--- title: "Section 43e BRAO Explained: AI API Requirements for German Law Firms (2026)" description: "Section 43e BRAO permits law firms to use AI APIs under strict conditions: confidentiality, §203 StGB, no-training clauses, and deletion rules." image: "https://compound.law/assets/images/og-image-en.webp" source: "https://compound.law/en-DE/compliance/section-43e-brao-ai/" language: "en" --- ![Section 43e BRAO compliance requirements for AI tools in German law firms](https://compound.law/assets/images/compliance/compliance_2.webp) compliance # Section 43e BRAO Explained: AI API Requirements for German Law Firms (2026) 11 April 2026 Short answer Section 43e BRAO permits law firms to use AI APIs for mandate-related work provided the service provider is bound in writing to professional confidentiality, warned of criminal liability under §203 StGB, contractually prohibited from using mandate data for AI training, and subject to documented subprocessor and. - Section 43e BRAO applies to every AI API that processes mandate data — regardless of provider or contract label. - A §203 StGB warning in the service provider contract is a mandatory professional-conduct requirement — a GDPR DPA alone does not satisfy it. - Client consent under Section 43e(5) BRAO is required where mandate data is processed beyond the specific scope of the instruction. **Section 43e of the Bundesrechtsanwaltsordnung (BRAO)** — Germany’s Federal Lawyers’ Act — permits law firms to involve external service providers, including AI API vendors such as OpenAI, Anthropic, and Microsoft Azure OpenAI, in mandate-related work, provided specific contractual and oversight conditions are met. The § symbol (*Paragraph-Zeichen*) is the standard German statutory reference marker; “§43e BRAO” simply means Section 43e of the BRAO statute. Section 43e BRAO requires law firms to bind service providers in writing to professional confidentiality, warn them of criminal liability under §203 StGB (the German Criminal Code), exclude mandate data from AI training, regulate subprocessors, and document deletion and exit terms — all before any client data reaches an external AI system. ## What Does Section 43e BRAO Regulate? Section 43e BRAO was introduced by the **BRAO Reform Act of 2022**, effective 1 August 2022. It closed a longstanding gap in German professional conduct rules: prior to the reform, there was no explicit statutory basis allowing lawyers to engage external service providers for mandate-related tasks without risking a breach of professional secrecy. **Section 43e(1) BRAO** authorises lawyers to engage service providers that assist in processing information subject to the professional duty of confidentiality under **§43a(2) BRAO** — the Verschwiegenheitspflicht, the core professional secrecy obligation that binds every German lawyer. The statute expressly references **information processing systems**, which covers AI APIs, cloud platforms, legal analytics software, and external document platforms. > **Quick reference — What is BRAO?** The Bundesrechtsanwaltsordnung is the federal statute governing the legal profession in Germany: bar admission, professional conduct, disciplinary proceedings, and the structure of regional bar associations (Rechtsanwaltskammern). The § symbol in German law corresponds to “section” or “article” in English legal systems. Section 43e BRAO is the central professional-conduct provision for AI tool usage in German law firms. The permission to use external service providers exists — but only together with the obligations in subsection (3). ## Why Section 43e BRAO Applies to Every AI API Deployment As soon as a law firm sends mandate data — case facts, draft briefs, contract terms, party information — to an external AI API, it has engaged a **service provider** within the meaning of Section 43e(1) BRAO. What matters is not the contract label or the provider’s business model. The operative question is: has confidential client information left the law firm’s sphere and reached a third party? The link to **§43a BRAO** is decisive. Section 43a(2) BRAO requires lawyers to protect mandate secrecy even with respect to third parties they bring in to assist with client work. Section 43e BRAO operationalises that duty for the digital environment, specifying how the obligation must be implemented contractually and organisationally when external processors are involved. **Practical consequence:** No AI API deployment involving client data is permissible without a Section 43e BRAO-compliant contractual foundation — whether