Local AI for confidentiality professions (§203 StGB)
Timo Wevelsiep•Updated: 04.08.2026Editorial note: Versions, commands and prices may change. Please verify critical steps independently before production use. This guide does not replace individual consulting.
Set up controlled AI for a firm, practice or advisory business? WZ-IT designs local and dedicated systems with explicit data flows, permission checks, secured administration and documented operations. Legal assessment remains with the organisation and its advisers. Explore AI for confidentiality professionals
For confidentiality professions, AI touches not only data protection but criminally sanctioned secrecy under section 203 of the German Criminal Code. Cloud services are not prohibited across the board, and local systems are not automatically permitted. Disclosure, necessity, participants, contracts and technical safeguards are decisive. This is an assessment framework, not legal advice. As of August 2026.
Table of contents
- What makes confidentiality professions special
- What section 203 means for external IT providers
- Why cloud AI needs particular scrutiny
- What local AI improves and what it does not
- The professions at a glance
- What a clean setup looks like
- Operating models by protection need
- How WZ-IT supports the technical implementation
- Sources
What makes confidentiality professions special
Certain professions are subject under §203 StGB (the German Criminal Code) to a criminally sanctioned duty of secrecy that goes beyond general data protection obligations. These include, among others, lawyers, doctors and dentists, pharmacists, psychotherapists, tax advisors, auditors and notaries - as well as their professional assistants.
Unauthorised disclosure can be a criminal offence. Data protection and professional secrecy remain separate reviews: a data processing agreement alone does not settle section 203, and a confidentiality obligation does not create a GDPR legal basis.
What section 203 means for external IT providers
Section 203(3) expressly permits disclosure to other persons contributing to the professional activity where necessary for their work. Subsection (4) also covers those contributing persons and requires, among other things, appropriate confidentiality commitments.
That does not make every external AI service acceptable. Assess necessity, the exact secrets exposed, provider staff and subprocessors, administration and support locations, technical access and export capabilities, plus GDPR and profession-specific requirements.
Why cloud AI needs particular scrutiny
A cloud service may receive prompts, answers, documents and metadata, and may involve subprocessors, international transfers, telemetry or support access. An EU region or a “no training” statement does not answer all of those questions. Cloud AI can suit anonymised, non-secret or explicitly approved tasks. Processing client, patient or tax secrets requires an assessment of the exact service and configuration.
What local AI improves and what it does not
Local AI can reduce the number of external recipients. Inference, embeddings and retrieval can stay inside a controlled boundary, supporting minimisation and potentially avoiding international transfers.
The model location is only one layer. Updates, telemetry, observability, backups, remote administration and connected OCR, speech or web services can still communicate externally. Knowledge permissions must also be enforced before retrieval. A prompt instruction is not access control; see RAG with real permissions.
The professions at a glance
The requirements are similar, the details differ by profession - from professional codes to sector-specific rules. For the individual professions we have prepared the AI use concretely:
- Local AI in law firms
- Local AI in tax firms
- Local AI in medical practices
- Local AI for notaries
- Local AI in psychotherapy
Additional professional, chamber and sector rules vary by profession and use. They need to be assessed separately; architecture alone does not replace that work.
What a clean setup looks like
A dependable setup includes:
- Data flow and data classes for prompts, answers, documents, embeddings, logs and backups.
- Controlled model operation, local or dedicated, with only approved recipients.
- SSO and rights management using existing users, roles and groups.
- Technically enforced permissions for knowledge systems - not left to the model via a prompt.
- Minimal logging with defined retention and separate evaluation rights.
- Secured operations covering secrets, segmentation, patching, encrypted backups and tested restores.
- Governed support access with named contributing persons and traceable approvals.
- Matching documentation and contracts, including DPIA where required.
Operating models by protection need
| Model | Advantage | Key assessment |
|---|---|---|
| Public AI API | fast start | disclosure, subprocessors, transfers, retention |
| Dedicated managed instance | isolation and managed operations | administrators, keys, support and export |
| Own data centre | high technical control | internal rights, patching, backup and physical security |
| On-premises appliance | narrow local boundary | updates, remote support, replacement and recovery |
How WZ-IT supports the technical implementation
WZ-IT designs AI for confidentiality professionals from the trust boundary outward. The result may be an on-site AI Cube, a dedicated managed AI stack or integration with existing Proxmox, identity and network infrastructure.
We document data flows and administrative roles, implement SSO and permissions, restrict outbound traffic and establish monitoring, backup and recovery. This makes the system reviewable by data-protection and legal advisers without claiming automatic compliance from the hosting model.
Sources
Rather have it operated?
You'd rather not run Local & Sovereign AI yourself? WZ-IT handles setup, operations and maintenance - privacy-focused from Germany.
Enquiry
Assess an AI application and its infrastructure
We combine models, company knowledge, integrations, and operations into a reliable AI solution on your own or European infrastructure.
Frequently Asked Questions
Answers to the most important questions
Yes. Section 203 StGB does not prohibit AI; it prohibits unauthorised disclosure of third-party secrets. Purpose, data, recipients, necessity and safeguards matter. Local or dedicated systems can reduce the disclosure surface but do not replace the assessment under section 203, GDPR and applicable professional rules.
Because an external provider and potentially subprocessors may gain access to protected information. Section 203(3) allows other contributing persons to be involved where disclosure is necessary for their work; subsection (4) includes confidentiality obligations. GDPR, professional law, contracts and technical access must be assessed separately.
Local AI can reduce external recipients and international transfers. It is not sufficient alone: local systems still require access, logging and deletion controls, secured administration, backups, updates and a review of connected services. The entire processing chain is decisive.
Among others lawyers, doctors and dentists, pharmacists, psychotherapists, tax advisors, auditors and notaries, as well as their professional assistants. They are subject to a criminally sanctioned duty of secrecy that goes beyond general data protection obligations - and that demands particular care in deploying AI.
No. Location and jurisdiction matter, but so do the contractual chain, necessity, subprocessors, administration and support access, encryption, key control and exports. A self-hosted system can also disclose data through telemetry or external add-ons.
A documented data flow and permissions design, controlled model and document processing, SSO and least privilege, matter or tenant isolation, data-minimised logs, encrypted backups, governed support access, and tested deletion and recovery. Contracts and records must match the actual technology.
More on Local & Sovereign AI
- The open-source LLM stack
- What is LiteLLM?
- What is Langfuse?
- What is vLLM?
- vLLM vs. Ollama
- What is RAG?
- Connect Open WebUI to Nextcloud (RAG with ACLs)
- What is local AI?
- Cloud AI vs. self-hosted
- AI sovereignty for companies
- Which LLM to self-host?
- Sizing GPU & VRAM
- Inference vs. Training
- Qdrant vs. pgvector
- The EU AI Act for companies
- Local AI for confidentiality professions
- Processing documents with AI
- AI agents & automation
- RAG with permissions
- Chatbot or knowledge navigator?
- AI agents: permissions and approvals
- AI assistants and the works council
