--- title: "AI APIs for Law Firms in Germany: BRAO, GDPR & Secrecy Guide" description: "Can lawyers in Germany use AI tools like Claude or ChatGPT? BRAO §43a, GDPR Art. 28, and BRAK guidance explained — with a 7-point compliance checklist." image: "https://compound.law/assets/images/og-image-en.webp" source: "https://compound.law/en-DE/tools/ai-tools-lawyers-germany/" language: "en" --- ![AI tools for lawyers Germany BRAO GDPR professional secrecy compliance](https://compound.law/assets/images/tools/tools_1.webp) tools # AI APIs for Law Firms in Germany: BRAO, GDPR & Secrecy Guide 14 April 2026 Can lawyers in Germany use AI APIs like Claude or ChatGPT? Yes — German lawyers can use AI APIs, but only with specific safeguards. BRAO §43a requires absolute professional confidentiality over client data. GDPR Art. 28 mandates a Data Processing Agreement (DPA/AVV). Cross-border transfers to US-based providers must be covered by SCCs. - BRAO §43a: Client data may only be shared with vendors who are contractually bound to confidentiality. - GDPR Art. 28: A Data Processing Agreement (DPA/AVV) is mandatory before processing any client data with an AI tool. - BRAK guidelines recommend against entering real client data into public AI systems without adequate contractual safeguards. Lawyers in Germany can use **AI APIs such as Claude or ChatGPT** in their practice — but only with specific safeguards in place. The key legal frameworks are **BRAO §43a** (professional duty of confidentiality), **GDPR Art. 28** (Data Processing Agreement required), and the professional guidance issued by the **BRAK** (Bundesrechtsanwaltskammer — German Federal Bar Association). This guide explains what is permitted, what the risks are, and how to introduce AI tools into a German law firm compliantly. This article is general information and does not constitute legal advice for individual cases. For a detailed GDPR assessment of Claude specifically, see our guide on [Claude Enterprise GDPR compliance](https://compound.law/en-DE/tools/claude-enterprise/). > **Quick answer** > > Yes, lawyers in Germany can use AI APIs — with these prerequisites: > > - **DPA under GDPR Art. 28** with the AI vendor (free-tier accounts do not include a DPA) > - **Confidentiality commitment** from the vendor covering client data under BRAO §43a > - **No model training** on client submissions > - **SCCs or EU hosting** for any cross-border data transfers outside the EEA ## Can Lawyers Use AI APIs? The Short Answer Yes, German lawyers can use AI tools such as Claude, ChatGPT, or similar systems. There is no blanket prohibition. What matters is **how** the tool is used and **what data** is processed. Three legal frameworks define the boundaries: 1. **BRAO §43a** — The professional duty of confidentiality is absolute and permanent. Client data may only be shared with third parties who are contractually bound to secrecy. 2. **GDPR Art. 28** — Whenever personal data (client information, opposing party details, witness statements) enters an AI system, a **Data Processing Agreement (DPA)** — called **Auftragsverarbeitungsvertrag (AVV)** in German — is required. 3. **BRAK professional guidance** — The Bundesrechtsanwaltskammer recommends caution when entering client-specific content into AI systems and requires lawyers to maintain professional responsibility for all AI-generated output. The practical dividing line is not the tool itself, but the workflow: **using AI for internal research without client data is far less sensitive than entering contract documents, court pleadings, or client correspondence.** ## Legal Framework: BRAO §43a, Professional Secrecy & AI **BRAO §43a** is the cornerstone of German professional legal rules. Section 2 imposes an unconditional and permanent duty of confidentiality over everything a lawyer learns in the course of professional activity — without exception. This obligation extends to assistants and service providers. When client data is transmitted to an AI vendor, the law firm must ensure: - The vendor is **contractually bound to confidentiality** (typically through a DPA and confidentiality clauses). - The vendor does **not train on client data** — no model optimization using submitted content. - Access to data is **technically restricted** and minimized to what is necessary. - Clear rules govern which **categories