the tool is an AI writing assistant, a legal research API, an automated document review system, or an AI-powered client communications platform. This applies equally to self-hosted models that use external inference infrastructure. ## Requirements Under Section 43e(3) BRAO Section 43e(3) BRAO defines the minimum contractual and organisational requirements that must be in place before any mandate data is transferred to an external AI provider. ### Written Obligation with §203 StGB Warning The service provider must be **bound in writing to professional confidentiality**. Beyond this, the contract must explicitly warn the provider of **criminal liability under §203 StGB** — the provision that makes the unauthorised disclosure of professional secrets a criminal offence, including for persons to whom a professional secret-holder has disclosed information. This requirement goes well beyond a standard Data Processing Agreement (DPA) under Art. 28 GDPR. A DPA contains no §203 StGB warning. Law firms must supplement the provider contract with this professional-conduct element — either as a standalone clause or in a separate professional-rules annex. ### No-Training Clause and Purpose Limitation Mandate data may only be processed by the service provider **for the specific purpose of the engagement**. Any use for model improvement, internal analysis, or AI training is incompatible with Section 43e BRAO. For AI API deployments, this requires an explicit **no-training clause** in the contract. Many major providers exclude training use in their API terms by default — but that contractual position must be verified, documented, and actively monitored. A vendor website statement does not replace a contractual commitment. ### Subprocessor Rules Section 43e(3) BRAO requires the primary service provider to **bind its own subprocessors to equivalent obligations**. AI providers routinely rely on cloud infrastructure, monitoring tools, and security services from third parties. For law firms, the chain of confidentiality and purpose-limitation obligations must be traceable through the entire processing chain. Law firms should request and review the **subprocessor list** from the AI provider and verify that all downstream processors are contractually bound to equivalent professional-secrecy standards. ### Deletion and Exit Arrangements The provider contract must specify when and how mandate data is deleted — both on an ongoing basis (temporary storage, logs, inference buffers) and upon contract termination. **Exit arrangements** — the secure handover or destruction of all stored mandate data on provider change — must be agreed in writing and implemented technically. ## Client Consent Under Section 43e(5) BRAO — When Is It Required? Section 43e(5) BRAO addresses a specific scenario: where the service provider processes mandate data **beyond the scope of the specific instruction**, or where using that service provider would not be recognisably acceptable to the client, **explicit client consent** is required. For AI APIs, this threshold is not automatically reached simply because AI is used in the workflow. Engaging IT service providers for mandate-related work is both legally permissible and common. Consent becomes necessary when: - mandate data is analysed for purposes outside the direct instruction (e.g. product analytics, model fine-tuning) - the provider stores data or uses it for its own commercial purposes - AI outputs are passed to clients without the AI involvement being apparent - particularly sensitive data (criminal defence, M\&A, trade secrets) is transferred to external systems **BRAK guidance from December 2024** recommends that law firms proactively inform clients when sensitive data categories are involved — even where formal Section 43e(5) BRAO consent is not strictly required in every individual case. Transparency is professionally sound and the practical foundation for client trust. ## Section 43e BRAO and GDPR — How Do They Interact? Section 43e BRAO and **Art. 28 GDPR** protect different legal interests and apply cumulatively. A DPA alone does not satisfy Section 43e BRAO requirements. | Requirement | Section 43e BRAO | Art. 28 GDPR (DPA) | | ------------------------ | ---------------------------------------- | ---------------------------- | | Legal basis | Professional conduct law (BRAO) | Data protection law (GDPR) | | Protected interest | Lawyer’s professional secrecy, §203 StGB | Personal data of individuals | | §203 StGB warning | Required | Not provided for | | No-training clause | Required | Not mandatory | | Purpose limitation | Required | Required (Art. 28(3)(b)) | | Subprocessor obligations | Required | Required (Art. 28(4)) | | Deletion terms | Required | Required | Law firms need both instruments: a DPA for the GDPR framework and a Section 43e BRAO-compliant confidentiality clause for professional conduct compliance. The **DAV (German Bar Association) position statement of 2025** explicitly noted that professional conduct law imposes higher standards than GDPR alone — a DPA-only contract structure does not fulfil the professional conduct requirements. ## Section 43e BRAO Compliance Checklist for AI Tools Before deploying any AI API with mandate data, law firms should confirm each of the following: 1. **Section 43e BRAO clause** in the service provider contract — written confidentiality obligation with explicit §203 StGB warning 2. **No-training clause** expressly agreed — mandate data is excluded from model training and product improvement 3. **Purpose limitation** documented — no processing beyond the specific engagement scope 4. **Subprocessors** identified, listed, and contractually bound to equivalent obligations 5. **Deletion and exit terms** agreed in writing and technically implemented 6. **DPA under Art. 28 GDPR** in place — complementary to Section 43e BRAO, not a substitute 7. **Client consent assessment** under Section 43e(5) BRAO — conducted, particularly for sensitive data categories 8. **Internal AI acceptable use policy** in place — approved tools, prohibited data categories, approval procedures 9. **AI literacy documentation** under Art. 4 EU AI Act — staff training on tools in use is verifiable 10. **Pilot operation** with defined test matters before full rollout ## Further Reading - [BRAO-Compliant AI Deployment: Full Guide](https://compound.law/en-DE/compliance/ai-api-brao-law-firms/) - [AI APIs for Law Firms in Germany](https://compound.law/en-DE/compliance/ai-apis-for-law-firms-germany/) - [Professional Liability and AI Specialists in Germany](https://compound.law/en-DE/compliance/professional-liability-ai-specialists/) ## FAQ ### What does Section 43e(3) BRAO require for AI APIs? **Section 43e(3) BRAO** requires law firms to ensure the following before engaging any AI API that processes mandate data: (1) a written confidentiality obligation on the service provider with an explicit §203 StGB warning, (2) purpose limitation and a no-training clause, (3) equivalent obligations passed on to the provider’s own subprocessors, and (4) documented deletion and exit arrangements. These requirements are cumulative — satisfying some but not all does not achieve compliance. ### When is client consent required under Section 43e(5) BRAO? **Section 43e(5) BRAO** requires explicit client consent when a service provider processes mandate data beyond the scope of the specific instruction, or when the client could not reasonably be expected to accept the use of that particular provider. For standard AI workflows (research, drafting, summarisation), the consent threshold is not automatically triggered. **BRAK guidance from December 2024** recommends proactive transparency with clients when sensitive data categories are involved, even where formal consent is not strictly required. ### What are the consequences of violating Section 43e BRAO? Violations of Section 43e BRAO can result in **professional disciplinary consequences**: a reprimand, warning, fine, or further measures by the relevant Rechtsanwaltskammer under §§ 113 ff. BRAO. **Civil liability claims** from affected clients are also possible. Where a provider discloses mandate secrets because the required §203 StGB obligation was absent from the contract, that disclosure has criminal law relevance for both the firm and the provider. ### Does a GDPR DPA satisfy Section 43e BRAO requirements? **No.** A DPA under Art. 28 GDPR addresses data protection law but does not contain a §203 StGB warning or the professional-conduct-specific purpose limitation required by Section 43e BRAO. Both instruments must be in place. A DPA-only contract structure does not fulfil the professional conduct requirements under BRAO — the Section 43e BRAO clause must be a distinct contractual element. ### Does Section 43e BRAO cover cloud services and AI APIs? Yes. **Section 43e(1) BRAO** expressly refers to “information processing systems” — a formulation that covers AI APIs, cloud platforms, legal analytics tools, and external document management systems. Any external service that processes mandate-related information falls within the scope of the provision, regardless of how the provider’s contract characterises the relationship. ## Next Step Compound Law advises law firms and in-house legal departments on **Section 43e BRAO-compliant AI tool deployment** — from contract negotiation with AI vendors to professional conduct analysis, GDPR structuring, and EU AI Act readiness. If your firm is planning an AI rollout or wants to audit an existing deployment, a structured compliance review is the right starting point. *This article provides general legal information only and does not constitute legal advice. For guidance on your specific situation, please consult a qualified lawyer.