25.06.2026
Local AI for Law Firms: §203, Case Data and RAG
How local RAG systems unlock case knowledge, cite sources and preserve matter-level permissions in every answer.
Case-law research, draft pleadings and case knowledge are sensitive. We set up a local AI platform with controlled data sources, roles and documented access paths.
Client emails, pleadings and research cost hours - but putting case data into ChatGPT or Copilot lacks what §43e BRAO requires of a service provider: a written obligation, instruction on the consequences, careful selection and oversight.
A DPA alone does not define how client separation, source permissions and the §203 framework are implemented technically.
With external AI services, providers, subprocessors, storage locations and possible third-country transfers must be assessed. A locally configured platform can reduce those external data paths.
We configure and operate AI Cube Pro for GDPR- and §203-compliant use when required. This includes controlled data paths, limited permissions, documented maintenance, the appropriate DPA and written secrecy obligations for the people involved.
§203 StGB protects confidential information entrusted by clients, patients and other parties. The necessary involvement of contributing persons is permitted. What matters is that access is limited to what is necessary, the people involved are bound to secrecy and the complete data and maintenance path is controlled.
With public AI services, inputs and documents leave your own infrastructure. Whether a service is suitable in a specific case therefore depends not only on a DPA, but also on data flows, subprocessors, access permissions and the actual use.
On-premises inference, local vector search and internally operated interfaces keep technical processing in your controlled environment. This reduces external data paths and subprocessors and allows access to be limited precisely.
When we provide setup or operations as a contributing person, the people involved accept a written secrecy obligation and are instructed about the criminal consequences. Where personal data is involved, this is combined with a DPA, limited administrative rights and documented maintenance paths.
These technical and contractual building blocks form part of the agreed §203 scope:
Data-protection layer
Secrecy and instruction on criminal consequences
necessary rights, logging and controlled paths
This content is general information and not legal or tax advice. The specific implementation under §203 must be reviewed professionally on a case-by-case basis.
AI Cube Pro provides chat, local models and dedicated knowledge areas within the firm network. DMS connections, automated RAG pipelines and client separation are implemented separately after reviewing the existing systems.

Ready for use in under two weeks after configuration approval
EUR 5,999 excl. VAT
RAG, data sources, integrations, secure connectivity and custom workflows are scoped separately.
Optional managed operations from EUR 149.90 excl. VAT per AI Cube and month; §203 scopes include a DPA, limited administrative rights, written secrecy obligations for the people involved and instruction on the criminal consequences
These examples describe possible workflows. Data sources, permissions and professional review are defined for the concrete use case.
Sovereign AI is a lifecycle, not a device purchase - and everything stays on your infrastructure.
Workshop, sizing, data classification and §203 contract framework. We understand your stack, professional software and compliance requirements before we recommend.
On-premise build on your hardware, RAG on your documents with access control, integration into your professional software, secrecy obligation + DPA.
Updates, monitoring, model upgrades and RAG maintenance as a service contract - or you operate fully yourself. Handover and knowledge transfer included.
From hardware and inference through RAG and integration to operations and security - no interface ping-pong between advice, build and operations.
Describe the workflow and data that should be processed locally or in a controlled environment.
From local AI integration to architecture, data sovereignty and ongoing operations.
Whether a specific IT challenge or just an idea - we look forward to the exchange. In a brief conversation, we'll evaluate together if and how your project fits with WZ-IT.
No risk: worst case, you leave with a clearer understanding of your project than before.


“WZ-IT's advice on our Azure migration was technically sound and completely non-binding right from the intro call - we took away a great deal.”