Cloud and AI in Law Firms – What Matters for Professional Secrecy

Law firms, tax offices and other professionals bound by secrecy work with especially confidential information. At the same time, like everyone else, they want to use modern tools: cloud storage, video calls, AI assistants. These fit together well if you keep a few things in mind. Here's a calm overview, based on the situation in Germany.

Why law firms are a special case

Lawyers, tax advisers, doctors and other professions are subject to a special duty of confidentiality. In Germany, it's set out among other places in § 203 of the Criminal Code (StGB). There are specific rules for involving service providers – such as an IT provider or a cloud service:

• § 43e BRAO for lawyers
• § 62a StBerG for tax advisers

Put simply: service providers may be involved if they're carefully selected and bound to confidentiality. You'll find the exact requirements in the legal text and in your chamber's guidance.

What this means for cloud services

For any cloud service, it's worth looking at these questions:

Many large providers offer special agreements for professionals bound by secrecy. Whether they fit your use is best clarified with your chamber or a lawyer.

And AI assistants?

AI can be really useful in a law firm – for drafts, summaries or research, for example. But with client data, special care is needed. A few simple ground rules:

1. Clear team rules: Which data may go into which tool?
2. Anonymise: Leave out names and case numbers wherever possible.
3. Check results: AI can be wrong – especially with legal details.
4. Consider local AI: An assistant on your own hardware keeps the data in-house.

How open source can help in a law firm

A nice way to keep control is open-source software on a server you know – in the office or in a German data centre:

• Nextcloud for files, documents and sharing with clients (with password and expiry date)
• Collabora or ONLYOFFICE for editing briefs in the browser
• Element for confidential internal communication
• Vaultwarden for all of the firm's passwords
• Local AI with Ollama or the Nextcloud Assistant

Practice software like DATEV or RA-MICRO stays as it is, of course. Open source takes care of everything around it.

A few terms, briefly explained

• Professionals bound by secrecy: People with a professional duty of confidentiality, such as lawyers, tax advisers or doctors.
• Contributing person: Anyone who works with a professional bound by secrecy or is involved as a service provider and may come into contact with confidential information.
• Confidentiality agreement: An agreement in which a service provider explicitly commits to confidentiality.
• End-to-end encryption: Only the sender and recipient can read the content.

An example from a small law firm

A firm with three lawyers and two staff wants to exchange documents with clients more securely. Until now, many documents went back and forth by email. The firm opts for a Nextcloud in a German data centre:

1. Each matter gets its own folder with clear permissions.
2. Clients receive share links with a password and expiry date.
3. For uploads, there's a "drop box" link clients can use to send files.
4. A data processing agreement and a confidentiality agreement are signed with the service provider.
5. The firm's practice software stays as it is.

The result: fewer email attachments, a clear overview and peace of mind with confidential documents.

Note

I'm an IT service provider and external information security officer, but not a lawyer. For the professional-law assessment, please talk to your chamber or a legal adviser. I'm happy to help with the technical side – more under Consulting.

Conclusion

Cloud and AI can be used well in law firms too – with clear contracts, a few simple rules and tools where you know where your data is. Open source is a reliable and pleasant foundation for this.

If you'd like to give it a try, I'm happy to help – just drop me a line.