AI for law firms and tax advisers – with client confidentiality
Pleadings, client correspondence, research, deadlines – hardly any sector involves as much text as law firms and tax practices. At the same time, professional secrecy applies. That rules out a private AI account. This page shows which requirements an AI service provider must meet for professionals bound by secrecy and how novendix.AI implements them.
What professional law requires
Since 2017, professionals bound by secrecy may involve external service providers if these are properly obliged to maintain confidentiality. The key points:
- § 203 German Criminal Code (StGB). Disclosure to persons involved in the work is permitted insofar as it is necessary for their activity. Anyone who does not oblige a service provider to secrecy may themselves be liable to prosecution.
- § 43e Federal Lawyers’ Act (BRAO) and § 62a Tax Advisers Act (StBerG). Select service providers carefully, oblige them to confidentiality in text form, inform them of the criminal-law consequences and restrict access to what is necessary.
- Service providers abroad. Only permitted if a comparable level of protection for secrets exists there. Processing in Germany or the EU makes this assessment considerably easier.
- GDPR in addition. Data protection applies alongside professional law: a data processing agreement (DPA) under Art. 28 GDPR and technical and organisational measures.
This overview does not replace legal advice. Agree the use of AI with your professional chamber and your data protection officer.
How novendix.AI implements this
- Confidentiality obligation. The obligation to maintain confidentiality under § 203 StGB is set out in the contract.
- Data processing. A DPA under Art. 28 GDPR, concluded at booking via its own mandatory checkbox – and available to view.
- Processing location. Platform in a German data centre, language models in data centres within the EU.
- No training, no retention at the model provider. Only models with contractually guaranteed Zero Data Retention are enabled.
- Features involving third countries can be switched off. For image generation, app connections, push notifications and web search, data can leave the EU. For client work, your policy determines whether these features are used.
- Access protection. Two-factor sign-in in all plans, one project per client matter with its own visibility.
All details on hosting and sub-processors are on Privacy and security.
Use in law firms and tax practices
How to use templates and checklists as shared knowledge is explained on Knowledge management with AI.
Limits you should know
- AI does not replace review. Language models can invent citations, judgments and figures. Every statement that goes out is checked.
- No automated decisions. Responsibility for advice and statements to the client remains with you.
- Special categories sparingly. Health data and similarly sensitive information only where necessary for the matter.
Checklist before getting started in your firm
Check the service provider
Document the confidentiality obligation, DPA, processing location and sub-processors.
Set firm rules
Which client data may go into the AI, which features stay switched off, who checks the results.
Train the team
Possibilities and limits, dealing with invented citations, the duty to check – this also meets the training obligation under the EU AI Act.
The general checklist for any AI solution is on GDPR-compliant AI.
Frequently asked questions about AI in law firms and tax practices
Are lawyers and tax advisers allowed to use AI?
Yes, if the service provider is obliged to confidentiality under § 203 StGB and the professional-law requirements of § 43e BRAO or § 62a StBerG are met. Free private accounts do not meet these requirements.
Is novendix.AI suitable for professionals bound by secrecy?
The confidentiality obligation under § 203 StGB is set out in the contract, the platform runs in Germany and the models in the EU, without training and without retention at the model provider. Whether its use suits your firm is something to clarify with your professional chamber and your data protection officer.
Is client data used to train the AI?
No. Only models that contractually do not train on customer data and do not store requests are enabled.
How much does AI cost a firm with ten professionals?
With the Business plan, 10 × €35 = €350 per month plus VAT, with no minimum purchase; the onboarding workshop is optional and costs a flat €1,800.
Can I test it first?
Yes, free for ten days and without payment details. For the trial, we recommend sample files rather than real client data.
Test it with client confidentiality in mind
Ten days free, with sample files instead of real client matters – and a dedicated contact for your questions about § 203.
Your secure AI platform for the Mittelstand. Secure. Intelligent. Integrated. Custom database integration, personally supported.
novendix GmbH · Industriestraße 6 · 91126 Schwabach
Locations: Schwabach · Weißenburg · Nuremberg
A company of the L&S Lange & Schermer Group
