--- title: "AI APIs for Law Firms: BRAO Compliance Guide Germany (2026)" description: "Using AI APIs as a German law firm: what §43a BRAO, §43e BRAO, and GDPR require for ChatGPT, Claude, and other AI tools in legal practice." image: "https://compound.law/assets/images/og-image-en.webp" source: "https://compound.law/en-DE/compliance/ai-api-brao-law-firms/" language: "en" --- ![AI API BRAO compliance guide for German law firms](https://compound.law/assets/images/compliance/compliance_4.webp) compliance # AI APIs for Law Firms: BRAO Compliance Guide Germany (2026) 8 April 2026 Short answer German law firms can use AI APIs including ChatGPT, Claude, and Gemini, but §43a BRAO's Verschwiegenheitspflicht applies — client data sent to an external API is a transfer to a third-party processor, requiring a DPA, subprocessor review, and a documented confidentiality architecture before going live. - §43a BRAO's duty of confidentiality applies whenever client data reaches an external AI API. - §43e BRAO requires lawyers to maintain professional supervision over any AI-assisted work product. - A DPA under Art. 28 GDPR is mandatory but not sufficient — a BRAO-specific confidentiality analysis must accompany it. **German law firms can use AI APIs** — including ChatGPT (OpenAI API), Claude (Anthropic API), and Gemini — but **§43a BRAO’s Verschwiegenheitspflicht** applies the moment client data enters an external model. That transfer constitutes outsourcing to a third-party processor under both professional conduct rules and **Art. 28 GDPR**, which means a DPA, subprocessor review, and a BRAO-compliant confidentiality architecture are required before going live. Firms that treat AI APIs as off-the-shelf software without this structure face serious professional liability exposure. This guide explains what **BRAO**, **BORA**, and **GDPR** require for AI API deployments in law firms — and what a compliant setup actually looks like in practice. ## Can German Law Firms Use AI APIs? Yes — with the right structure. There is no statutory provision in the **Bundesrechtsanwaltsordnung** that prohibits German lawyers from using AI APIs. The **Bundesrechtsanwaltskammer (BRAK)** confirmed this in its December 2024 guidance: AI tools are permissible, provided firms address professional secrecy, supervision, data protection, and transparency obligations in a coherent deployment model. The critical point is that “using AI APIs” is not a single legal question. The answer depends entirely on: - what data enters the API (public research vs. active client matter files) - how the provider relationship is structured contractually - where data is processed and retained - what human oversight is in place - how the firm documents the above A law firm that uses an AI API to help draft template clauses in a sandboxed environment faces a very different legal analysis from one that pipes raw matter files, correspondence, and personal data into an API without classification or controls. ## §43a BRAO: Verschwiegenheitspflicht and AI APIs **§43a BRAO** codifies the lawyer’s **Verschwiegenheitspflicht** — the professional duty of confidentiality covering everything the lawyer learns in the course of their mandate. This duty does not end at the firm’s server boundary. It extends to every third party that processes mandate-related information on behalf of the lawyer. When client data is sent to an external AI API, the provider processes that information as a **service provider**. Under §43a(2) BRAO, the lawyer must ensure that third parties involved in mandate-related activities are bound to equivalent confidentiality obligations. ### What this means in practice A BRAO-compliant AI API deployment requires: - a **written contract** with the provider that includes an explicit confidentiality commitment covering client data - a **DPA under Art. 28 GDPR** specifying what data may be processed, for what purpose, and with which subprocessors - **purpose limitation**: the provider must not use client data for model training or product improvement without explicit consent - **access controls** that prevent unauthorised internal or provider-side access to matter data - **deletion logic** that is documented and technically enforced The BRAK’s 2024 guidance specifically calls out foreign service providers as a focus area — firms using US-headquartered providers need to pay particular attention to cross-border transfer mechanisms and the contractual protection of confidentiality alongside GDPR safeguards. ### What does not satisfy §43a BRAO Signing a DPA alone is not sufficient under §43a BRAO. The DPA