AI for Tax Firms: What Section 203 StGB and the GDPR Allow, and What You Owe Your Clients [2026]

AI in a tax firm is legal when two conditions hold at the same time: the provider is bound to professional secrecy as an assisting person under section 203(3) and (4) of the German Criminal Code (StGB), and the processing of client data meets the GDPR, including a data processing agreement and, for payroll and health-related data, Article 9. A private ChatGPT account meets neither. A platform with EU hosting, a signed confidentiality obligation, a data processing agreement and permissions per client file meets both.

This guide is written for the 53,932 tax practices in Germany and their Austrian counterparts under the Wirtschaftstreuhandberufsgesetz. It explains what the 2017 reform of section 203 actually allows, where the GDPR adds duties the criminal code does not, which five questions settle any vendor conversation, which use cases pay off first, and how DATEV, ChatGPT, Copilot and a dedicated platform compare when the client is a Berufsgeheimnisträger.

Since the reform of 9 November 2017, a tax adviser may disclose client secrets to other assisting persons to the extent necessary for their work, and the legislature named the operation, maintenance and external storage of IT systems as exactly such work. That sentence is what makes cloud software, and with it cloud AI, legally possible for a Berufsgeheimnisträger. The condition sits one paragraph later: the assisting person must be bound to secrecy, and a provider who then discloses a secret faces up to one year in prison under section 203(4). If you never bound the provider, the criminal exposure is yours, not theirs, a point the innFactory analysis of section 203 and public cloud makes with the phrase that this is no trivial offence.

Three consequences follow for AI tools. First, the confidentiality obligation is a separate document from the GDPR data processing agreement; the DPA checklist covers Article 28, not section 203. Second, every link in the chain counts: if your platform sends prompts to a model provider, that provider is also an assisting person and must be bound as well, which is why a platform that can show you its sub-processor list and their obligations is worth more than one that cannot. Third, necessity is a real test. Uploading a full client file to draft a two-line e-mail is not necessary; a platform that lets you scope what the model sees per task keeps you on the right side of that word.

The GDPR adds three duties the criminal code does not know. A data processing agreement under Article 28 with every AI provider, with a sub-processor list you can actually read. A legal basis for special categories under Article 9 wherever payroll runs through the tool: sickness days, religious affiliation for church tax, disability status and union membership are all special-category data and appear in ordinary payroll files. And a data protection impact assessment under Article 35 when you process client data at scale with a new technology, which an AI platform over your whole client base is. The DPIA template is built for that case.

The practical trap is not the contract, it is the prompt. Staff paste a client name, a tax number and a bank statement into a chat window because that is the fastest way to get an answer. A platform that resolves those references itself from a connected system, with permissions per client file, means the person never has to paste anything, and the audit log shows which file the model read. That is the difference between a policy and a control.

Your officer will run the same twelve questions as for any other AI tool; the data protection officer checklist lists them with the proving documents. For the most common starting point, ChatGPT Business and the GDPR shows tier by tier where residency and the DPA stop.

The best first use cases in a practice share two properties: the input is something the firm already holds in a system, and the output is checked by a professional before it leaves the building. Client questions about deadlines, a draft reply to a Finanzamt letter, a summary of a 40-page audit report and a searchable memory of every circular your association ever sent are all of that kind. Fully automated filing is not, and the AI Act will treat some HR-adjacent uses as high risk from December 2027.

The table sorts common use cases by the data class they touch and by the setup that makes them permissible. The time figures are deliberately absent where we have no source; the DStV whitepaper on AI assistants from February 2025 is the honest starting point for expectations.

Most practices will run two things: the AI that is already inside their practice software, and a general assistant for everything the practice software does not do. The first is DATEV's territory and it is the right answer for receipts and postings, because the data never leaves the DATEV data centre. The second is where the section 203 question actually arises, because it is where staff reach for ChatGPT.

The table compares the realistic options for that second layer. It is deliberately fair to DATEV and deliberately hard on us: Teamo AI is a managed platform, and a practice that requires air-gapped operation should look at self-hosting instead. For the broader vendor field see the ChatGPT alternatives for the Mittelstand and the six-component test in what an AI operating system for companies is.

Practices that already tried Langdock should read the Langdock alternative guide before renewing.

Two dates matter. Since 2 February 2025 every deployer must ensure AI literacy among staff under Article 4, which for a practice means a documented training that covers what may be entered, what must be checked and how to recognise a wrong answer; the Article 4 training guide has the curriculum. From 2 December 2027, after the postponement in the Digital Omnibus, AI used for hiring, promotion or evaluation of your own staff is high risk under Annex III, with human oversight and logging duties. Client-facing tax work is not high risk, but it remains a section 203 matter every single day.

All of this belongs in one document: a practice AI policy. The AI policy template for companies has the twelve clauses; for a practice, add the confidentiality obligation and the rule that client identifiers never enter a tool that is not bound under section 203. Austrian practices face the same structure under section 80 of the Wirtschaftstreuhandberufsgesetz 2017, which carries the confidentiality duty of Wirtschaftstreuhänder and their assistants.

Section 203 was rewritten in 2017 precisely so that professionals could use external IT without committing a crime. The price is one document most vendors have never seen and a discipline about what enters a prompt. Practices that settle both, and put the rule in a policy, get the productivity their staff are already taking from private accounts, minus the exposure.

Start with the two use cases that touch no client secret, the circular memory and the client FAQ. Bind the provider, sign the DPA, run the training. Then move client work onto the platform file by file, with the permission demo as your acceptance test.