Professional secrecy and AI: the technical questions behind the duty of confidentiality

Professionals bound by secrecy may use AI – but the duty of confidentiality applies towards every third party, and an AI provider is a third party. Anyone who enters client or patient data into an AI tool must therefore ask stricter questions than any other company: what has been agreed contractually? Where is the data stored? Is it used for training? And is the protected data needed for the purpose at all? This article sets out the basic principles – it is no substitute for legal advice or for information from your professional body in an individual case.

In brief

• Professional confidentiality is a separate level alongside the GDPR – and stricter in many respects; breaching it can also have criminal law consequences.
• Consumer AI tools without a data processing agreement (DPA) and without a training exclusion are unsuitable for client and patient data.
• Even with a business contract: enter as little protected data as possible, be critical of anonymisation, restrict access internally.
• AI is less critical where it concerns internal know-how with no reference to a client mandate or patient – templates, processes, the specialist knowledge of the firm or practice.
• Professionals bound by secrecy should ask every provider where the data is processed, which sub-processors are involved, whether there is access from third countries and whether a training exclusion and sources have been agreed – assessing the answers remains the job of the firm or practice.

Why is professional secrecy stricter than the GDPR?

Data protection and professional secrecy are often lumped together, but they are two separate levels. The GDPR protects personal data of all kinds and governs how its processing must be organised. The duty of confidentiality protects something else: the relationship of trust between the professional and the client or patient. It is a professional duty and exists regardless of whether data processing has been set up properly under data protection law.

It is laid down in the relevant professional legislation: for lawyers in the Rechtsanwaltsordnung (§ 9 RAO, the Austrian Lawyers’ Act), for doctors in the Ärztegesetz (§ 54 ÄrzteG 1998, the Austrian Physicians Act), for tax advisers and auditors in the Wirtschaftstreuhandberufsgesetz (the Austrian act governing public accountants and tax advisers). Breaching professional secrets can also have consequences under criminal and disciplinary law. The legal texts are available in the Austrian federal legal information system RIS (ris.bka.gv.at).

For AI, this means: “The tool is GDPR-compliant” is a necessary but not a sufficient answer. The second question is always: is passing data to this service provider compatible with my duty of confidentiality – and have I safeguarded it contractually and technically in the way my professional law expects?

Where exactly do AI tools pose a risk?

The basic problem is quickly explained: whatever is entered into an AI tool leaves the protected sphere of the law firm or practice and sits with the provider. Five risks deserve particular attention:

• No DPA: free and private versions generally do not offer a data processing agreement. So even the legal basis under data protection law is missing – not to mention professional law.
• Use for training: if the provider reserves the right to use inputs to train its models, you are handing over protected information for someone else’s purposes. In industries bound by confidentiality, a contractual training exclusion is the point that is scrutinised most closely.
• Third-country transfer: if the data is stored outside the EU or there is remote access from there, the whole issue of third-country transfers comes into play.
• Storage of histories: even without use for training, many services store inputs and chat histories for a certain time, for example to monitor misuse. How long, where and with what access is one of the contractual questions.
• Shadow IT: the biggest risk in everyday work is employees’ private AI accounts. Where the firm does not provide a suitable tool, people improvise – without a contract, without oversight, without management knowing.

Professional group	Legal basis	Typically affected data
Lawyers	Rechtsanwaltsordnung (§ 9 RAO)	Mandate content, written submissions, correspondence, strategy
Tax advisers, auditors	Wirtschaftstreuhandberufsgesetz	Income and asset data, accounting, payroll data
Doctors	Ärztegesetz 1998 (§ 54)	Diagnoses, findings, courses of treatment

The list could go on – notaries, pharmacists, consultants with contractual confidentiality agreements. The pattern remains the same: the stricter the duty of secrecy, the higher the requirements for every service provider that comes into contact with the data – AI providers included.

Which questions should a law firm or practice ask an AI provider?

The following six questions are useful in every conversation with a provider – and for tools that are already in use. They do not prescribe an answer: the firm or practice has to judge for itself – if in doubt together with its chamber or professional body – whether what a provider promises contractually and technically is enough for its own duty of confidentiality.

1. Is there a DPA under Art. 28 GDPR – and what does it govern regarding purpose, instructions and sub-processing?
2. Is use for training contractually excluded? Are inputs and documents used to train or improve models – including by the provider of the language model?
3. Where is the data processed, which sub-processors are there, is there access from third countries – and are the guarantees sufficient? The list of sub-processors shows who is involved and whether this includes companies from third countries or groups headquartered outside the EU; how this is to be assessed under professional law is not for the provider to decide.
4. How is access controlled internally? Are there roles and permissions so that only those who are allowed to see something can see it? Professional secrecy does not end at the office door.
5. Does every answer name its source? Can you open the document behind every AI answer? This is doubly important, because AI can be wrong and a professional cannot hand over professional responsibility for their work to a tool.
6. How are logging and deletion handled? Can you trace who accessed what and when, and are there clear rules on what is deleted and when?

How can law firms and practices use AI sensibly without risking secrecy?

In practice, a tiered approach works well. Tier one: internal know-how with no reference to a client mandate or patient. Every law firm and every practice sits on a mountain of documented knowledge that has nothing to do with confidentiality: templates and model documents, checklists for recurring procedures, process descriptions (“How do we open a new file?”), deadline logic, QM documents, manuals for the practice management software. This is where the quickest wins lie: an AI knowledge base for this operational knowledge answers the team’s questions with sources from your own documents – new employees find processes themselves instead of asking the colleague who is currently in a hearing. Typical everyday questions: “How do we open a new file correctly?”, “Where is the current fee note template?”, “How does our deadline tracking work?” – all answerable from documents that do not touch any secret.

Tier two: protected data – only with full safeguards. Documents relating to a client mandate or patient only become an option once the questions above have been answered – contract, training exclusion, place of processing, sub-processors and third-country access, access controls – and the firm or practice has satisfied itself that this is permissible under professional law. Even then, data minimisation remains a permanent principle: as little protected data as possible, only as much as necessary. At this tier, rely not on provider advertising but on the text of the contract and, if in doubt, on guidance from your chamber or professional body.

One organisational duty applies to both tiers: a written AI policy that tells the team which tools are permitted and which data may be entered where. Without this clarity, shadow IT emerges – and in an industry bound by confidentiality, that is the real risk.

The overview article AI and the GDPR in Austria shows in detail how the DPA, server location and training exclusion work together.

As a next step, start where professional secrecy is not affected – with the internal knowledge of the firm or practice. The page on how the implementation works walks you through the roll-out step by step.