covers data protection law. It does not automatically satisfy the professional confidentiality obligations under BRAO unless the contract also contains explicit provisions limiting provider access to mandate data, prohibiting secondary use, and committing the provider to equivalent confidentiality standards. ## §43e BRAO: Supervision of AI-Assisted Legal Work **§43e BRAO**, introduced as part of the modernisation of the professional rules, requires lawyers to exercise appropriate **professional supervision** over AI-assisted work. A lawyer who delegates drafting, research, or analysis to an AI system remains fully professionally responsible for the result. The practical implications are significant: - **AI-generated documents** (contracts, pleadings, legal opinions) require qualified lawyer review before release - **legal conclusions** produced by an AI must be verified by the responsible lawyer - **AI-generated citations or legal references** must be checked for accuracy before they are relied upon - **external communications** to clients, courts, or counterparties may not be sent without approval by the responsible professional §43e BRAO does not prohibit AI-assisted workflows — it requires **meaningful human oversight**. A workflow in which lawyers use an AI API to accelerate research, produce first drafts, or compare clause alternatives, subject to consistent professional review, is structurally sound. A workflow in which AI outputs flow directly to clients or courts without review is not. ### AI literacy under the EU AI Act **Article 4 of the EU AI Act**, which has applied since **2 February 2025**, requires providers and deployers to ensure that staff working with AI systems have sufficient AI literacy. For law firms, this means training lawyers and paralegals on: - the capabilities and limitations of the specific AI tools in use - hallucination risk and how to identify unreliable outputs - the professional rules that apply to AI-assisted outputs - the firm’s internal approval and escalation procedures This is not a one-time briefing — it requires a documented and maintained training approach. ## BORA §2: Independence and Professional Integrity **BORA §2** protects the lawyer’s professional independence. AI tool selection can create subtle conflicts if vendors position themselves in ways that influence legal decision-making, create dependency, or condition tool access on commercial relationships. Law firms selecting AI APIs should ensure that: - tool selection follows an objective vendor review, not marketing relationships - AI recommendations on legal strategy are clearly flagged as tool output, not legal judgment - no vendor lock-in prevents the firm from switching providers if the contractual or compliance position changes - the selected tools do not create undisclosed conflicts with client interests In practice, BORA §2 concerns are most relevant for law firms building AI-powered client-facing products or integrating AI into mandate management workflows at scale. ## Attorney-Client Privilege and AI APIs **Legal professional privilege** in Germany protects mandate-related communications and strategies from disclosure. When client data is processed by an external AI provider, privilege does not automatically extend to cover that provider’s infrastructure, staff, or records. This creates a specific risk: if a provider’s systems are subject to law enforcement requests, data breach exposure, or regulatory inspection in another jurisdiction, privilege may not protect the underlying client information from being accessed or disclosed. Law firms should assess: - whether the chosen provider can be subjected to data access demands outside Germany or the EU - whether mandate data at rest in provider infrastructure is adequately protected - how the firm would respond to a provider-side incident affecting client confidentiality For **cross-border matters** and sensitive mandates (litigation, M\&A, regulatory defence, criminal matters), this analysis is especially important. Firms handling such mandates should document why the chosen API deployment is compatible with their privilege and confidentiality obligations for those specific matter types. ## GDPR Requirements for Law Firms Using AI APIs AI API usage in a legal context almost always involves **personal data** — client names, financial data, employee information, counterparty details, or case facts. This triggers the full GDPR framework alongside BRAO. Key requirements: ### Data Processing Agreement (Art. 28 GDPR) A **DPA** is mandatory when a law firm uses an AI provider to process