of data** staff are permitted to enter into AI systems. A practical consequence: most free-tier AI services (ChatGPT Free, Claude Free, Gemini Free) do not meet these requirements. Only **commercial Enterprise or API plans** that include a DPA are appropriate for client-facing workflows. ### Professional Privilege and Cloud Services The **professional duty of confidentiality (anwaltliche Verschwiegenheitspflicht)** under German law is not merely a data protection obligation — it is an independent professional duty that applies even when GDPR requirements are formally met. A DPA alone does not automatically preserve professional privilege. **Additional contractual confidentiality commitments** from the vendor are required. For law firms, this means zero-data-retention options and explicit contractual commitments against model training are not optional — they are professionally required for any client-facing AI workflow. ## Data Protection: DPA, Cross-Border Transfers & EU Hosting ### Data Processing Agreement under GDPR Art. 28 Once a lawyer enters client data into an AI system, the vendor becomes a **data processor** under GDPR Art. 28. A Data Processing Agreement (DPA/AVV) is then mandatory — without exception. The key elements a DPA must cover for law firm use: | DPA Requirement | Why It Matters for Law Firms | | ------------------------------------- | ----------------------------------------------------------------- | | Subject matter and duration | AI workflows with client data must be specifically described | | Instructions binding | The vendor may only process data on the firm’s instructions | | Confidentiality obligations | Vendor staff must be bound to secrecy — directly relevant to BRAO | | Technical and organizational measures | Art. 32 GDPR security standard | | Sub-processors | Where is client data actually processed and forwarded? | | Deletion and return | What happens to client data after the contract ends? | | Audit rights | Can the firm conduct checks or request compliance evidence? | ### Cross-Border Transfers and EU Hosting Most major AI vendors (Anthropic, OpenAI) process data primarily in the United States. For **transfers to third countries** under GDPR Chapter V, **Standard Contractual Clauses (SCCs)** under Art. 46(2)(c) are the standard transfer mechanism. All major enterprise-tier vendors provide SCCs as part of their commercial terms. Law firms that require **EU-only hosting** — for example, due to client requirements or internal policy — should evaluate these deployment options: | Deployment path | Data location | EU-only possible? | | ----------------------------------- | ------------------ | --------------------------------------- | | Claude.ai / Anthropic API direct | US (default) | No dedicated EU offering | | Claude via AWS Bedrock | Configurable | Yes — Frankfurt (eu-central-1), Ireland | | ChatGPT Enterprise direct | US (default) | Limited — Azure EU available | | Claude/GPT via Azure OpenAI Service | Configurable | Yes — EU regions available | | On-premise open-source models | Own infrastructure | Yes — full control | For firms with strict data residency requirements — for example in M\&A, banking, or insolvency work — **AWS Bedrock EU configurations** or **on-premise deployments** are the most defensible options. For a detailed guide to the Claude DPA, see our guide on [Claude Enterprise GDPR compliance](https://compound.law/en-DE/tools/claude-enterprise/). ## Which AI Tools Are Suitable for Law Firms? Not every AI tool meets the minimum requirements for law firm use. The key criteria are: Does the vendor provide a DPA? Do they commit to confidentiality? Is there no model training on client data? | AI Tool | DPA/AVV available | No training (commercial) | SCCs / EU option | Suitable for law firms? | | --------------------------- | ---------------------- | ------------------------ | ----------------------------------- | --------------------------- | | Claude Enterprise / API | Yes (Commercial Terms) | Yes | Yes / EU via Bedrock | Yes | | ChatGPT Enterprise | Yes | Yes | Yes / Azure EU | Yes | | Microsoft Copilot (M365) | Yes | Yes | EU Data Boundary (exceptions apply) | Conditional | | Gemini for Google Workspace | Yes | Yes | EU available | Conditional | | Claude Free / ChatGPT Free | No | No | No | No | | Local open-source models | Not required | Structurally yes | Own infrastructure | Yes — requires IT resources | **Note:** This comparison shows whether fundamental requirements can be met. Whether a specific tool is compliant for your firm depends on the actual workflow, the type of client data involved, and your firm’s internal compliance requirements. ## BRAK Guidance and Current Legal Commentary The **BRAK (Bundesrechtsanwaltskammer)** — Germany’s Federal Bar Association — has issued professional guidance on AI tools in legal practice. Key points: - **Professional responsibility cannot be delegated to AI.