steps. This does not replace the deadline register or responsible review. Test and monitor reminders. Email and Telegram create additional data flows; even subject lines and file references can reveal confidential information. ### Searching Your Own Files "What did we argue about cosmetic repairs in Müller versus Schmidt?" A configured system can search authorised briefs, correspondence and notes for relevant passages. Check completeness and relevance against the sources. Speed and quality depend on the collection and setup. ### Client Communication An assistant can prepare status replies, meeting suggestions and reminders about missing documents. It needs authorised, current context. Review content, recipient and necessary data before sending. Documents should only be transferred through an approved, assessed channel. ## What an AI-Server Costs for Law Firms Pricing follows a needs assessment. Local models can require different hardware and operating costs from cloud integration. The proposal specifies server configuration, integrations, training and support. Setup, ongoing operation and model usage belong in the same calculation. ### Is It Economically Viable? Test this in a small pilot. Which tasks become faster, how much review remains and what are the setup, operating and maintenance costs? Saved time becomes additional revenue only when used for billable work. This does not establish a universal one-month payback. ## Common Objections and Honest Answers ### "I have practiced for 20 years without AI." True. And you probably also spent 20 years manually writing your briefs, searching case law in databases, and entering deadlines by hand. An AI system does not replace your expertise. It takes over the work that is beneath your qualification level. The legal assessment remains with you. ### "Can I trust the AI?" No, and you should not. AI systems can deliver incorrect or imprecise results. Every draft, every research result, every output must be reviewed by you. The system is an assistant, not a decision-maker. The lawyer's duty to review remains in full force. ### "What if the bar association objects?" The BRAK guide explains requirements and limits. It does not approve a specific server. Document tasks, required information, providers, access rights and safeguards. A German server location does not replace professional assessment or data protection accountability. ### "My clients do not want this." Explain what AI prepares and which data it uses. Statements about storage and access must match the deployment. Do not promise complete isolation if messages, model requests or maintenance access involve external providers. ## Which Law Firms Benefit from an AI-Server? Recurring drafts, a substantial authorised collection or specific integrations can justify a pilot. Sensitive matters also increase assessment work. Firm size and legal specialism alone prove neither the greatest time saving nor financial value. Compare the actual task, review effort and operating costs. ## The Next Step Start with a defined task and documented data flows. Then assess whether abstract queries suffice, a local model is suitable or an external service can meet the necessary conditions at all. In a free introductory call, we discuss technical implementation and scope. The firm and its relevant advisers remain responsible for legal approval of the deployment. **[See our AI systems](https://studiomeyer.io/en/ai-solutions)** ## Sources and review date Reviewed on 30 September 2026. - [BRAK, Leitfaden 12/2024](https://www.brak.de/fileadmin/service/publikationen/Handlungshinweise/BRAK_Leitfaden_mit_Hinweisen_zum_KI-Einsatz_Stand_12_2024.pdf) - [§ 203 StGB](https://www.gesetze-im-internet.de/stgb/__203.html) - [§ 43e BRAO](https://www.gesetze-im-internet.de/brao/__43e.html) - [EU AI Act](https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai) ## Read more, AI Strategy for Business - [AI-ready medical practices: information, booking and privacy](https://studiomeyer.io/en/blog/ai-ready-aerzte.md) - [Digital Transformation for SMBs: Assessing Readiness and Next Steps](https://studiomeyer.io/en/blog/digitalisierung-mittelstand.md) - [AI inference in the EU: assess the processing chain](https://studiomeyer.io/en/blog/eu-ai-inference.md)