personal data as a processor. The DPA must specify: data categories, processing purpose, subprocessors, security measures, deletion timelines, and support access restrictions. ### Legal Basis Law firms typically rely on **Art. 6(1)(b) GDPR** (contract performance) or **Art. 6(1)(c)** (legal obligation) for processing client personal data. Using that same data in an AI API workflow may require analysis of whether the basis extends to the AI processing step — particularly if the provider uses data for purposes beyond direct service delivery. ### Special Categories of Data Legal matters frequently involve **Art. 9 GDPR** special category data — health information, criminal proceedings, trade union membership, or financial distress. Processing these through an AI API requires explicit legal basis and heightened security measures. ### Data Protection Impact Assessment (Art. 35 GDPR) A **DPIA** is required when processing is likely to create a high risk to individuals’ rights. For law firms, this threshold is frequently met when: - large volumes of sensitive client data are processed systematically - the AI system analyses or profiles individuals - criminal, health, or financial data is involved The DPIA must precede the processing — not follow it. ### Cross-Border Transfers Where AI providers process data outside the EEA, law firms must ensure an adequate transfer mechanism: **adequacy decision, Standard Contractual Clauses (SCCs), or Binding Corporate Rules**. This is a live issue for US-headquartered providers. The contractual basis must be documented and verifiable. ## Which AI APIs Are BRAO-Compatible? An Evaluation Framework There is no official list of BRAO-approved AI APIs. Compliance depends on the specific deployment, not the provider alone. The following framework helps law firms assess any AI API: | Criterion | What to check | | -------------------------- | ----------------------------------------------------- | | **DPA** | Available, current, covers relevant data categories | | **Data region** | EU or German processing available and selected | | **Subprocessors** | Disclosed with specificity; changes notified | | **Training use** | Client data not used for model training | | **Retention** | Processing limited; deletion schedules documented | | **Security** | SOC 2, ISO 27001 or equivalent; breach notification | | **Support access** | Human support access to content restricted and logged | | **Confidentiality clause** | Explicit contractual commitment, not just DPA terms | **OpenAI API**, **Anthropic API**, and **Azure OpenAI** all offer DPAs and are used by German law firms. But compliance is not a provider-level conclusion — it depends on the specific architecture, region selection, data categories involved, and surrounding contractual and operational controls. ## Subprocessor Risk for Law Firms All major AI providers use subprocessors — cloud infrastructure, monitoring tools, security services. For law firms, each subprocessor in the processing chain is a potential confidentiality and GDPR exposure point. Before going live, a law firm should: - **obtain the subprocessor list** from the provider and assess whether any subprocessor creates a conflict with mandate confidentiality - **verify that Art. 28 GDPR obligations flow down** to subprocessors contractually - **monitor subprocessor changes** — providers are required to notify customers of new subprocessors in advance; law firms should have a change-monitoring process - **assess jurisdiction**: where subprocessors are headquartered and operate can affect privilege, data access risk, and transfer compliance For sensitive practice areas, the subprocessor analysis may justify selecting a provider with a shorter, EU-anchored subprocessor chain over one with global infrastructure. ## Internal Governance: What Your Law Firm Needs A BRAO-compliant AI API deployment is not just about external contracts. Internal governance is equally important: ### AI Acceptable Use Policy Every law firm using AI APIs should have a written **AI acceptable use policy** covering: - which AI tools are approved and for which data categories - what is never permitted (e.g., uploading unredacted client files, sharing matter strategies) - prompt rules and output handling - logging and record-keeping requirements - escalation and incident response procedures ### Works Agreement If the firm employs staff, introducing AI tools that monitor, evaluate, or affect working conditions may require a **Betriebsvereinbarung** under the Betriebsverfassungsgesetz. Legal and HR teams should assess this before rollout. ### DPIA As noted above, a DPIA is required for high-risk processing scenarios. Even where not strictly mandatory, a **lightweight privacy impact review** before rollout is good practice and reduces subsequent exposure. ### Staff Training Combine BRAO supervision requirements with **AI Act Art. 4 AI literacy** obligations: train all users on the tools in use, the professional rules that apply, and the firm’s internal approval process for AI-assisted outputs. ## Checklist: BRAO-Compliant AI API Deployment Use this checklist before going live with any AI API in a law firm: 1. **Define the use case** — research, drafting, summarisation, or client-facing? Which data categories? 