** Every AI-generated document — whether a draft pleading, contract clause, or research memo — must be independently reviewed and authorized by the responsible lawyer. - **No unprotected client data in public AI systems.** The BRAK explicitly recommends against entering real, unencrypted client data into publicly accessible AI platforms. - **Careful vendor selection.** Lawyers must verify that the vendor provides a valid DPA and confidentiality commitments before deployment. - **Ongoing review obligation.** AI technology and vendor terms change rapidly — law firms must regularly update their AI governance framework. From case law and disciplinary practice, no blanket prohibition on AI use exists in Germany. Current legal commentary emphasizes that AI use is permissible but requires heightened professional care — particularly around the duty of confidentiality and the secure communication obligations tied to the **beA** (besonderes elektronisches Anwaltspostfach). ### Relationship to BRAO §43e (Office Management Duties) BRAO §43e requires lawyers to manage their law firm in a way that ensures confidentiality and compliance with professional rules. This framework applies directly to AI tools: the firm is responsible for ensuring its entire technical infrastructure — including external service providers like AI vendors — meets professional conduct standards. ## Practical Compliance Checklist: Introducing AI in a German Law Firm Before any AI tool is used in production in a law firm, verify these seven points: 1. **Check the tier and DPA.** Only commercial plans (API, Enterprise, Team) include a DPA. Free-tier accounts are not suitable for client data. 2. **Obtain confidentiality commitments.** Confirm the vendor does not train on client data and that contractual confidentiality obligations exist beyond the standard DPA terms. 3. **Document cross-border transfers.** Record which countries outside the EEA receive data and document the transfer mechanism (SCCs) in your Records of Processing Activities (RPA/VVT). 4. **Clarify EU hosting requirements.** If client mandates or firm policy require EU-only hosting, evaluate deployment options via AWS Bedrock or Azure OpenAI Service. 5. **Define firm-wide usage rules in writing.** Set out which categories of data staff may enter into AI systems. Maintain clear “no-go” categories (e.g., unredacted banking data, health data, highly sensitive M\&A materials). 6. **Update your RPA and assess DPIA need.** Add the AI tool to your Records of Processing Activities. For high-volume or high-risk processing, a Data Protection Impact Assessment (DPIA) under GDPR Art. 35 may be required. 7. **Schedule regular reviews.** AI vendors update terms and infrastructure frequently. Set an annual review of your AI governance and document the rationale for your tool choices. *** This structured review matters more than which AI tool is most popular. The decision ultimately depends on your firm’s **specific workflows** and the nature of the client data involved — not the vendor name alone. Compound Law advises law firms, in-house legal teams, and professional associations in Germany on AI tool compliance, GDPR, DPA review, and professional conduct rules. If you want to introduce AI tools in your law firm compliantly, [contact us](https://compound.law/en-DE/#booking). ## FAQ ### Can lawyers in Germany use ChatGPT? Yes, under conditions. German lawyers may use ChatGPT Enterprise if a GDPR-compliant DPA is in place, no client data is used for model training, and the professional confidentiality obligations under BRAO §43a are met through contractual and technical measures. The free-tier ChatGPT account does not include a DPA and is not suitable for client data. ### Which AI tools are BRAO-compliant? AI