* ## Related Compliance Guides [![GDPR-compliant AI implementation for businesses in Germany](https://compound.law/assets/images/compliance/compliance_1.webp)](https://compound.law/en-DE/compliance/gdpr-compliant-ai-businesses-germany/) [Guides](https://compound.law/en-DE/compliance/gdpr-compliant-ai-businesses-germany/) ### [GDPR-Compliant AI in Germany: A Practical Guide for 2026](https://compound.law/en-DE/compliance/gdpr-compliant-ai-businesses-germany/) [GDPR-compliant AI means a lawful basis, transparency, a DPA, controlled transfers and a DPIA where risk is high. The 2026 guide for German companies.](https://compound.law/en-DE/compliance/gdpr-compliant-ai-businesses-germany/) [![AI legal counsel in Germany for company AI procurement](https://compound.law/assets/images/compliance/compliance_3.webp)](https://compound.law/en-DE/compliance/ai-legal-counsel-germany/) [Guides](https://compound.law/en-DE/compliance/ai-legal-counsel-germany/) ### [AI Legal Counsel in Germany for Companies](https://compound.law/en-DE/compliance/ai-legal-counsel-germany/) [AI legal counsel in Germany helps companies handle EU AI Act, GDPR, DPA, procurement, and rollout risk before signing or launching AI tools.](https://compound.law/en-DE/compliance/ai-legal-counsel-germany/) [![EU AI Act procurement before 2027 for German buyers](https://compound.law/assets/images/compliance/compliance_3.webp)](https://compound.law/en-DE/compliance/eu-ai-act-procurement-before-2027/) [compliance](https://compound.law/en-DE/compliance/eu-ai-act-procurement-before-2027/) ### [EU AI Act Procurement Before 2027 in Germany](https://compound.law/en-DE/compliance/eu-ai-act-procurement-before-2027/) [EU AI Act procurement before 2027 matters now for German buyers because contracts, evidence flows, and deployer support should be fixed before rollout.](https://compound.law/en-DE/compliance/eu-ai-act-procurement-before-2027/) ## Frequently asked questions Section 43e(3) BRAO requires law firms to bind AI service providers in writing to professional confidentiality with a §203 StGB warning, agree a no-training clause and purpose limitation, ensure subprocessors are equivalently bound, and document deletion and exit arrangements — all before mandate data enters the system. Section 43e(5) BRAO requires client consent when the service provider processes mandate data beyond the specific instruction, or where the client could not reasonably be expected to accept that particular provider. For standard AI workflows, the threshold is not automatically triggered, but BRAK guidance from December 2024 recommends proactive transparency when sensitive data is involved. Violations can trigger professional disciplinary measures by the relevant Rechtsanwaltskammer — reprimand, warning, fine, or further sanctions under §§ 113 ff. BRAO — as well as civil liability claims from affected clients. If mandate secrets are disclosed because the §203 StGB obligation was absent, that disclosure has criminal law relevance. No. A DPA under Art. 28 GDPR addresses data protection law but does not contain a §203 StGB warning or the professional-conduct purpose limitation required by Section 43e BRAO. Both instruments must be used together. Yes. Section 43e(1) BRAO expressly refers to systems of information processing — a formulation that covers AI APIs, cloud platforms, legal analytics tools, and external document management systems. Any external service that processes mandate-related information falls within the scope of the provision. ## Structured data ```json [ { "@context": "https://schema.org", "@type": [ "Organization", "LegalService" ], "@id": "https://compound.law/#organization", "name": "Compound Law", "alternateName": "Compound Law — AI Law Firm", "url": "https://compound.law/", "logo": { "@type": "ImageObject", "url": "https://compound.law/press/logos/PNG/Compound_Law_Icon.png", "width": 1024, "height": 1024 }, "image": "https://compound.law/assets/images/og-image.webp", "description": "The AI-native law firm in Berlin for start-ups, mid-sized companies and corporates: commercial and contract law, data protection, the EU AI Act, trademarks, corporate law, and restructuring and insolvency. A lawyer reviews every result, billed at a flat fee.", "foundingDate": "2026", "founder": [ { "@type": "Person", "name": "Marko Bradic", "jobTitle": "CEO", "url": "https://compound.law/en-DE/tech-team/marko-bradic/", "sameAs": [ "https://www.linkedin.com/in/markobradic/" ], "knowsAbout": [ "Product strategy and development", "Scaling technology companies", "FinTech and financial services", "AI-powered product innovation", "Business operations and growth", "Digital transformation" ] }, { "@type": "Person", "name": "Mohit Tilwani", "jobTitle": "CTO", "url": "https://compound.law/en-DE/tech-team/mohit-tilwani/", "sameAs": [ "https://www.linkedin.com/in/mohit-tilwani/" ], "knowsAbout": [ "Engineering leadership and architecture", "Scaling high-traffic systems", "AI and machine learning infrastructure", "FinTech platform development", "Cloud infrastructure and DevOps", "Product engineering" ] }, { "@type": "Person", "name": "Julian Jantze", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/julian-jantze/", "sameAs": [ "https://www.linkedin.com/in/julian-jantze-957b95158/" ], "knowsAbout": [ "Corporate law and corporate governance for technology companies", "Employment law and HR compliance", "EU AI Act compliance and AI governance", "Employee participation models (VSOP/ESOP)", "Regulatory compliance for tech companies", "Legal operations and Legal Tech implementation" ] } ], "employee": [ { "@type": "Person", "name": "Marko Bradic", "jobTitle": "CEO", "url": "https://compound.law/en-DE/tech-team/marko-bradic/", "sameAs": [ "https://www.linkedin.com/in/markobradic/" ], "knowsAbout": [ "Product strategy and development", "Scaling technology companies", "FinTech and financial services", "AI-powered product innovation", "Business operations and growth", "Digital transformation" ] }, { "@type": "Person", "name": "Mohit Tilwani", "jobTitle": "CTO", "url": "https://compound.law/en-DE/tech-team/mohit-tilwani/", "sameAs": [ "https://www.linkedin.com/in/mohit-tilwani/" ], "knowsAbout": [ "Engineering leadership and architecture", "Scaling high-traffic systems", "AI and machine learning infrastructure", "FinTech platform development", "Cloud infrastructure and DevOps", "Product engineering" ] }, { "@type": "Person", "name": "Julian Jantze", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/julian-jantze/", "sameAs": [ "https://www.linkedin.com/in/julian-jantze-957b95158/" ], "knowsAbout": [ "Corporate law and corporate governance for technology companies", "Employment law and HR compliance", "EU AI Act compliance and AI governance", "Employee participation models (VSOP/ESOP)", "Regulatory compliance for tech companies", "Legal operations and Legal Tech implementation" ] }, { "@type": "Person", "name": "Marc Schuba", "jobTitle": "Founding Partner, Rechtsanwalt (German attorney)", "url": "https://compound.law/en-DE/lawyers/marc-schuba/", "sameAs": [ "https://www.linkedin.com/in/marcschuba/" ], "knowsAbout": [ "IP and IT law", "SaaS and IT contracts, IT outsourcing", "Software and open-source licensing", "Data protection law (GDPR)", "AI law and the EU AI Act" ] }, { "@type": "Person", "name": "Dr. Markus Dreißigacker", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/markus-dreissigacker/", "sameAs": [ "https://www.linkedin.com/in/markusdreissigacker" ], "knowsAbout": [ "M&A (Due diligence, post-merger integration, IPO readiness)", "Corporate Law (Governance, board work, restructuring)", "Commercial Law (Customer contracts, supplier agreements, NDAs)", "IP (Trademark management, IP transfer agreements)", "Compliance & ESG (Global compliance programs, human rights, sustainability)", "Data Protection (GDPR strategy, DPO experience, privacy programs)" ] }, { "@type": "Person", "name": "Philipp Brandt", "jobTitle": "Partner, Rechtsanwalt (German attorney), Specialist Lawyer for Intellectual Property Law", "url": "https://compound.law/en-DE/lawyers/philipp-brandt/", "sameAs": [ "https://www.linkedin.com/in/philipp-brandt-81b446a/" ], "knowsAbout": [ "Restructuring and insolvency law (crisis advice for management, protective shield and insolvency plan proceedings, insolvency administration)", "Intellectual property (trademarks, unfair competition, copyright, trade secrets, licence agreements)", "Data protection law (data breaches, regulatory