If you develop software for law firms, medical practices or tax advisory firms, sooner or later a customer asks whether the product complies with § 203 of the German Criminal Code (StGB). The question usually comes at the moment an AI feature moves into the product, such as a summary of legal briefs, a draft letter to a client or the analysis of a doctor’s letter. By then, the data protection questions are often settled, with data processing agreements and servers in the EU.
§ 203 StGB protects professional secrets at the software provider and the inference provider as well
Separately from this, criminal law governs who may see a secret that was confided. Doctors, lawyers, tax advisors, notaries and other professionals bound by secrecy commit a criminal offence if they disclose without authorisation another person’s secret that was confided to them or otherwise became known to them (§ 203 StGB). This expressly includes trade and business secrets. The duty of confidentiality stands alongside data protection law, and a data processing agreement therefore answers the customer’s question only in part.
The mere possibility that a third party takes note of the content is enough for a disclosure. Whether they actually read it makes no difference. A language model connected via API sees the complete prompt, that is, the brief or the doctor’s letter itself.
Since a reform in 2017, professionals bound by secrecy may pass other people’s secrets on to service providers involved in their professional activity, to the extent this is necessary for the service. The law calls them other persons involved. This covers, for example, anyone who operates or maintains IT systems, and equally anyone interposed in a multi-tier engagement who can gain knowledge of the secret.
The software provider and the inference provider it connects via API are therefore both persons involved as soon as they process the customer’s secrets. The inference provider is the company that runs a language model on its servers and processes the requests. For an open model such as DeepSeek, this is, for example, a European cloud provider that runs the model in its own data centre. The model developer is a person involved only if it receives access to the requests itself.
Several companies thus stand between the law firm and the inference provider, and each of them must be bound to confidentiality. The explanatory memorandum to the 2017 bill speaks of an “unbroken chain of contracts between the professional bound by secrecy and the person ultimately performing the work” (our translation). Figure 1 shows this chain of contracts for software with an AI feature.
-
Law firm / practice
§ 203(1)
Professional bound by secrecy
-
Software provider
Bound ✓
Person involved, contract with the law firm
-
AI gateway
Bound ✓
Person involved, contract with the software provider
-
Inference provider
Bound ✓
Person involved, runs the model
Professional law requires a contract with a duty of confidentiality
Criminal law and professional law set different standards for what the obligation of confidentiality must look like. Criminal law accepts any obligation to maintain secrecy and requires no particular form. The professional statutes for lawyers, tax advisors, auditors, patent attorneys and notaries, by contrast, prescribe a contract in text form, for lawyers in § 43e of the Federal Lawyers’ Act (BRAO), for example.
The contract binds the service provider to confidentiality and informs it of the criminal consequences of a breach. It limits the provider’s knowledge of other people’s secrets to what is necessary to perform the contract. And it determines whether the service provider may engage further persons, whom it then in turn binds to confidentiality in text form.
For doctors, the professional code of conduct requires a written obligation, and all professionals bound by secrecy can obtain the consent of their clients or patients instead.
The software provider’s subcontractors must be bound to confidentiality as well
Passing data on rarely ends with the software provider. Its AI feature runs at an inference provider, which in turn may have its own subcontractors. The law carries the obligation forward at every tier. The professional bound by secrecy ensures that the person involved they engage has been bound to secrecy. If that person in turn engages another person involved, the same duty applies to it (§ 203(4) sentence 2 StGB). The software provider therefore binds its inference provider, and the inference provider binds its own subcontractors.
The contract with the inference provider passes on the duty of confidentiality and rules out training
Every prompt goes to the inference provider, so the contract with it is the first measure. In it, the software provider binds the inference provider to confidentiality, as its own contract with the customer requires for further persons.
In addition, the contract must rule out the provider using the data for training. The German Bar Association expressly requires this rule in its statement 32/2025, because training on client data is unlikely to meet the threshold of necessity.
A subprocessor register shows the customer the status of every obligation
The customer must select its service provider carefully and needs a list of subcontractors for this, often called a subprocessor register. For each entry, the register states the name and role, the registered office of the company and the headquarters of its group, the region of processing and the status of the confidentiality obligation. These details follow from what data protection law and professional law require of the customer.
The group is listed because, even with servers in the EU, a parent company in a third country can gain de facto access through intra-group rights to issue instructions. Whenever this list changes, the software provider must inform its customers in advance so that they can object (Art. 28(2) GDPR).
| Provider | Based in | Region | § 203 obligation |
|---|---|---|---|
| Gateway | Based in Germany | Region Germany | § 203 Bound ✓ |
| Inference provider A | Based in Germany | Region EU | § 203 Bound ✓ |
| Inference provider B | Based in Netherlands | Region EU | § 203 Missing |
| Data centre | Based in Germany | Region Frankfurt | § 203 Bound ✓ |
How Noirdoc meets these requirements
Noirdoc is a gateway between the software and the inference providers. We anchor confidentiality under § 203 StGB in our contracts, with our employees, our own service providers and the inference providers in the catalogue. If a provider lacks the agreement, we filter it out for professionals bound by secrecy. All subprocessors are listed with the status of their obligation in the subprocessor register in Annex 4 of our Data Processing Agreement (DPA). If an organisation counts as bound by secrecy, the gateway forwards its requests only to bound providers from our catalogue, even during an outage. In addition, each API key can be restricted to bound providers and specific models. A software provider can thus serve law firms on one route and customers without a duty of confidentiality on another.
Inference runs at providers with data centres in Germany and the EU. Neither we nor the providers store prompts and responses once the response is delivered (zero retention), and training on the data is excluded by contract. If a provider deviates from this, we state it for each model. For billing and evidence, we log every request with timestamp, provider, model and region, without prompt and response.