25.06.2026
Local AI for Tax Firms: §203, Client Data and RAG
How tax firms can process documents, correspondence and internal knowledge with local AI.
Client emails, receipts and payroll data are sensitive. We set up a local AI platform with controlled data sources, roles and documented access paths.
Sorting, assigning and preparing client emails and incoming receipts takes time. When AI is used, the resulting data paths must be deliberately limited.
A DPA with a cloud provider does not define how data flows, source permissions and §203 are implemented technically.
Client data is among the most sensitive data there is - a leak becomes a matter for professional supervision and costs trust you cannot win back.
We configure and operate AI Cube Pro for GDPR- and §203-compliant use when required. This includes controlled data paths, limited permissions, documented maintenance, the appropriate DPA and written secrecy obligations for the people involved.
§203 StGB protects confidential information entrusted by clients, patients and other parties. The necessary involvement of contributing persons is permitted. What matters is that access is limited to what is necessary, the people involved are bound to secrecy and the complete data and maintenance path is controlled.
With public AI services, inputs and documents leave your own infrastructure. Whether a service is suitable in a specific case therefore depends not only on a DPA, but also on data flows, subprocessors, access permissions and the actual use.
On-premises inference, local vector search and internally operated interfaces keep technical processing in your controlled environment. This reduces external data paths and subprocessors and allows access to be limited precisely.
When we provide setup or operations as a contributing person, the people involved accept a written secrecy obligation and are instructed about the criminal consequences. Where personal data is involved, this is combined with a DPA, limited administrative rights and documented maintenance paths.
These technical and contractual building blocks form part of the agreed §203 scope:
Data-protection layer
Secrecy and instruction on criminal consequences
necessary rights, logging and controlled paths
This content is general information and not legal or tax advice. The specific implementation under §203 must be reviewed professionally on a case-by-case basis.
Staff receive a familiar AI chat with local models and dedicated knowledge areas. DATEV connections, document workflows and automated RAG pipelines are planned as a separate integration scope.

Ready for use in under two weeks after configuration approval
EUR 5,999 excl. VAT
RAG, data sources, integrations, secure connectivity and custom workflows are scoped separately.
Optional managed operations from EUR 149.90 excl. VAT per AI Cube and month; §203 scopes include a DPA, limited administrative rights, written secrecy obligations for the people involved and instruction on the criminal consequences
These examples describe possible workflows. Data sources, permissions and professional review are defined for the concrete use case.
Sovereign AI is a lifecycle, not a device purchase - and everything stays on your infrastructure.
Workshop, sizing, data classification and §203 contract framework. We understand your stack, professional software and compliance requirements before we recommend.
On-premise build on your hardware, RAG on your documents with access control, integration into your professional software, secrecy obligation + DPA.
Updates, monitoring, model upgrades and RAG maintenance as a service contract - or you operate fully yourself. Handover and knowledge transfer included.
From hardware and inference through RAG and integration to operations and security - no interface ping-pong between advice, build and operations.
Describe the workflow and data that should be processed locally or in a controlled environment.
From local AI integration to architecture, data sovereignty and ongoing operations.
Whether a specific IT challenge or just an idea - we look forward to the exchange. In a brief conversation, we'll evaluate together if and how your project fits with WZ-IT.
No risk: worst case, you leave with a clearer understanding of your project than before.


“WZ-IT's advice on our Azure migration was technically sound and completely non-binding right from the intro call - we took away a great deal.”