fine proceedings, access and damages claims)", "Distribution and commercial law (distribution agreements, acquisition and sale of industrial plants)" ] } ], "address": { "@type": "PostalAddress", "addressLocality": "Berlin", "addressCountry": "DE" }, "areaServed": [ "Germany", "Austria", "Switzerland", "European Union", "United Kingdom", "United States", "Singapore" ], "availableLanguage": [ "de", "en" ], "serviceType": [ "AI law firm", "AI-native legal services", "legal counsel for start-ups and growth companies", "legal counsel for mid-sized companies and corporates", "Commercial Law", "Corporate Law", "Employment Law", "Regulatory & Compliance", "Intellectual Property", "Insolvency & Restructuring" ], "hasOfferCatalog": { "@type": "OfferCatalog", "name": "Compound Law services", "itemListElement": [ { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Commercial Contracts", "description": "Battle-tested contracts for your sales process", "serviceType": [ "enterprise contracts", "MSA", "DPA", "sales contracts" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "International Employment", "description": "Compliant hiring across borders", "serviceType": [ "international employment", "hiring abroad", "employment contracts" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "VSOP/ESOP Setup", "description": "Employee participation that actually works", "serviceType": [ "VSOP", "ESOP", "employee stock options", "equity incentives" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Funding Round Support", "description": "Clean legal for your next raise", "serviceType": [ "funding round", "term sheet", "SHA", "due diligence", "cap table" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Corporate Housekeeping", "description": "Get your legal house in order", "serviceType": [ "corporate governance", "board resolutions", "shareholder register" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Data Protection & Privacy", "description": "GDPR compliance that doesn't slow you down", "serviceType": [ "GDPR", "data protection", "privacy", "DPA", "cookies", "data breach response", "GDPR fines", "Art. 82 GDPR" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "AI Act Compliance", "description": "Navigate EU AI regulation", "serviceType": [ "AI Act", "AI compliance", "AI governance", "EU AI regulation" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "IP & Competition", "description": "Protect and enforce what you've built", "serviceType": [ "IP protection", "intellectual property", "trademarks", "trademark enforcement", "warning letters", "preliminary injunctions", "unfair competition", "software licensing", "open source compliance" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Fractional General Counsel", "description": "In-house legal without the full-time cost", "serviceType": [ "fractional GC", "fractional general counsel", "outsourced legal", "legal retainer" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "FinTech Compliance", "description": "Navigate financial regulation", "serviceType": [ "fintech compliance", "BaFin", "banking regulation", "AML", "KYC" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Legal Retainer", "description": "Predictable legal support when you need it", "serviceType": [ "legal retainer", "legal subscription", "ongoing legal support" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "M&A Preparation", "description": "Get ready for acquisition interest", "serviceType": [ "M&A preparation", "acquisition", "due diligence", "exit" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Restructuring & Insolvency", "description": "From the first liquidity check to the restructuring itself", "serviceType": [ "restructuring", "insolvency", "StaRUG", "self-administration", "insolvency plan", "director liability" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } } ] }, "contactPoint": { "@type": "ContactPoint", "contactType": "sales", "email": "contact@compound.law", "availableLanguage": [ "English", "German" ], "areaServed": [ "DE", "AT", "CH", "EU", "GB", "US", "SG" ] }, "email": "contact@compound.law", "sameAs": [ "https://www.linkedin.com/company/compoundlawfirm", "https://x.com/CompoundLawFirm" ], "knowsAbout": [ "Commercial Contracts", "enterprise contracts", "MSA", "DPA", "sales contracts", "International Employment", "international employment", "hiring abroad", "employment contracts", "VSOP/ESOP Setup", "VSOP", "ESOP", "employee stock options", "equity incentives", "Funding Round Support", "funding round", "term sheet", "SHA", "due