2. **Classify the data** — establish what may never enter an API, what requires redaction, and what can be used more freely 3. **Review the vendor** — DPA, subprocessors, data region, training use, retention, support access 4. **Conduct a BRAO confidentiality analysis** — map §43a BRAO obligations to the specific deployment model 5. **Assess GDPR requirements** — legal basis, transfer mechanics, DPIA if applicable 6. **Negotiate the contract** — ensure confidentiality commitments go beyond the DPA template 7. **Set internal roles and approval flows** — who may use the API, who reviews AI outputs, who authorises release 8. **Draft an AI acceptable use policy** — approved uses, prohibited uses, escalation paths 9. **Document AI literacy measures** under Art. 4 EU AI Act 10. **Run a limited pilot** before full rollout ## When to Bring in External Counsel External support adds particular value when: - the firm plans to process active matter files or personal data systematically through an AI API - the project involves cross-border processing or US-headquartered providers - the firm wants to build a client-facing AI product or automated external communications - sensitive practice areas are involved (criminal defence, regulatory, employment, M\&A) - the firm’s works council must be engaged before rollout At that point, the question moves beyond compliance hygiene to **professional responsibility design** — and a documented legal basis for the specific deployment becomes essential. ## Related Reading - [AI APIs for Law Firms in Germany: Compliance Guide](https://compound.law/en-DE/compliance/ai-apis-for-law-firms-germany/) - [AI Legal Research Tools: Compliance Guide](https://compound.law/en-DE/compliance/ai-legal-research/) - [AI Act for Legal Services](https://compound.law/en-DE/ai-act/legal-services/) - [OpenAI API for German Companies](https://compound.law/en-DE/tools/openai-api/) - [Anthropic API for German Companies](https://compound.law/en-DE/tools/anthropic-api/) - [Azure OpenAI for German Companies](https://compound.law/en-DE/tools/azure-openai/) ## FAQ ### Does §43a BRAO prohibit German law firms from using AI APIs? No. **§43a BRAO does not prohibit AI API usage**. It requires that client data shared with external providers is contractually protected to the same standard as mandate information generally — through a DPA, explicit confidentiality commitment, purpose limitation, and access controls. A blanket prohibition does not exist; a compliance obligation does. ### What does §43e BRAO require for AI-assisted legal work? **§43e BRAO** requires that the responsible lawyer supervises AI-assisted work and remains professionally accountable for every legally relevant output. AI can assist drafting, research, or analysis, but a qualified lawyer must review the result before it is released internally or externally. ### Is a DPA enough for BRAO compliance when using AI APIs? No. A **DPA covers GDPR obligations** but does not automatically satisfy the professional confidentiality requirements under §43a BRAO. Law firms need the DPA plus an explicit contractual confidentiality commitment, purpose limitation on mandate data, and a documented operational model — not just a signed template agreement. ### Do German law firms need a DPIA before deploying AI APIs? A **DPIA** under Art. 35 GDPR is required when processing is likely to result in a high risk to individuals. For law firms processing sensitive client data (health, criminal, financial) systematically through an AI API, the threshold is likely met. Even where not strictly required, a privacy impact review before rollout is strongly advisable. ### Can German law firms use ChatGPT or Claude under BRAO? Yes, in principle. The decisive factors are: Does the provider offer a DPA with EU data residency? Are subprocessors disclosed and EU-anchored? Is data excluded from model training? Can the firm structure the deployment to satisfy §43a BRAO’s confidentiality requirements? **The provider is not the compliance answer — the deployment model is.