[{"data":1,"prerenderedAt":402},["ShallowReactive",2],{"navigation-docs_en":3,"/en/blog/microsoft-365-copilot-law-firms-tax-advisors-professional-secrecy-2026-posts_en":51,"/en/blog/microsoft-365-copilot-law-firms-tax-advisors-professional-secrecy-2026-surround-posts_en":391},[4],{"title":5,"path":6,"stem":7,"children":8,"page":25},"En","/en","en",[9],{"title":10,"path":11,"stem":12,"children":13,"page":25},"Docs","/en/docs","en/1.docs",[14,26],{"title":15,"path":16,"stem":17,"children":18,"icon":25},"Getting Started","/en/docs/getting-started","en/1.docs/1.getting-started/1.index",[19,21],{"title":20,"path":16,"stem":17,"children":-1},"Introduction",{"title":22,"path":23,"stem":24,"children":-1},"Migration Roadmap","/en/docs/getting-started/migration-fahrplan","en/1.docs/1.getting-started/2.migration-fahrplan",false,{"title":27,"path":28,"stem":29,"children":30,"page":25},"Technologies","/en/docs/technologies","en/1.docs/2.technologies",[31,35,39,43,47],{"title":32,"path":33,"stem":34,"children":-1},"Nextcloud","/en/docs/technologies/nextcloud","en/1.docs/2.technologies/1.nextcloud",{"title":36,"path":37,"stem":38,"children":-1},"Matrix / Element","/en/docs/technologies/matrix","en/1.docs/2.technologies/2.matrix",{"title":40,"path":41,"stem":42,"children":-1},"ONLYOFFICE","/en/docs/technologies/onlyoffice","en/1.docs/2.technologies/3.onlyoffice",{"title":44,"path":45,"stem":46,"children":-1},"Ubuntu Linux","/en/docs/technologies/ubuntu","en/1.docs/2.technologies/4.ubuntu",{"title":48,"path":49,"stem":50,"children":-1},"Keycloak","/en/docs/technologies/keycloak","en/1.docs/2.technologies/5.keycloak",{"id":52,"title":53,"authors":54,"badge":60,"body":62,"date":353,"description":354,"extension":355,"faq":356,"howto":366,"image":383,"meta":385,"navigation":386,"path":387,"seo":388,"stem":389,"__hash__":390},"posts_en/en/3.blog/28.microsoft-365-copilot-law-firms-tax-advisors-professional-secrecy-2026.md","Cloud and AI in Law Firms – What Matters for Professional Secrecy",[55],{"name":56,"to":57,"avatar":58},"Michael Wolf","/en/about",{"src":59},"/michael.webp",{"label":61},"Guide",{"type":63,"value":64,"toc":341},"minimark",[65,69,73,78,90,106,109,113,116,176,179,183,186,213,217,220,254,257,261,287,291,294,311,314,318,327,331,334],[66,67,53],"h1",{"id":68},"cloud-and-ai-in-law-firms-what-matters-for-professional-secrecy",[70,71,72],"p",{},"Law firms, tax offices and other professionals bound by secrecy work with especially confidential information. At the same time, like everyone else, they want to use modern tools: cloud storage, video calls, AI assistants. These fit together well if you keep a few things in mind. Here's a calm overview, based on the situation in Germany.",[74,75,77],"h2",{"id":76},"why-law-firms-are-a-special-case","Why law firms are a special case",[70,79,80,81,85,86,89],{},"Lawyers, tax advisers, doctors and other professions are subject to a special ",[82,83,84],"strong",{},"duty of confidentiality",". In Germany, it's set out among other places in ",[82,87,88],{},"§ 203 of the Criminal Code (StGB)",". There are specific rules for involving service providers – such as an IT provider or a cloud service:",[91,92,93,100],"ul",{},[94,95,96,99],"li",{},[82,97,98],{},"§ 43e BRAO"," for lawyers",[94,101,102,105],{},[82,103,104],{},"§ 62a StBerG"," for tax advisers",[70,107,108],{},"Put simply: service providers may be involved if they're carefully selected and bound to confidentiality. You'll find the exact requirements in the legal text and in your chamber's guidance.",[74,110,112],{"id":111},"what-this-means-for-cloud-services","What this means for cloud services",[70,114,115],{},"For any cloud service, it's worth looking at these questions:",[117,118,119,132],"table",{},[120,121,122],"thead",{},[123,124,125,129],"tr",{},[126,127,128],"th",{},"Question",[126,130,131],{},"Why it matters",[133,134,135,144,152,160,168],"tbody",{},[123,136,137,141],{},[138,139,140],"td",{},"Is there a data processing agreement?",[138,142,143],{},"Covers the data