May lawyers enter client data into ChatGPT?

That depends on the specific service, the contracts and how the provider is involved under §43e BRAO and Section 203 StGB; the firm makes that assessment with its legal advisers. The BRAK AI guideline offers orientation. With local AI, input is not sent to an external model provider; on request, WZ-IT accepts a written secrecy obligation for setup and maintenance.

Is a DPA with OpenAI or Microsoft enough?

A DPA is only one part of the assessment. For case data, data flows, subprocessors, permissions and the §203 framework must also be considered.

Can the AI separate clients and matters?

This is possible with an appropriate role, group and source architecture. Whether permissions can be enforced down to matter or document level depends on the connected source and its interfaces.

How is §203 addressed technically?

Through local processing, clearly separated data sources, roles, audit logs and documented maintenance access. You align the specific legal framework with your professional advisers.

How long does setup take?

We usually deliver the AI Cube fully preconfigured within ten working days after configuration approval. Professional-software connections, automated RAG pipelines or larger infrastructure are planned separately.

How are you legally involved?

We document data flows, roles, technical safeguards and operational responsibility. Where personal data is processed, we conclude the appropriate DPA; on request, the people involved also accept a written secrecy obligation under Section 203 StGB, including instruction on the criminal consequences.

What does it cost to get started?

The AI Cube costs from €7,999 excl. VAT one-time for the 1 TB version, including setup, briefing and shipping. On top of that comes AI Cube Care at from €349.90 excl. VAT / month for patching, backup, monitoring and support; the first twelve months run with the device, cancellable monthly after that. Integrations and larger deployments are quoted separately.

Can we operate the AI ourselves later?

Yes. We hand over with documentation and train your team. For the AI Cube, AI Cube Care runs for the first twelve months with the device and can be cancelled monthly after that; you can then take over operation yourselves. For other deployments, we agree maintenance, updates, model upgrades and RAG upkeep as needed.

Local AI for law firms: research, pleadings and case knowledge inside your own network

Case data is subject to lawyers' professional secrecy. We set up an AI platform inside the firm network, with approved data sources, roles and documented access paths.

Local processing with controllable data paths
Connect firm software and DMS as a scoped project
No billing per token or per user

Assess the use case View the AI Cube

Reviews

IT Beratung Service Consulting Soforthilfe

Customers from mid-sized business, industry and the public sector, in Germany and internationally

Read client reviews

The situation

Client confidentiality and AI: what must be settled first

Client emails, pleadings and research cost hours. Before case data goes into ChatGPT or Copilot, it must be clear whether the service meets the requirements §43e BRAO sets for service providers: careful selection, a secrecy obligation in text form and instruction on the criminal consequences.
A DPA alone does not define how client separation, source permissions and the §203 framework are implemented technically.
With external AI services, providers, subprocessors, storage locations and possible third-country transfers must be assessed. A locally configured platform reduces those external data paths.

Use cases

AI in the law firm: use cases and what changes

These examples describe workflows. Data sources, permissions and professional review are defined for the concrete use case; review and approval stay with you.

Case-law and precedent research via semantic search (RAG)

Today

Case law, earlier pleadings and opinions are pieced together from databases, file shares and colleagues.

With local AI

The AI searches approved pleadings, opinions and case collections and names the sources for you to review.

Draft pleadings and opinions from your templates

Today

Drafts are produced by copying and adapting old templates.

With local AI

A first draft is built from the facts and the firm template. Review, edits and approval stay with the lawyer.

Deadline and inquiry triage

Today

Incoming client emails are read one by one, assigned to the matter and prioritised.

With local AI

The AI summarises requests and suggests the matter and urgency. Deadlines are still checked and recorded by the firm.

RAG over approved case files or a DMS after reviewing interfaces and source permissions
Contract analysis and clause review
Internal knowledge base: new staff find answers to typical cases

Our approach

Advise. Build. Operate. From one team.

Sovereign AI is a lifecycle, not a device purchase: advice, build and operations come from one team.

01
Advise & design
Workshop, sizing, data classification and §203 contract framework. We understand your stack, professional software and compliance requirements before we recommend.
02
Build & integrate
On-premise build on your hardware, RAG on your documents with access control, integration into your professional software. Plus the DPA and, on request, a written secrecy obligation under Section 203 StGB.
03
Operate & maintain
Updates, monitoring, model upgrades and RAG upkeep in ongoing operation. For the AI Cube, AI Cube Care runs with the device for the first twelve months and is cancellable monthly after that; handover to your team and knowledge transfer included.

Legal framework

Local AI for GDPR and Section 203 requirements

We configure and operate the local AI platform for the agreed GDPR and Section 203 scope, as an AI Cube or on your own infrastructure. This includes controlled data paths, limited permissions, documented maintenance, the appropriate DPA and, on request, written secrecy obligations for the people involved. Legal evaluation of the specific use remains with the controller and its advisers.

What §203 StGB prohibits
§203 StGB protects confidential information entrusted by clients, patients and other parties. The necessary involvement of contributing persons is permitted. What matters is that access is limited to what is necessary, the people involved are bound to secrecy and the complete data and maintenance path is controlled.
Why cloud AI is the problem
With public AI services, inputs and documents leave your own infrastructure. Whether a service is suitable in a specific case therefore depends not only on a DPA, but also on data flows, subprocessors, access permissions and the actual use.
Why local processing helps
On-premises inference, local vector search and internally operated interfaces keep technical processing in your controlled environment. This reduces external data paths and subprocessors and allows access to be limited precisely.
Managed service with a secrecy obligation
When we provide setup or operations as a contributing person, the people involved accept a written secrecy obligation and are instructed about the criminal consequences. Where personal data is involved, this is combined with a DPA, limited administrative rights and documented maintenance paths.