** ### What is the BRAK’s position on AI tools for law firms? The **Bundesrechtsanwaltskammer** issued guidance in December 2024 confirming that AI tools are permissible but require careful assessment against **§43e BRAO**, professional secrecy, GDPR, and transparency obligations. The BRAK does not prohibit AI API usage but emphasises that firms must examine provider selection, contract structure, confidentiality protection, and mandate-data governance before going live. ## Next Step Compound Law advises law firms and legal departments on **BRAO-compliant AI deployments** — from vendor review and DPA negotiation to internal AI policies, GDPR assessments, and EU AI Act readiness. If your firm is planning an AI API rollout, a structured pre-deployment review is the right starting point. *This article provides general legal information only and does not constitute legal advice. For guidance on your specific situation, please consult a qualified lawyer.* ## Related Compliance Guides [![GDPR-compliant AI implementation for businesses in Germany](https://compound.law/assets/images/compliance/compliance_1.webp)](https://compound.law/en-DE/compliance/gdpr-compliant-ai-businesses-germany/) [Guides](https://compound.law/en-DE/compliance/gdpr-compliant-ai-businesses-germany/) ### [GDPR-Compliant AI in Germany: A Practical Guide for 2026](https://compound.law/en-DE/compliance/gdpr-compliant-ai-businesses-germany/) [GDPR-compliant AI means a lawful basis, transparency, a DPA, controlled transfers and a DPIA where risk is high. The 2026 guide for German companies.](https://compound.law/en-DE/compliance/gdpr-compliant-ai-businesses-germany/) [![EU AI Act training obligation and Article 4 AI literacy in Germany](https://compound.law/assets/images/compliance/compliance_2.webp)](https://compound.law/en-DE/compliance/ai-act-schulungspflicht/) [compliance](https://compound.law/en-DE/compliance/ai-act-schulungspflicht/) ### [EU AI Act Training Obligation: What Article 4 Requires](https://compound.law/en-DE/compliance/ai-act-schulungspflicht/) [EU AI Act training obligation under Article 4: who it covers in Germany, what AI literacy measures to implement, and how to document compliance.](https://compound.law/en-DE/compliance/ai-act-schulungspflicht/) [![AI legal counsel in Germany for company AI procurement](https://compound.law/assets/images/compliance/compliance_3.webp)](https://compound.law/en-DE/compliance/ai-legal-counsel-germany/) [Guides](https://compound.law/en-DE/compliance/ai-legal-counsel-germany/) ### [AI Legal Counsel in Germany for Companies](https://compound.law/en-DE/compliance/ai-legal-counsel-germany/) [AI legal counsel in Germany helps companies handle EU AI Act, GDPR, DPA, procurement, and rollout risk before signing or launching AI tools.](https://compound.law/en-DE/compliance/ai-legal-counsel-germany/) ## Frequently asked questions No. §43a BRAO does not prohibit AI API usage, but it requires law firms to ensure that client data sent to an external provider is protected through a DPA, contractual confidentiality commitments, and access controls — just as with any other outsourcing arrangement. §43e BRAO requires that the responsible lawyer maintains professional supervision over AI-assisted outputs. AI tools may support legal work, but a qualified lawyer must review, approve, and take responsibility for any legally relevant result. No. A DPA is one necessary layer, but law firms also need a BRAO-specific confidentiality analysis, data classification, internal usage rules, access controls, and documented human review procedures. A DPIA under Art. 35 GDPR is required when processing is likely to result in a high risk to individuals. For law firms processing large volumes of sensitive client data through an AI API, a DPIA is likely necessary. Yes, in principle. The key questions are: Does the provider offer a DPA? Are subprocessors disclosed? Where is data processed? Is data used for model training? And can the firm document a BRAO-compliant confidentiality structure for the specific use case? The BRAK issued guidance in December 2024 noting that law firms must assess AI tools carefully against §43e BRAO, professional secrecy, GDPR, and transparency requirements — but stopping short of a blanket prohibition on AI API usage. ## Structured data ```json [ { "@context": "https://schema.org", "@type": [ "Organization", "LegalService" ], "@id": "https://compound.law/#organization", "name": "Compound Law", "alternateName": "Compound Law — AI