When an attorney uploads a client document to a cloud platform, the document leaves the attorney's infrastructure. That makes permissibility the central question. Is the transfer an authorized way to handle data within the professional relationship, or does it amount to disclosure, and under which legal framework?
Selecting an AI legal tool therefore concerns professional duties as well as IT procurement. This article sets out the relevant obligations and practical questions to consider before bringing a cloud service into legal work. It is informational, not legal advice on whether any specific product is compliant with your obligations in your jurisdiction.
The Verschwiegenheitspflicht Under German and Austrian Professional Law
In Germany, the principal rule is found in §43a(2) BRAO, with §2 BORA (Berufsordnung der Rechtsanwalte) providing further detail. It covers information obtained through the professional relationship, even the fact that someone is a client. The duty does not end when the mandate does, and has no set expiry date.
In Austria, §9(2) RAO (Rechtsanwaltsordnung) establishes a comparable duty. The broad subject matter is similar, although the statutory basis and procedural details are not identical. Disciplinarbehorde decisions have also treated information held by people working under an attorney's supervision as covered, a point that matters when an outside provider handles data for the attorney.
The berufsrechtliche Verschwiegenheitspflicht forms part of the attorney-client relationship; clicking "I agree" to a provider's terms cannot set it aside. Breaches may lead to professional disciplinary consequences and, in serious cases, criminal liability under §203 StGB.
What Cloud Processing Actually Means
A client document sent to a cloud-based AI tool leaves the attorney's systems and is handled on infrastructure controlled by the provider. The issue is whether that handling is a permissible delegation within the professional relationship or an unauthorized disclosure of protected information.
German professional guidance, including material from Bundesrechtsanwaltskammer (BRAK) and bar associations, generally treats cloud processing as permissible where four conditions are met: the provider is bound as a processor under GDPR Article 28, processing takes place in the EU or a jurisdiction with adequate protection, the attorney has assessed and recorded the arrangement, and suitable technical and organizational measures are in place.
Comparable guidance applies in Austria. In practice, using a cloud AI service without a properly structured GDPR Article 28 DPA can create two problems at once: a possible GDPR violation and a possible breach of professional confidentiality, whichever issue is examined first.
The GDPR Article 28 Requirement
A cloud AI service that processes personal data for an attorney is a processor in GDPR terms. Article 28 calls for a written agreement between the attorney, acting as controller, and the provider, acting as processor. That agreement must identify the processing subject matter, duration, nature, and purpose, along with the personal-data types, data-subject categories, and the controller's rights and obligations.
Article 28(3) requires, among other things, documented instructions, confidentiality duties for authorized personnel, suitable technical and organizational security, controls on sub-processors, audit cooperation, and the deletion or return of data when the services end.
Providers often present a standard DPA. Signing it is only the starting point. The attorney should check whether it reflects actual operations and names or covers every sub-processor, including those involved in model inference or storage. A DPA limited to the provider's main infrastructure may leave those activities outside its scope.
Data Residency and Transfer Risk
Even an otherwise adequate Article 28 DPA may not resolve a transfer outside the EU or EEA. After Schrems II (C-311/18), and in light of EDPB guidance, standard contractual clauses by themselves are no longer enough for US transfers. A transfer impact assessment must examine whether the recipient country's legal system offers protection essentially equivalent to GDPR.
For an attorney, an EU-only hosting arrangement is usually easier to assess than a service that sends data through US data centers, even where standard contractual clauses exist. The attorney, as controller, remains responsible for recording the transfer impact assessment and considering whether access powers under FISA Section 702 create an unacceptable risk.
Some attorneys therefore prefer providers that commit contractually to EU-only processing and support that commitment with certifications, such as ISO 27001 for EU data centers or SOC 2 with an EU-limited scope, rather than relying on a policy statement alone.
The Training-Data Question
The processor analysis is not the whole confidentiality inquiry. Some general-purpose tools give the provider a license to use submitted material to improve its models. For client documents, that permission can itself create a confidentiality problem, which a DPA cannot repair. The information is no longer confined to the attorney's purposes and may enter product development or be available to the provider's engineering team.
Before using a client document, the attorney should find the terms governing training and read them closely. Silence or uncertainty about model-training use should be resolved with a written question to the provider. A provider unable to state clearly, in writing, that client uploads are excluded from model training does not provide a satisfactory basis for German or Austrian client-matter work.
Practical Due Diligence Before Adoption
Before adding a tool to client-matter workflows, ask the provider: Where are the processing servers located? Is there a current sub-processor list? Can the Article 28 DPA be reviewed before signup, rather than only after contracting? May uploaded documents be used for training or fine-tuning? How long are files retained, and how are they deleted on request?
Retention deserves a separate check. If a service keeps documents for 90 days after processing, those files remain on a third-party system long after the task is complete. Where deletion cannot be verified on request or the retention period is not contractual, the uncertainty should be recorded in the risk assessment before client workflows begin.
What This Article Cannot Tell You
The framework here can help structure the inquiry, but it cannot deliver a compliance finding for a particular tool in a particular bar jurisdiction. Current guidance may differ between Rechtsanwaltskammer and may change as the technology and regulatory setting develop.
For a tool-specific decision, consult the current guidance applicable to your practice and, if uncertainty remains, ask your bar association's professional responsibility service. The Verschwiegenheitspflicht follows the protected information and the attorney-client relationship, so changing the system that processes a document does not remove the duty.
Review Alawyer's DPA, EU processing terms, and no-training commitment. Start a free 14-day trial, no credit card required.
Start Free Trial