tools are considered professionally usable under BRAO when they include a valid DPA, commit to not training on client data, and provide SCCs or EU hosting options. Suitable options include Claude Enterprise/API (Anthropic), ChatGPT Enterprise (OpenAI), and on-premise deployments of open-source models. ### Do I need a DPA to use AI tools as a lawyer in Germany? Yes. Whenever client data or other personal data is entered into an AI system, a Data Processing Agreement (DPA/AVV) under GDPR Art. 28 is mandatory. Free-tier accounts do not include a DPA. Only paid API or Enterprise plans from major vendors provide a DPA. ### What does the BRAK say about AI tools for lawyers? The BRAK has published professional guidance on AI tools in legal practice. Core points: do not enter real client data into public AI systems without contractual safeguards, carefully review vendor DPAs, and maintain professional accountability for all AI-generated output. AI use is permissible but requires a structured compliance approach. ### Is professional secrecy protected by a DPA alone? No. A DPA satisfies the GDPR requirement for data processing but does not alone preserve the professional duty of confidentiality under BRAO §43a. Additional contractual confidentiality commitments, no model training on client submissions, and appropriate technical safeguards (such as zero-data-retention options) are also required. ## Related Tool Guides [![Canva DPA data processing addendum reviewed under Article 28 GDPR](https://compound.law/assets/images/tools/tools_3.webp)](https://compound.law/en-DE/tools/canva-dpa/) [tools](https://compound.law/en-DE/tools/canva-dpa/) ### [Does Canva Offer a DPA? Yes — Canva DPA Guide for Germany](https://compound.law/en-DE/tools/canva-dpa/) [Yes — Canva provides a Data Processing Addendum on paid plans. See what the Canva DPA covers clause by clause: SCCs, subprocessors, audits, German-law gaps.](https://compound.law/en-DE/tools/canva-dpa/) [![Cursor DPA data processing agreement Art. 28 GDPR review for Germany](https://compound.law/assets/images/tools/tools_1.webp)](https://compound.law/en-DE/tools/cursor-dpa/) [tools](https://compound.law/en-DE/tools/cursor-dpa/) ### [Cursor DPA: Yes — What the Anysphere Data Processing Agreement Covers](https://compound.law/en-DE/tools/cursor-dpa/) [Yes, Cursor offers a DPA at cursor.com/terms/dpa. What the Cursor data processing agreement covers under GDPR Art. 28 — and how German buyers should review it.](https://compound.law/en-DE/tools/cursor-dpa/) [![ElevenLabs DPA data processing addendum reviewed under Article 28 GDPR](https://compound.law/assets/images/tools/tools_4.webp)](https://compound.law/en-DE/tools/elevenlabs-dpa/) [tools](https://compound.law/en-DE/tools/elevenlabs-dpa/) ### [Does ElevenLabs Offer a DPA? Yes — ElevenLabs DPA Guide for Germany](https://compound.law/en-DE/tools/elevenlabs-dpa/) [Yes — ElevenLabs publishes a Data Processing Addendum at elevenlabs.io/dpa. What the ElevenLabs DPA covers clause by clause under Article 28 GDPR.](https://compound.law/en-DE/tools/elevenlabs-dpa/) [![Synthesia GDPR compliance facts: AI video training policy, DPA, and EU data storage](https://compound.law/assets/images/tools/tools_4.webp)](https://compound.law/en-DE/tools/synthesia/) [tools](https://compound.law/en-DE/tools/synthesia/) ### [Synthesia GDPR: Training, DPA & German Compliance Facts](https://compound.law/en-DE/tools/synthesia/) [No — Synthesia does not train on customer content. GDPR-usable for German firms: Art. 28 DPA and EU storage in Ireland. What to verify before rollout.](https://compound.law/en-DE/tools/synthesia/) [![Claude Pro GDPR compliance review — no DPA means Claude Pro is not suitable for business personal data](https://compound.law/assets/images/tools/tools_1.webp)](https://compound.law/en-DE/tools/claude-pro-privacy/) [tools](https://compound.law/en-DE/tools/claude-pro-privacy/) ### [Claude Pro GDPR Compliance: Not for Business, Team vs Enterprise](https://compound.law/en-DE/tools/claude-pro-privacy/) [Claude Pro is not the GDPR-compliant business tier. Claude Team adds the Article 28 DPA; Enterprise adds stronger controls and EU residency options.](https://compound.law/en-DE/tools/claude-pro-privacy/) [![Claude EU hosting options with AWS Bedrock Frankfurt and Google Vertex AI for GDPR