Law Firm", "url": "https://compound.law/", "logo": { "@type": "ImageObject", "url": "https://compound.law/press/logos/PNG/Compound_Law_Icon.png", "width": 1024, "height": 1024 }, "image": "https://compound.law/assets/images/og-image.webp", "description": "The AI-native law firm in Berlin for start-ups, mid-sized companies and corporates: commercial and contract law, data protection, the EU AI Act, trademarks, corporate law, and restructuring and insolvency. A lawyer reviews every result, billed at a flat fee.", "foundingDate": "2026", "founder": [ { "@type": "Person", "name": "Marko Bradic", "jobTitle": "CEO", "url": "https://compound.law/en-DE/tech-team/marko-bradic/", "sameAs": [ "https://www.linkedin.com/in/markobradic/" ], "knowsAbout": [ "Product strategy and development", "Scaling technology companies", "FinTech and financial services", "AI-powered product innovation", "Business operations and growth", "Digital transformation" ] }, { "@type": "Person", "name": "Mohit Tilwani", "jobTitle": "CTO", "url": "https://compound.law/en-DE/tech-team/mohit-tilwani/", "sameAs": [ "https://www.linkedin.com/in/mohit-tilwani/" ], "knowsAbout": [ "Engineering leadership and architecture", "Scaling high-traffic systems", "AI and machine learning infrastructure", "FinTech platform development", "Cloud infrastructure and DevOps", "Product engineering" ] }, { "@type": "Person", "name": "Julian Jantze", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/julian-jantze/", "sameAs": [ "https://www.linkedin.com/in/julian-jantze-957b95158/" ], "knowsAbout": [ "Corporate law and corporate governance for technology companies", "Employment law and HR compliance", "EU AI Act compliance and AI governance", "Employee participation models (VSOP/ESOP)", "Regulatory compliance for tech companies", "Legal operations and Legal Tech implementation" ] } ], "employee": [ { "@type": "Person", "name": "Marko Bradic", "jobTitle": "CEO", "url": "https://compound.law/en-DE/tech-team/marko-bradic/", "sameAs": [ "https://www.linkedin.com/in/markobradic/" ], "knowsAbout": [ "Product strategy and development", "Scaling technology companies", "FinTech and financial services", "AI-powered product innovation", "Business operations and growth", "Digital transformation" ] }, { "@type": "Person", "name": "Mohit Tilwani", "jobTitle": "CTO", "url": "https://compound.law/en-DE/tech-team/mohit-tilwani/", "sameAs": [ "https://www.linkedin.com/in/mohit-tilwani/" ], "knowsAbout": [ "Engineering leadership and architecture", "Scaling high-traffic systems", "AI and machine learning infrastructure", "FinTech platform development", "Cloud infrastructure and DevOps", "Product engineering" ] }, { "@type": "Person", "name": "Julian Jantze", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/julian-jantze/", "sameAs": [ "https://www.linkedin.com/in/julian-jantze-957b95158/" ], "knowsAbout": [ "Corporate law and corporate governance for technology companies", "Employment law and HR compliance", "EU AI Act compliance and AI governance", "Employee participation models (VSOP/ESOP)", "Regulatory compliance for tech companies", "Legal operations and Legal Tech implementation" ] }, { "@type": "Person", "name": "Marc Schuba", "jobTitle": "Founding Partner, Rechtsanwalt (German attorney)", "url": "https://compound.law/en-DE/lawyers/marc-schuba/", "sameAs": [ "https://www.linkedin.com/in/marcschuba/" ], "knowsAbout": [ "IP and IT law", "SaaS and IT contracts, IT outsourcing", "Software and open-source licensing", "Data protection law (GDPR)", "AI law and the EU AI Act" ] }, { "@type": "Person", "name": "Dr. Markus Dreißigacker", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/markus-dreissigacker/", "sameAs": [ "https://www.linkedin.com/in/markusdreissigacker" ], "knowsAbout": [ "M&A (Due diligence, post-merger integration, IPO readiness)", "Corporate Law (Governance, board work, restructuring)", "Commercial Law (Customer contracts, supplier agreements, NDAs)", "IP (Trademark management, IP transfer agreements)", "Compliance & ESG (Global compliance programs, human rights, sustainability)", "Data Protection (GDPR strategy, DPO experience, privacy programs)" ] }, { "@type": "Person", "name": "Philipp Brandt", "jobTitle": "Partner, Rechtsanwalt (German attorney), Specialist Lawyer for Intellectual Property Law", "url": "https://compound.law/en-DE/lawyers/philipp-brandt/", "sameAs": [ "https://www.linkedin.com/in/philipp-brandt-81b446a/" ], "knowsAbout": [ "Restructuring and insolvency law (crisis advice for management, protective shield and insolvency plan proceedings, insolvency administration)", "Intellectual