AI in the Tax Firm: What § 203 StGB and § 62a StBerG Permit and What They Do Not

An employee pastes a case into ChatGPT to reach an assessment faster. Client name, revenue figures, the disputed audit question. Two minutes later a usable answer is on screen. Nobody acted in bad faith, and in many firms this happens daily. It is still a legal problem, and one for the firm: responsibility for professional secrecy cannot be shifted onto the vendor.

Key takeaway: The dividing line does not run between permitted and forbidden tools, but between use with and without client data. General research without client reference is unproblematic. The moment protected facts enter a system, § 203 StGB and § 62a StBerG apply: the service provider must be carefully selected, bound to confidentiality in text form, and instructed about the criminal consequences. If the professional intentionally omits this obligation and the provider subsequently discloses a secret, the professional becomes criminally liable. If the service is performed abroad, the protection of secrets there must be comparable, and if a service directly serves a single engagement, the firm needs the client's consent wherever the provider is located.

Can I use ChatGPT in a tax firm at all?

Yes, but the question is framed wrongly. What matters is not the tool but what goes into it. Asking a language model how case law distinguishes maintenance expenses from production costs discloses no secret. Entering the same case with the client name, property address and figures does.

The distinction sounds obvious but is crossed constantly in daily practice, because the second version produces better answers. That is precisely where the risk lies: the incentive points the wrong way.

How widespread the use has become is shown by Bitkom's AI study of September 2026: 57 percent of companies with 20 or more employees use AI, up from 36 percent a year earlier; a further 38 percent are planning or discussing it. A typical use in tax firms is research, for instance on Federal Fiscal Court rulings and Federal Ministry of Finance circulars. Research without client reference is the uncritical case here.

What exactly does professional confidentiality protect?

Everything entrusted to or learned by the tax adviser in the course of practising the profession. The duty is set out in § 57 paragraph 1 StBerG as a professional obligation, and § 203 paragraph 1 number 3 StGB makes its breach a criminal offence. Tax advisers are named there explicitly, alongside lawyers, doctors and other professions.

More is protected than most people assume. Not only figures and documents, but the very fact that a particular engagement exists. A case from which the client can be inferred, even without the name appearing, can also be a protected secret. In a firm with a regional client base, the industry plus the revenue bracket is sometimes enough.

Who becomes criminally liable when something goes wrong?

Both sides can become liable, for different reasons: anyone involved in the service at the vendor who discloses a secret without authorisation is liable under § 203 paragraph 4 sentence 1 StGB, and so is the professional if they failed to have the vendor bound to secrecy (sentence 2 number 1, see below).

§ 203 paragraph 3 sentence 2 StGB permits disclosure of protected facts to participating persons, to the extent necessary for their work. IT service providers fall under this. The legislator created the rule in 2017 to make outsourcing legally viable at all; before that, every instance of external IT maintenance sat in a grey area.

The permission comes with a condition. The professional must bind the participating person to confidentiality. If they intentionally fail to do so and the provider subsequently discloses a third party's secret, the professional is themselves liable under § 203 paragraph 4 sentence 2 number 1 StGB. The penalty range is imprisonment of up to one year or a fine.

So there is no configuration in which one can say the vendor is responsible and I have nothing to do with it. Responsibility for the obligation rests with the professional and cannot be delegated away.

What does § 62a StBerG require of an AI provider?

Five things, concrete enough to turn into a checklist. § 62a StBerG is the professional-law counterpart to § 203 StGB and governs the use of external services in detail.

Paragraph 3 adds the duty to limit knowledge to what is necessary and to govern whether and how the provider may bring in further parties. That last point matters particularly with AI providers, because many build on third-party compute. Without contractual clarity there, you do not know how many parties are actually involved.

Data protection comes on top, not instead. A processing agreement under Article 28 GDPR does not automatically satisfy the professional-law requirements, because it does not contain the criminal-law instruction. Both are needed.

What applies if the provider is based abroad?

Then a further hurdle arises. The client's consent, by contrast, is not a question of location.