compliance](https://compound.law/assets/images/tools/tools_1.webp)](https://compound.law/en-DE/tools/claude-eu-hosting/) [tools](https://compound.law/en-DE/tools/claude-eu-hosting/) ### [Where Is Claude Hosted? EU Hosting & Data Residency Facts (2026)](https://compound.law/en-DE/tools/claude-eu-hosting/) [Where is Claude hosted? No EU residency by default; EU path is Bedrock/Vertex AI](https://compound.law/en-DE/tools/claude-eu-hosting/) Tool Library ### Browse More AI Tools by Topic Compare more tools, privacy issues, and deployment scenarios in the full AI tool library. [View all AI tools](https://compound.law/en-DE/tools/) - [Claude ZDR: What It Covers, Who Qualifies, How to Get It tools](https://compound.law/en-DE/tools/claude-zdr/) - [Cursor DPA: Where to Find It and Which Plan German Teams Need tools](https://compound.law/en-DE/tools/cursor/) - [Is DeepSeek GDPR Compliant? What German Companies Need to Know tools](https://compound.law/en-DE/tools/deepseek/) - [Is Zapier GDPR Compliant? Germany Guide 2026 tools](https://compound.law/en-DE/tools/zapier/) - [Claude Code Data Privacy: GDPR, DPA & No Training Policy tools](https://compound.law/en-DE/tools/claude-code-gdpr/) - [HubSpot Privacy in Germany: GDPR, DPA, and Works Council Risks tools](https://compound.law/en-DE/tools/hubspot/) - [Claude GDPR: Which Claude Plans Work for Germany in 2026 tools](https://compound.law/en-DE/tools/claude-gdpr/) - [Anthropic SCCs: GDPR Data Transfer Guide for Module 2 and 3 tools](https://compound.law/en-DE/tools/anthropic-scc/) - [Zoom AI Companion GDPR Compliance for German Businesses tools](https://compound.law/en-DE/tools/zoom/) - [Claude Team vs Enterprise: Which Plan Is GDPR-Compliant for Your Team? tools](https://compound.law/en-DE/tools/claude-business/) - [Claude Team vs Enterprise: Plan Comparison for German Businesses tools](https://compound.law/en-DE/tools/claude-team-vs-enterprise/) - [Claude Enterprise for Law Firms and Legal Teams tools](https://compound.law/en-DE/tools/claude-enterprise-legal-teams/) - [Anthropic Data Processing Addendum: Where to Find the Official DPA tools](https://compound.law/en-DE/tools/anthropic-data-processing-addendum/) - [Anthropic DPA: GDPR Article 28 Guide for German Companies tools](https://compound.law/en-DE/tools/anthropic-dpa/) - [Claude Enterprise GDPR: DPA Yes, EU Residency No by Default tools](https://compound.law/en-DE/tools/claude-enterprise/) ## Frequently asked questions Yes, under conditions. German lawyers may use ChatGPT Enterprise if a GDPR-compliant DPA is in place, no client data is used for model training, and the confidentiality obligations under BRAO §43a are met through contractual and technical measures. Free-tier accounts do not include a DPA. AI tools are professionally usable under BRAO when they include a valid DPA, commit to not training on client data, and provide SCCs or EU hosting options. Suitable options include Claude Enterprise/API and ChatGPT Enterprise. Yes. Whenever client data or other personal data is entered into an AI system, a Data Processing Agreement under GDPR Art. 28 is required. Free-tier accounts (ChatGPT Free, Claude Free) do not include a DPA. The BRAK (German Federal Bar Association) recommends that lawyers not enter real client data into public AI systems without proper contractual safeguards, that DPAs be carefully reviewed, and that professional accountability for all AI-generated output be maintained. No. A DPA satisfies GDPR Art. 28 but does not alone preserve the professional duty of confidentiality under BRAO §43a. Additional contractual confidentiality commitments, no model training on submissions, and technical safeguards such as zero-data-retention options are also required. ## Structured data ```json [ { "@context": "https://schema.org", "@type": [ "Organization", "LegalService" ], "@id": "https://compound.law/#organization", "name": "Compound Law", "alternateName": "Compound Law — AI Law Firm", "url": "https://compound.law/", "logo": { "@type": "ImageObject", "url": "https://compound.law/press/logos/PNG/Compound_Law_Icon.png", "width": 1024, "height": 1024 }, "image": "https://compound.law/assets/images/og-image.webp", "description": "The AI-native law firm in Berlin for start-ups, mid-sized companies and corporates: commercial and contract law, data protection, the EU AI Act, trademarks, corporate law, and