property (trademarks, unfair competition, copyright, trade secrets, licence agreements)", "Data protection law (data breaches, regulatory fine proceedings, access and damages claims)", "Distribution and commercial law (distribution agreements, acquisition and sale of industrial plants)" ] } ], "address": { "@type": "PostalAddress", "addressLocality": "Berlin", "addressCountry": "DE" }, "areaServed": [ "Germany", "Austria", "Switzerland", "European Union", "United Kingdom", "United States", "Singapore" ], "availableLanguage": [ "de", "en" ], "serviceType": [ "AI law firm", "AI-native legal services", "legal counsel for start-ups and growth companies", "legal counsel for mid-sized companies and corporates", "Commercial Law", "Corporate Law", "Employment Law", "Regulatory & Compliance", "Intellectual Property", "Insolvency & Restructuring" ], "hasOfferCatalog": { "@type": "OfferCatalog", "name": "Compound Law services", "itemListElement": [ { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Commercial Contracts", "description": "Battle-tested contracts for your sales process", "serviceType": [ "enterprise contracts", "MSA", "DPA", "sales contracts" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "International Employment", "description": "Compliant hiring across borders", "serviceType": [ "international employment", "hiring abroad", "employment contracts" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "VSOP/ESOP Setup", "description": "Employee participation that actually works", "serviceType": [ "VSOP", "ESOP", "employee stock options", "equity incentives" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Funding Round Support", "description": "Clean legal for your next raise", "serviceType": [ "funding round", "term sheet", "SHA", "due diligence", "cap table" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Corporate Housekeeping", "description": "Get your legal house in order", "serviceType": [ "corporate governance", "board resolutions", "shareholder register" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Data Protection & Privacy", "description": "GDPR compliance that doesn't slow you down", "serviceType": [ "GDPR", "data protection", "privacy", "DPA", "cookies", "data breach response", "GDPR fines", "Art. 82 GDPR" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "AI Act Compliance", "description": "Navigate EU AI regulation", "serviceType": [ "AI Act", "AI compliance", "AI governance", "EU AI regulation" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "IP & Competition", "description": "Protect and enforce what you've built", "serviceType": [ "IP protection", "intellectual property", "trademarks", "trademark enforcement", "warning letters", "preliminary injunctions", "unfair competition", "software licensing", "open source compliance" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Fractional General Counsel", "description": "In-house legal without the full-time cost", "serviceType": [ "fractional GC", "fractional general counsel", "outsourced legal", "legal retainer" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "FinTech Compliance", "description": "Navigate financial regulation", "serviceType": [ "fintech compliance", "BaFin", "banking regulation", "AML", "KYC" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Legal Retainer", "description": "Predictable legal support when you need it", "serviceType": [ "legal retainer", "legal subscription", "ongoing legal support" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "M&A Preparation", "description": "Get ready for acquisition interest", "serviceType": [ "M&A preparation", "acquisition", "due diligence", "exit" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Restructuring & Insolvency", "description": "From the first liquidity check to the restructuring itself", "serviceType": [ "restructuring", "insolvency", "StaRUG", "self-administration", "insolvency plan", "director liability" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } } ] }, "contactPoint": { "@type": "ContactPoint", "contactType": "sales", "email": "contact@compound.law", "availableLanguage": [ "English", "German" ], "areaServed": [ "DE", "AT", "CH", "EU", "GB", "US", "SG" ] }, "email": "contact@compound.law", "sameAs": [ "https://www.linkedin.com/company/compoundlawfirm", "https://x.com/CompoundLawFirm" ], "knowsAbout": [ "Commercial Contracts", "enterprise contracts", "MSA", "DPA", "sales contracts", "International Employment", "international employment", "hiring abroad", "employment contracts", "VSOP/ESOP Setup", "VSOP", "ESOP", "employee stock options", "equity