§ 62a paragraph 4 StBerG permits giving a provider that performs its service abroad access to client secrets only if the protection of secrets existing there is comparable to protection in Germany, unless the protection of the secrets does not require this. For the other EU member states, the explanatory memorandum generally assumes comparable protection. For all other countries it is a separate case-by-case assessment, not settled by standard contractual clauses alone, because what counts is the protection of secrets existing there.

Regardless of location, § 62a paragraph 5 StBerG requires the client's consent where a service directly serves a single engagement and gets to see client secrets in doing so. According to the explanatory memorandum, what matters is whether there is a particular need for the service in the individual engagement, as with a translator or an expert. A tool the firm keeps available for all of its work is, by this standard, rather a general working tool; where the line is unclear, consent provides certainty.

In practice this means: before client data goes into a tool whose service is performed outside the EU, the firm has to check whether the protection of secrets there is comparable. Anyone using such tools with client data should decide this knowingly, not out of ignorance.

The clean alternative is a provider that performs the service in Germany or another EU member state and accepts the obligation under § 62a paragraph 3 StBerG in text form. Paragraph 4 then does not apply at all for services in Germany and is generally met in the other EU member states, leaving the requirements in the table and in paragraph 3. Paragraph 5 applies regardless to services that directly serve a single engagement.

Where the language model may run for that, and which four operating models come into question, is a separate question. We have worked it through in LLM hosting under § 203 StGB. This article stays with what the firm has to settle contractually and organisationally.

Which tasks can be automated with legal certainty?

More than the previous section suggests. The key is to sort tasks by their data exposure rather than by their technology.

The most productive applications lie not in advice but upstream of it: in everything that costs time without requiring professional judgement. Call handling is the clearest example, because it creates the same bottleneck in tax firms as in medical practices. How that is solved there is described in our guide to the AI phone assistant for medical practices; the professional-law construction differs, the organisational problem is identical.

One point applies to every such application: the system may only draw on stored knowledge and must escalate rather than improvise. How such a knowledge base is built, and why it is the decisive difference between useful and dangerous, is covered in our article on the knowledge base of AI agents.

What belongs in a firm policy on AI use?

Six points, and they fit on two pages. Such a policy is not bureaucratic decoration but the practical way to document the duty of care under § 62a paragraph 2 StBerG.

1. Name the approved tools explicitly. Anything not on the list is not approved. Without that, every employee decides for themselves.
2. Draw the data line expressly. Which details may never be entered: client name, tax number, addresses, amounts, file references, anything from which the client can be inferred.
3. Make anonymisation binding. Anyone abstracting a case needs instructions on exactly what to replace.
4. Record the review duty. Every output is checked by the professional before it enters an engagement. Language models invent citations, including convincingly formatted ones.
5. Name who is responsible. One person decides on approvals and maintains the list.
6. Document training. Who was trained, when, on what, with a signature.

The last point is not optional. Since 2 February 2025, Article 4 of the EU AI Act has required every company deploying AI systems to take measures for the AI literacy of the people involved. Since the Digital Omnibus it is enough to support its development; nobody has to guarantee a specific level. The provision prescribes no curriculum but an organisational responsibility: training, internal guidelines or multiplier programmes are equally recognised measures. From 3 August 2026, the competent market surveillance authorities monitor compliance.

What else does the EU AI Act change for firms?

Less than is often feared. Tax advice is not listed as a high-risk area in Annex III of the regulation, so those obligations do not apply.

Two points are relevant. First, the AI literacy requirement under Article 4 just mentioned. Second, the transparency obligation under Article 50, in force since 2 August 2026: anyone interacting directly with an AI system must be able to recognise it. For a firm this mainly concerns call handling and website chat. The details are covered in our article on the AI disclosure duty under Article 50.

The professional-law requirements remain untouched by this. They are older, stricter, and for firms they are the real benchmark.

What applies to firms in Austria and Switzerland?