restructuring and insolvency. A lawyer reviews every result, billed at a flat fee.", "foundingDate": "2026", "founder": [ { "@type": "Person", "name": "Marko Bradic", "jobTitle": "CEO", "url": "https://compound.law/en-DE/tech-team/marko-bradic/", "sameAs": [ "https://www.linkedin.com/in/markobradic/" ], "knowsAbout": [ "Product strategy and development", "Scaling technology companies", "FinTech and financial services", "AI-powered product innovation", "Business operations and growth", "Digital transformation" ] }, { "@type": "Person", "name": "Mohit Tilwani", "jobTitle": "CTO", "url": "https://compound.law/en-DE/tech-team/mohit-tilwani/", "sameAs": [ "https://www.linkedin.com/in/mohit-tilwani/" ], "knowsAbout": [ "Engineering leadership and architecture", "Scaling high-traffic systems", "AI and machine learning infrastructure", "FinTech platform development", "Cloud infrastructure and DevOps", "Product engineering" ] }, { "@type": "Person", "name": "Julian Jantze", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/julian-jantze/", "sameAs": [ "https://www.linkedin.com/in/julian-jantze-957b95158/" ], "knowsAbout": [ "Corporate law and corporate governance for technology companies", "Employment law and HR compliance", "EU AI Act compliance and AI governance", "Employee participation models (VSOP/ESOP)", "Regulatory compliance for tech companies", "Legal operations and Legal Tech implementation" ] } ], "employee": [ { "@type": "Person", "name": "Marko Bradic", "jobTitle": "CEO", "url": "https://compound.law/en-DE/tech-team/marko-bradic/", "sameAs": [ "https://www.linkedin.com/in/markobradic/" ], "knowsAbout": [ "Product strategy and development", "Scaling technology companies", "FinTech and financial services", "AI-powered product innovation", "Business operations and growth", "Digital transformation" ] }, { "@type": "Person", "name": "Mohit Tilwani", "jobTitle": "CTO", "url": "https://compound.law/en-DE/tech-team/mohit-tilwani/", "sameAs": [ "https://www.linkedin.com/in/mohit-tilwani/" ], "knowsAbout": [ "Engineering leadership and architecture", "Scaling high-traffic systems", "AI and machine learning infrastructure", "FinTech platform development", "Cloud infrastructure and DevOps", "Product engineering" ] }, { "@type": "Person", "name": "Julian Jantze", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/julian-jantze/", "sameAs": [ "https://www.linkedin.com/in/julian-jantze-957b95158/" ], "knowsAbout": [ "Corporate law and corporate governance for technology companies", "Employment law and HR compliance", "EU AI Act compliance and AI governance", "Employee participation models (VSOP/ESOP)", "Regulatory compliance for tech companies", "Legal operations and Legal Tech implementation" ] }, { "@type": "Person", "name": "Marc Schuba", "jobTitle": "Founding Partner, Rechtsanwalt (German attorney)", "url": "https://compound.law/en-DE/lawyers/marc-schuba/", "sameAs": [ "https://www.linkedin.com/in/marcschuba/" ], "knowsAbout": [ "IP and IT law", "SaaS and IT contracts, IT outsourcing", "Software and open-source licensing", "Data protection law (GDPR)", "AI law and the EU AI Act" ] }, { "@type": "Person", "name": "Dr. Markus Dreißigacker", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/markus-dreissigacker/", "sameAs": [ "https://www.linkedin.com/in/markusdreissigacker" ], "knowsAbout": [ "M&A (Due diligence, post-merger integration, IPO readiness)", "Corporate Law (Governance, board work, restructuring)", "Commercial Law (Customer contracts, supplier agreements, NDAs)", "IP (Trademark management, IP transfer agreements)", "Compliance & ESG (Global compliance programs, human rights, sustainability)", "Data Protection (GDPR strategy, DPO experience, privacy programs)" ] }, { "@type": "Person", "name": "Philipp Brandt", "jobTitle": "Partner, Rechtsanwalt (German attorney), Specialist Lawyer for Intellectual Property Law", "url": "https://compound.law/en-DE/lawyers/philipp-brandt/", "sameAs": [ "https://www.linkedin.com/in/philipp-brandt-81b446a/" ], "knowsAbout": [ "Restructuring and insolvency law (crisis advice for management, protective shield and insolvency plan proceedings, insolvency administration)", "Intellectual property (trademarks, unfair competition, copyright, trade secrets, licence agreements)", "Data protection law (data breaches, regulatory fine proceedings, access