incentives", "Funding Round Support", "funding round", "term sheet", "SHA", "due diligence", "cap table", "Corporate Housekeeping", "corporate governance", "board resolutions", "shareholder register", "Data Protection & Privacy", "GDPR", "data protection", "privacy", "cookies", "data breach response", "GDPR fines", "Art. 82 GDPR", "AI Act Compliance", "AI Act", "AI compliance", "AI governance", "EU AI regulation", "IP & Competition", "IP protection", "intellectual property", "trademarks", "trademark enforcement", "warning letters", "preliminary injunctions", "unfair competition", "software licensing", "open source compliance", "Fractional General Counsel", "fractional GC", "fractional general counsel", "outsourced legal", "legal retainer", "FinTech Compliance", "fintech compliance", "BaFin", "banking regulation", "AML", "KYC", "Legal Retainer", "legal subscription", "ongoing legal support", "M&A Preparation", "M&A preparation", "acquisition", "exit", "Restructuring & Insolvency", "restructuring", "insolvency", "StaRUG", "self-administration", "insolvency plan", "director liability" ] }, { "@context": "https://schema.org", "@type": "Article", "headline": "AI APIs for Law Firms: BRAO Compliance Guide Germany (2026)", "description": "Using AI APIs as a German law firm: what §43a BRAO, §43e BRAO, and GDPR require for ChatGPT, Claude, and other AI tools in legal practice.", "image": "https://compound.law/assets/images/compliance/compliance_4.webp", "datePublished": "2026-04-08T00:00:00.000Z", "dateModified": "2026-04-08T00:00:00.000Z", "author": { "@type": "Person", "name": "Dr. Markus Dreißigacker", "image": "https://compound.law/assets/images/team/markusdreissigacker.webp" }, "publisher": { "@type": "Organization", "@id": "https://compound.law/#organization", "name": "Compound Law" }, "mainEntityOfPage": { "@type": "WebPage", "@id": "https://compound.law/en-DE/compliance/ai-api-brao-law-firms/" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://compound.law/en-DE/" }, { "@type": "ListItem", "position": 2, "name": "Compliance Guides", "item": "https://compound.law/en-DE/compliance/" }, { "@type": "ListItem", "position": 3, "name": "AI APIs for Law Firms: BRAO Compliance Guide Germany", "item": "https://compound.law/en-DE/compliance/ai-api-brao-law-firms/" } ] }, { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "Does §43a BRAO prohibit German law firms from using AI APIs?", "acceptedAnswer": { "@type": "Answer", "text": "No. §43a BRAO does not prohibit AI API usage, but it requires law firms to ensure that client data sent to an external provider is protected through a DPA, contractual confidentiality commitments, and access controls — just as with any other outsourcing arrangement." } }, { "@type": "Question", "name": "What does §43e BRAO require for AI-assisted legal work?", "acceptedAnswer": { "@type": "Answer", "text": "§43e BRAO requires that the responsible lawyer maintains professional supervision over AI-assisted outputs. AI tools may support legal work, but a qualified lawyer must review, approve, and take responsibility for any legally relevant result." } }, { "@type": "Question", "name": "Is a DPA enough for BRAO compliance when using AI APIs?", "acceptedAnswer": { "@type": "Answer", "text": "No. A DPA is one necessary layer, but law firms also need a BRAO-specific confidentiality analysis, data classification, internal usage rules, access controls, and documented human review procedures." } }, { "@type": "Question", "name": "Do German law firms need a DPIA before deploying AI APIs?", "acceptedAnswer": { "@type": "Answer", "text": "A DPIA under Art. 35 GDPR is required when processing is likely to result in a high risk to individuals. For law firms processing large volumes of sensitive client data through an AI API, a DPIA is likely necessary." } }, { "@type": "Question", "name": "Can German law firms use ChatGPT or Claude under BRAO?", "acceptedAnswer": { "@type": "Answer", "text": "Yes, in principle. The key questions are: Does the provider offer a DPA? Are subprocessors disclosed? Where is data processed? Is data used for model training? And can the firm document a BRAO-compliant confidentiality structure for the specific use case?" } }, { "@type": "Question", "name": "What is the Bundesrechtsanwaltskammer's position on AI tools?", "acceptedAnswer": { "@type": "Answer", "text": "The BRAK issued guidance in December 2024 noting that law firms must assess AI tools carefully against §43e BRAO, professional secrecy, GDPR, and transparency requirements — but stopping short of a blanket prohibition on AI API usage." } } ] } ] ```