What we deliver for it: AVV (data-protection layer) · Written secrecy obligation (secrecy and instruction on criminal consequences) · Maintenance and access concept (necessary rights, logging and controlled paths).

This content is general information and not legal or tax advice. The specific implementation under §203 must be reviewed professionally on a case-by-case basis.

AI Cube

AI Cube as a local platform for firm knowledge

AI Cube provides chat, local models and dedicated knowledge areas within the firm network. DMS connections, automated RAG pipelines and client separation are implemented separately after reviewing the existing systems.

Delivered ready to use within 10 working daysfrom €7,999 excl. VAT one-timeDevice, setup, briefing and shipping

AI Cube

Compact AI appliance on NVIDIA GB10 with 128 GB unified memory and 1 TB NVMe
Open WebUI with knowledge bases, groups and roles
A local language model, a fast model for short tasks and an embedding model
Hardened system, firewall, HTTPS on the local network
Remote maintenance through NetBird, logged and switchable
Handover documentation, a briefing and shipping to Germany, Austria and Switzerland
Two-year manufacturer warranty

AI Cube Care

Care: from €349.90 excl. VAT / month

View the AI Cube

Beyond that

Without your own hardware

AI platform hosted in Germany

The same tasks as a hosted platform with a Section 203 contract chain, cancellable monthly.

from €149.90 excl. VAT / monthView the AI platform →Operable for the long term

Operations by WZ-IT

AI Cube Care · first year accompanied, then cancellable monthly AI Cube Care keeps the device running: a monthly maintenance window, tested model updates with a rollback path, round-the-clock monitoring, ticket support and warranty handling. The data processing agreement under Art. 28 GDPR comes with the order; for confidentiality professionals the written secrecy obligation is available on request under Section 203 (4) of the German Criminal Code, including instruction on the criminal consequences; on request remote access stays switched off by default.

View the AI Cube →

Frequently asked questions about AI in law firms

Answers to the most important questions

What clients say about working with us

From a knowledge base with an AI assistant and local AI integration to data sovereignty and ongoing operations.

AI Platform

We were looking for a secure yet easy-to-use alternative to the large American providers and came across WZ-IT. WZ-IT advised us on choosing the right models and implemented the integration for us. Beforehand, we were able to try everything out calmly on a test instance. Today WZ-IT runs Open WebUI for us on our own domain, with a convenient Microsoft login and open-source models hosted by a German provider. Our team can now work productively with AI without resorting to external tools or shadow AI. Working together is straightforward, and questions are answered quickly and clearly. With WZ-IT we also have a partner at our side for further AI projects. (translated)

Carl-Frederic KornHead of E-Commerce & Online Marketing, Krüger Dirndl GmbH

See the AI platform

Knowledge Management & AI

The knowledge from many years in the solar industry lived in the head of our former managing director, and it still lives in the heads of our employees today. We wanted to secure it, not as a folder full of notes, but in a way that lets us ask questions in daily work and get reliable answers. WZ-IT advised us from the start and weighed different approaches and knowledge management systems against each other with us before we decided. What was built is a custom knowledge base with an AI assistant that brings together conversations, notes, documentation and manuals: from the platform through onboarding our team to support in operation. Conversations are transcribed and facts are extracted; we review and correct everything ourselves before it is stored, because we do not want to trust an AI blindly. The system runs in our own environment, and the data stays with us. What surprised us was how efficient it was: WZ-IT used existing open-source software and extended it specifically for our requirements, instead of selling an expensive custom build from scratch, as is often usual with IT service providers. Timo and Robin understood our actual problem, preserving knowledge during the generational handover, and implemented it step by step: from the proof of concept through setup and validation with our own data to productive operation, explaining everything clearly along the way. Next, we want to extend this to the knowledge of our employees, so that this does not depend on individual people either.

Joshua von AmelnManaging Director, solarwerkstatt berlin GmbH

See knowledge transfer

Read client reviews

International

Selected projects

WZ-IT designs, develops and operates infrastructure and software for clients in Germany and internationally. We deliver projects remotely and continue supporting them in ongoing operations after go-live.

Enquiry

Assess local AI for Law Firm

Describe the workflow and data that should be processed locally or in a controlled environment.

Straight with Timo and Robin - no sales team, no pitch
A professional assessment of your situation
Concrete next steps for infrastructure, software or AI

The conversation is free and non-binding.

WZ-IT's advice on our Azure migration was technically sound and completely non-binding right from the intro call - we took away a great deal.

Jakob ÖschlbergerInno7 GmbH

Email[email protected]Phone+49 2922 875068

WZ-IT's advice on our Azure migration was technically sound and completely non-binding right from the intro call - we took away a great deal.

Jakob ÖschlbergerInno7 GmbH

Local AI for law firms: research, pleadings and case knowledge inside your own network

Client confidentiality and AI: what must be settled first

AI in the law firm: use cases and what changes

Case-law and precedent research via semantic search (RAG)