and damages claims)", "Distribution and commercial law (distribution agreements, acquisition and sale of industrial plants)" ] } ], "address": { "@type": "PostalAddress", "addressLocality": "Berlin", "addressCountry": "DE" }, "areaServed": [ "Germany", "Austria", "Switzerland", "European Union", "United Kingdom", "United States", "Singapore" ], "availableLanguage": [ "de", "en" ], "serviceType": [ "AI law firm", "AI-native legal services", "legal counsel for start-ups and growth companies", "legal counsel for mid-sized companies and corporates", "Commercial Law", "Corporate Law", "Employment Law", "Regulatory & Compliance", "Intellectual Property", "Insolvency & Restructuring" ], "hasOfferCatalog": { "@type": "OfferCatalog", "name": "Compound Law services", "itemListElement": [ { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Commercial Contracts", "description": "Battle-tested contracts for your sales process", "serviceType": [ "enterprise contracts", "MSA", "DPA", "sales contracts" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "International Employment", "description": "Compliant hiring across borders", "serviceType": [ "international employment", "hiring abroad", "employment contracts" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "VSOP/ESOP Setup", "description": "Employee participation that actually works", "serviceType": [ "VSOP", "ESOP", "employee stock options", "equity incentives" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Funding Round Support", "description": "Clean legal for your next raise", "serviceType": [ "funding round", "term sheet", "SHA", "due diligence", "cap table" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Corporate Housekeeping", "description": "Get your legal house in order", "serviceType": [ "corporate governance", "board resolutions", "shareholder register" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Data Protection & Privacy", "description": "GDPR compliance that doesn't slow you down", "serviceType": [ "GDPR", "data protection", "privacy", "DPA", "cookies", "data breach response", "GDPR fines", "Art. 82 GDPR" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "AI Act Compliance", "description": "Navigate EU AI regulation", "serviceType": [ "AI Act", "AI compliance", "AI governance", "EU AI regulation" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "IP & Competition", "description": "Protect and enforce what you've built", "serviceType": [ "IP protection", "intellectual property", "trademarks", "trademark enforcement", "warning letters", "preliminary injunctions", "unfair competition", "software licensing", "open source compliance" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Fractional General Counsel", "description": "In-house legal without the full-time cost", "serviceType": [ "fractional GC", "fractional general counsel", "outsourced legal", "legal retainer" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "FinTech Compliance", "description": "Navigate financial regulation", "serviceType": [ "fintech compliance", "BaFin", "banking regulation", "AML", "KYC" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Legal Retainer", "description": "Predictable legal support when you need it", "serviceType": [ "legal retainer", "legal subscription", "ongoing legal support" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "M&A Preparation", "description": "Get ready for acquisition interest", "serviceType": [ "M&A preparation", "acquisition", "due diligence", "exit" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Restructuring & Insolvency", "description": "From the first liquidity check to the restructuring itself", "serviceType": [ "restructuring", "insolvency", "StaRUG", "self-administration", "insolvency plan", "director liability" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } } ] }, "contactPoint": { "@type": "ContactPoint", "contactType": "sales", "email": "contact@compound.law", "availableLanguage": [ "English", "German" ], "areaServed": [ "DE", "AT", "CH", "EU", "GB", "US", "SG" ] }, "email": "contact@compound.law", "sameAs": [ "https://www.linkedin.com/company/compoundlawfirm", "https://x.com/CompoundLawFirm" ], "knowsAbout": [ "Commercial Contracts", "enterprise contracts", "MSA", "DPA", "sales contracts", "International Employment", "international employment", "hiring