Austria. Tax advisers and auditors fall under § 80 of the Wirtschaftstreuhandberufsgesetz 2017: members of the profession are bound to confidentiality about the matters entrusted to them, and subsection 5 extends the duty to vicarious agents. § 121 of the Austrian Criminal Code, the counterpart to § 203 StGB, concerns health professions; for tax advisers the emphasis lies in professional law. For data protection the GDPR applies as in Germany, so the data processing agreement under Article 28 is only half the answer there too. The confidentiality undertaking of the AI provider and its sub-processors belongs explicitly in the contract. The AI Act applies directly, with Article 4 and Article 50 as described above.

Switzerland. Fiduciaries and tax advisers are not in the catalogue of Art. 321 of the Swiss Criminal Code. It names, among others, lawyers, notaries and auditors bound to confidentiality under the Code of Obligations, in each case including their auxiliary persons. For the fiduciary sector Art. 62 of the Federal Act on Data Protection (FADP) applies: anyone who wilfully discloses secret personal data of which they gained knowledge while practising a profession that requires knowledge of such data is liable on complaint to a fine of up to 250,000 Swiss francs. The same applies to persons working for them. However, Art. 62 FADP only covers personal data of natural persons. It does not protect information about legal entities, such as the figures of a company limited by shares or a limited liability company; there the contractual duty of confidentiality arising from the engagement remains the basis.

For outsourcing to an AI provider Art. 9 FADP requires that no statutory or contractual duty of confidentiality prohibits the transfer and that every sub-processor is authorised in advance. Art. 16 FADP governs disclosure abroad. The EU AI Act does not apply directly in Switzerland.

This section provides orientation and does not replace advice under Austrian or Swiss law.

Frequently asked questions

Conclusion

Professional confidentiality is not an obstacle to AI in a tax firm but a design constraint. In 2017 the legislator deliberately created a route for engaging external service providers, and that route is open. It only requires that you take it rather than work around it.

What goes wrong in practice is rarely a deliberate decision in favour of a risky tool. It is the unnoticed everyday: a pasted case, a quick test, a helpful answer. That is why a two-page firm policy achieves more than any technology decision.

The first step takes half an hour: write down which tools are actually in use in the firm, and for each one check where processing happens and whether an obligation under § 62a paragraph 3 StBerG exists. The list is usually longer than expected, and usually at least one entry is missing its contract.

If the practice then moves to its own tool instead of publicly available services, processing within Europe and the obligation of everyone involved are part of the setup.

This article was published on 11 August 2026 and on 18 September 2026 was aligned with the Digital Omnibus and extended to cover Austria and Switzerland. On 18 October 2026 we updated the adoption figure to Bitkom's September 2026 study and removed a figure on tax firms whose source could no longer be verified. On 8 November 2026 we corrected the presentation of § 62a paragraphs 4 and 5 StBerG: consent under paragraph 5 does not depend on where the provider is located, but on whether a service directly serves a single engagement. We also clarified that under § 203 paragraph 4 sentence 1 StGB, anyone at the provider who discloses a secret is criminally liable as well. This article does not constitute legal advice. For assessment of an individual case, consult the competent chamber of tax advisers or a lawyer.

Sources

• § 57 paragraph 1 Steuerberatungsgesetz (professional confidentiality)
• § 62a Steuerberatungsgesetz (use of external services), in particular paragraphs 1 to 5
• § 203 Strafgesetzbuch (violation of private secrets), in particular paragraph 1 number 3, paragraph 3 sentence 2 and paragraph 4 sentence 2 number 1
• Regulation (EU) 2024/1689 (EU AI Act), Article 4 (AI literacy, since 2 February 2025) and Article 50 (transparency obligations, since 2 August 2026)
• Regulation (EU) 2016/679 (GDPR), Article 28 (processing on behalf of a controller)
• Bitkom (14 September 2026): Erstmals nutzt die Mehrheit der Unternehmen KI - 57 percent of companies with 20 or more employees use AI (2025: 36 percent), 38 percent are planning or discussing it
• Austria: § 80 of the Wirtschaftstreuhandberufsgesetz 2017, duty of confidentiality and § 121 of the Criminal Code, Austrian Legal Information System
• Switzerland: Art. 321 of the Criminal Code and Arts. 9, 16 and 62 of the Federal Act on Data Protection (FADP), in force since 1 September 2023