protection side",[123,145,146,149],{},[138,147,148],{},"Is there a confidentiality agreement?",[138,150,151],{},"Covers the professional-law side",[123,153,154,157],{},[138,155,156],{},"Where is the data stored?",[138,158,159],{},"Helps assess the legal framework",[123,161,162,165],{},[138,163,164],{},"Who has access?",[138,166,167],{},"Subprocessors count too",[123,169,170,173],{},[138,171,172],{},"How is the data encrypted?",[138,174,175],{},"Good encryption adds protection",[70,177,178],{},"Many large providers offer special agreements for professionals bound by secrecy. Whether they fit your use is best clarified with your chamber or a lawyer.",[74,180,182],{"id":181},"and-ai-assistants","And AI assistants?",[70,184,185],{},"AI can be really useful in a law firm – for drafts, summaries or research, for example. But with client data, special care is needed. A few simple ground rules:",[187,188,189,195,201,207],"ol",{},[94,190,191,194],{},[82,192,193],{},"Clear team rules:"," Which data may go into which tool?",[94,196,197,200],{},[82,198,199],{},"Anonymise:"," Leave out names and case numbers wherever possible.",[94,202,203,206],{},[82,204,205],{},"Check results:"," AI can be wrong – especially with legal details.",[94,208,209,212],{},[82,210,211],{},"Consider local AI:"," An assistant on your own hardware keeps the data in-house.",[74,214,216],{"id":215},"how-open-source-can-help-in-a-law-firm","How open source can help in a law firm",[70,218,219],{},"A nice way to keep control is open-source software on a server you know – in the office or in a German data centre:",[91,221,222,227,236,242,248],{},[94,223,224,226],{},[82,225,32],{}," for files, documents and sharing with clients (with password and expiry date)",[94,228,229,232,233,235],{},[82,230,231],{},"Collabora"," or ",[82,234,40],{}," for editing briefs in the browser",[94,237,238,241],{},[82,239,240],{},"Element"," for confidential internal communication",[94,243,244,247],{},[82,245,246],{},"Vaultwarden"," for all of the firm's passwords",[94,249,250,253],{},[82,251,252],{},"Local AI"," with Ollama or the Nextcloud Assistant",[70,255,256],{},"Practice software like DATEV or RA-MICRO stays as it is, of course. Open source takes care of everything around it.",[74,258,260],{"id":259},"a-few-terms-briefly-explained","A few terms, briefly explained",[91,262,263,269,275,281],{},[94,264,265,268],{},[82,266,267],{},"Professionals bound by secrecy:"," People with a professional duty of confidentiality, such as lawyers, tax advisers or doctors.",[94,270,271,274],{},[82,272,273],{},"Contributing person:"," Anyone who works with a professional bound by secrecy or is involved as a service provider and may come into contact with confidential information.",[94,276,277,280],{},[82,278,279],{},"Confidentiality agreement:"," An agreement in which a service provider explicitly commits to confidentiality.",[94,282,283,286],{},[82,284,285],{},"End-to-end encryption:"," Only the sender and recipient can read the content.",[74,288,290],{"id":289},"an-example-from-a-small-law-firm","An example from a small law firm",[70,292,293],{},"A firm with three lawyers and two staff wants to exchange documents with clients more securely. Until now, many documents went back and forth by email. The firm opts for a Nextcloud in a German data centre:",[187,295,296,299,302,305,308],{},[94,297,298],{},"Each matter gets its own folder with clear permissions.",[94,300,301],{},"Clients receive share links with a password and expiry date.",[94,303,304],{},"For uploads, there's a \"drop box\" link clients can use to send files.",[94,306,307],{},"A data processing agreement and a confidentiality agreement are signed with the service provider.",[94,309,310],{},"The firm's practice software stays as it is.",[70,312,313],{},"The result: fewer email attachments, a clear overview and peace of mind with confidential documents.",[74,315,317],{"id":316},"note","Note",[70,319,320,321,326],{},"I'm an IT service provider and external information security