abroad", "employment contracts", "VSOP/ESOP Setup", "VSOP", "ESOP", "employee stock options", "equity incentives", "Funding Round Support", "funding round", "term sheet", "SHA", "due diligence", "cap table", "Corporate Housekeeping", "corporate governance", "board resolutions", "shareholder register", "Data Protection & Privacy", "GDPR", "data protection", "privacy", "cookies", "data breach response", "GDPR fines", "Art. 82 GDPR", "AI Act Compliance", "AI Act", "AI compliance", "AI governance", "EU AI regulation", "IP & Competition", "IP protection", "intellectual property", "trademarks", "trademark enforcement", "warning letters", "preliminary injunctions", "unfair competition", "software licensing", "open source compliance", "Fractional General Counsel", "fractional GC", "fractional general counsel", "outsourced legal", "legal retainer", "FinTech Compliance", "fintech compliance", "BaFin", "banking regulation", "AML", "KYC", "Legal Retainer", "legal subscription", "ongoing legal support", "M&A Preparation", "M&A preparation", "acquisition", "exit", "Restructuring & Insolvency", "restructuring", "insolvency", "StaRUG", "self-administration", "insolvency plan", "director liability" ] }, { "@context": "https://schema.org", "@type": "Article", "headline": "AI APIs for Law Firms in Germany: BRAO, GDPR & Secrecy Guide", "description": "Can lawyers in Germany use AI tools like Claude or ChatGPT? BRAO §43a, GDPR Art. 28, and BRAK guidance explained — with a 7-point compliance checklist.", "image": "https://compound.law/assets/images/tools/tools_1.webp", "datePublished": "2026-04-14T00:00:00.000Z", "dateModified": "2026-04-14T00:00:00.000Z", "author": { "@type": "Person", "name": "Julian Jantze", "image": "https://compound.law/assets/images/team/julianjantze.webp" }, "publisher": { "@type": "Organization", "@id": "https://compound.law/#organization", "name": "Compound Law" }, "mainEntityOfPage": { "@type": "WebPage", "@id": "https://compound.law/en-DE/tools/ai-tools-lawyers-germany/" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://compound.law/en-DE/" }, { "@type": "ListItem", "position": 2, "name": "AI Tools", "item": "https://compound.law/en-DE/tools/" }, { "@type": "ListItem", "position": 3, "name": "AI APIs for Law Firms in Germany: BRAO, GDPR & Secrecy Guide", "item": "https://compound.law/en-DE/tools/ai-tools-lawyers-germany/" } ] }, { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "Can lawyers in Germany use ChatGPT?", "acceptedAnswer": { "@type": "Answer", "text": "Yes, under conditions. German lawyers may use ChatGPT Enterprise if a GDPR-compliant DPA is in place, no client data is used for model training, and the confidentiality obligations under BRAO §43a are met through contractual and technical measures. Free-tier accounts do not include a DPA." } }, { "@type": "Question", "name": "Which AI tools are BRAO-compliant?", "acceptedAnswer": { "@type": "Answer", "text": "AI tools are professionally usable under BRAO when they include a valid DPA, commit to not training on client data, and provide SCCs or EU hosting options. Suitable options include Claude Enterprise/API and ChatGPT Enterprise." } }, { "@type": "Question", "name": "Do I need a DPA to use AI tools as a lawyer in Germany?", "acceptedAnswer": { "@type": "Answer", "text": "Yes. Whenever client data or other personal data is entered into an AI system, a Data Processing Agreement under GDPR Art. 28 is required. Free-tier accounts (ChatGPT Free, Claude Free) do not include a DPA." } }, { "@type": "Question", "name": "What does the BRAK say about AI tools for lawyers?", "acceptedAnswer": { "@type": "Answer", "text": "The BRAK (German Federal Bar Association) recommends that lawyers not enter real client data into public AI systems without proper contractual safeguards, that DPAs be carefully reviewed, and that professional accountability for all AI-generated output be maintained." } }, { "@type": "Question", "name": "Is professional secrecy protected through a DPA alone?", "acceptedAnswer": { "@type": "Answer", "text": "No. A DPA satisfies GDPR Art. 28 but does not alone preserve the professional duty of confidentiality under BRAO §43a. Additional contractual confidentiality commitments, no model training on submissions, and technical safeguards such as zero-data-retention options are also required." } } ] } ] ```