diligence", "cap table", "Corporate Housekeeping", "corporate governance", "board resolutions", "shareholder register", "Data Protection & Privacy", "GDPR", "data protection", "privacy", "cookies", "data breach response", "GDPR fines", "Art. 82 GDPR", "AI Act Compliance", "AI Act", "AI compliance", "AI governance", "EU AI regulation", "IP & Competition", "IP protection", "intellectual property", "trademarks", "trademark enforcement", "warning letters", "preliminary injunctions", "unfair competition", "software licensing", "open source compliance", "Fractional General Counsel", "fractional GC", "fractional general counsel", "outsourced legal", "legal retainer", "FinTech Compliance", "fintech compliance", "BaFin", "banking regulation", "AML", "KYC", "Legal Retainer", "legal subscription", "ongoing legal support", "M&A Preparation", "M&A preparation", "acquisition", "exit", "Restructuring & Insolvency", "restructuring", "insolvency", "StaRUG", "self-administration", "insolvency plan", "director liability" ] }, { "@context": "https://schema.org", "@type": "Article", "headline": "Section 43e BRAO Explained: AI API Requirements for German Law Firms (2026)", "description": "Section 43e BRAO permits law firms to use AI APIs under strict conditions: confidentiality, §203 StGB, no-training clauses, and deletion rules.", "image": "https://compound.law/assets/images/compliance/compliance_2.webp", "datePublished": "2026-04-11T00:00:00.000Z", "dateModified": "2026-04-11T00:00:00.000Z", "author": { "@type": "Person", "name": "Dr. Markus Dreißigacker", "image": "https://compound.law/assets/images/team/markusdreissigacker.webp" }, "publisher": { "@type": "Organization", "@id": "https://compound.law/#organization", "name": "Compound Law" }, "mainEntityOfPage": { "@type": "WebPage", "@id": "https://compound.law/en-DE/compliance/section-43e-brao-ai/" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://compound.law/en-DE/" }, { "@type": "ListItem", "position": 2, "name": "Compliance Guides", "item": "https://compound.law/en-DE/compliance/" }, { "@type": "ListItem", "position": 3, "name": "Section 43e BRAO Explained: AI API Requirements for German Law Firms", "item": "https://compound.law/en-DE/compliance/section-43e-brao-ai/" } ] }, { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "What does Section 43e(3) BRAO require for AI APIs?", "acceptedAnswer": { "@type": "Answer", "text": "Section 43e(3) BRAO requires law firms to bind AI service providers in writing to professional confidentiality with a §203 StGB warning, agree a no-training clause and purpose limitation, ensure subprocessors are equivalently bound, and document deletion and exit arrangements — all before mandate data enters the system." } }, { "@type": "Question", "name": "When is client consent required under Section 43e(5) BRAO?", "acceptedAnswer": { "@type": "Answer", "text": "Section 43e(5) BRAO requires client consent when the service provider processes mandate data beyond the specific instruction, or where the client could not reasonably be expected to accept that particular provider. For standard AI workflows, the threshold is not automatically triggered, but BRAK guidance from December 2024 recommends proactive transparency when sensitive data is involved." } }, { "@type": "Question", "name": "What are the consequences of violating Section 43e BRAO?", "acceptedAnswer": { "@type": "Answer", "text": "Violations can trigger professional disciplinary measures by the relevant Rechtsanwaltskammer — reprimand, warning, fine, or further sanctions under §§ 113 ff. BRAO — as well as civil liability claims from affected clients. If mandate secrets are disclosed because the §203 StGB obligation was absent, that disclosure has criminal law relevance." } }, { "@type": "Question", "name": "Does a GDPR DPA satisfy Section 43e BRAO requirements?", "acceptedAnswer": { "@type": "Answer", "text": "No. A DPA under Art. 28 GDPR addresses data protection law but does not contain a §203 StGB warning or the professional-conduct purpose limitation required by Section 43e BRAO. Both instruments must be used together." } }, { "@type": "Question", "name": "Does Section 43e BRAO cover cloud services and AI APIs?", "acceptedAnswer": { "@type": "Answer", "text": "Yes. Section 43e(1) BRAO expressly refers to systems of information processing — a formulation that covers AI APIs, cloud platforms, legal analytics tools, and external document management systems. Any external service that processes mandate-related information falls within the scope of the provision." } } ] } ] ```