officer, but not a lawyer. For the professional-law assessment, please talk to your chamber or a legal adviser. I'm happy to help with the technical side – more under ",[322,323,325],"a",{"href":324},"/en/consulting","Consulting",".",[74,328,330],{"id":329},"conclusion","Conclusion",[70,332,333],{},"Cloud and AI can be used well in law firms too – with clear contracts, a few simple rules and tools where you know where your data is. Open source is a reliable and pleasant foundation for this.",[70,335,336,337,326],{},"If you'd like to give it a try, I'm happy to help – ",[322,338,340],{"href":339},"/en/contact","just drop me a line",{"title":342,"searchDepth":343,"depth":343,"links":344},"",2,[345,346,347,348,349,350,351,352],{"id":76,"depth":343,"text":77},{"id":111,"depth":343,"text":112},{"id":181,"depth":343,"text":182},{"id":215,"depth":343,"text":216},{"id":259,"depth":343,"text":260},{"id":289,"depth":343,"text":290},{"id":316,"depth":343,"text":317},{"id":329,"depth":343,"text":330},"2026-09-08T00:00:00.000Z","Law firms and tax offices handle especially confidential data. What matters when using cloud and AI, and how open source can help.","md",[357,360,363],{"q":358,"a":359},"Are law firms allowed to use cloud services at all?","In principle, yes. German professional law allows service providers to be involved if certain conditions are met. These include, among other things, binding the provider to confidentiality. The details are set out in § 43e BRAO for lawyers and § 62a StBerG for tax advisers.",{"q":361,"a":362},"Is a normal data processing agreement enough?","The GDPR data processing agreement covers data protection. For professionals bound by secrecy, professional-law requirements come on top, such as an explicit confidentiality agreement. What that means in your case is best clarified with your professional chamber or a lawyer.",{"q":364,"a":365},"Can I use AI assistants in my firm?","Many firms use AI for drafts or research. With client data, special care is needed. One option is an AI assistant that runs on your own hardware, so the data stays in-house.",{"name":367,"description":368,"totalTime":369,"steps":370},"Setting up a law firm's IT with confidence","Four steps to use cloud and AI in your firm with peace of mind.","P4W",[371,374,377,380],{"name":372,"text":373},"List services","List which cloud services and AI tools are used in the firm.",{"name":375,"text":376},"Check contracts","For each provider, check whether a data processing agreement and a confidentiality agreement are in place.",{"name":378,"text":379},"Set rules","Agree together which data may go into which tools.",{"name":381,"text":382},"Consider your own solutions","For especially confidential data, consider a solution on your own server or with a carefully chosen European provider.",{"src":384},"/img/blog/photo-1589829545856-d10d557cf95f.webp",{},true,"/en/blog/microsoft-365-copilot-law-firms-tax-advisors-professional-secrecy-2026",{"title":53,"description":354},"en/3.blog/28.microsoft-365-copilot-law-firms-tax-advisors-professional-secrecy-2026","xqtz9oZt2jhYD9TGt-S0fQjulkRP_NCcbu_CEk_ip1M",[392,397],{"title":393,"path":394,"stem":395,"description":396,"children":-1},"What Municipal Utilities Show Us – Structured Security with Open Source","/en/blog/municipal-utilities-nis2-energy-microsoft-365-sovereign-alternative-2026","en/3.blog/27.municipal-utilities-nis2-energy-microsoft-365-sovereign-alternative-2026","Energy suppliers take IT security especially seriously. The ideas behind it and how small businesses can put them into practice with open source.",{"title":398,"path":399,"stem":400,"description":401,"children":-1},"Open Source at Universities – What They Do and What You Can Use","/en/blog/universities-opendesk-microsoft-365-dmk-review-autumn-2026","en/3.blog/29.universities-opendesk-microsoft-365-dmk-review-autumn-2026","Many universities run their own cloud, chat and learning platforms with open source. An overview and ideas for your own everyday life.",1792720367329]