LLM Hosting and § 203 StGB: What Law Firms Must Verify in AI Providers

LLM Hosting and § 203 StGB: What Law Firms Must Verify in AI Providers

Section 203 of the German Criminal Code does not prohibit law firms from having language models hosted by service providers. Since 2017, professionals bound by secrecy are permitted to disclose confidential information to cooperating service providers to the extent necessary. This requires a formal duty of confidentiality, further specified for attorneys under Section 43e BRAO.

Why this question affects every law firm

AI has arrived in German law firms: 63.6% already use it actively, and 82.5% of users rely on public tools like ChatGPT. As soon as case file contents enter a language model, the operator becomes a party to the client secret. Whether this is permitted depends not on technology, but on whether the law firm has established the service provider's cooperation in full accordance with professional and criminal law.

What Section 203 StGB has permitted since 2017

With the 2017 legislation protecting professional secrecy when third parties cooperate in professional duties, the German legislature expressly regulated external service providers. Under Section 203 StGB:

• Secrecy holders may disclose confidential information to persons cooperating in their professional duties to the extent required for their cooperation (Section 203 (3) StGB).

• The cooperating person is subject to criminal penalties if they disclose such secrets without authorization (Section 203 (4) sentence 1 StGB).

• The law firm itself may be penalized if it failed to obligate the cooperating person to confidentiality and that person discloses a secret without authorization (Section 203 (4) sentence 2 no. 1 StGB).

For LLM hosting, this means external operation is permissible if necessary and effectively bound by confidentiality obligations.

What Section 43e BRAO requires additionally

For attorneys, Section 43e BRAO specifies how this obligation must be structured:

• Necessity: The service provider receives access only to the extent required for the service.

• Careful selection: The law firm selects the provider carefully and terminates cooperation if requirements are no longer met.

• Written agreement in text form: The provider is bound to secrecy and instructed on criminal penalties for violations. The contract governs whether and how subcontractors are involved.

• Foreign services: For services performed abroad, access is permitted only if secret protection is comparable to that in Germany.

• Individual case mandates: If the service directly serves an individual client mandate, client consent is required.

Data protection obligations continue in parallel. When a provider processes personal data, a data processing agreement under Art. 28 GDPR is additionally required.

Three hosting models compared

Public AI API. The provider processes content in its cloud data center and acts as a service provider under Section 43e BRAO. The law firm must check whether terms contain a formal secrecy obligation or whether a supplementary agreement is required.

AI API via Private Link in an EU region. Microsoft Azure, AWS, and Google Cloud offer private networking connections to AI services in European regions. Traffic does not traverse the public Internet, but the provider still processes contents and remains a service provider.

Private Operation. The language model runs on law firm servers or in a dedicated German data center. If run in-house, there is no external party. If managed by a specialist, the provider is bound under Section 43e BRAO while contents never leave the agreed infrastructure. Learn more under Private AI infrastructure.

Checklist: seven questions for every AI provider

1. Where exactly are prompts, documents, and answers processed and stored?

2. Who has technical access to these contents, including in support and maintenance?

3. Is there a written secrecy agreement with instruction on criminal penalties?

4. Which subcontractors are involved, and are they equally bound?

5. Is content used for model training or product improvement?

6. Does access occur from a third country, and is secrecy protection comparable?

7. Are a data processing agreement and technical-organizational measures provided prior to contract conclusion?

Anyone unable to answer these questions clearly should not feed client data into the system. Learn more: AI vendor sovereignty check.

What this means for RAG in the law firm

A RAG system accesses your entire case file repository to deliver cited answers. The hosting question applies not to individual prompts, but to entire firm knowledge. How we implement private RAG for attorneys on dedicated infrastructure is shown on our law firms industry page.