Professional secrecy and AI: the technical questions behind the duty of confidentiality

Professionals bound by secrecy may use AI – but the duty of confidentiality applies towards every third party, and an AI provider is a third party. Anyone who enters client or patient data into an AI tool must therefore ask stricter questions than any other company: what has been agreed contractually? Where are the data stored? Are they used for training? And is the protected data needed for the purpose at all? This article sets out the basic principles – it is no substitute for legal advice or for information from your professional body in an individual case.

In brief

• Professional confidentiality is a separate level alongside the GDPR – and stricter in many respects; breaching it can also have criminal law consequences.
• Consumer AI tools without a data processing agreement (DPA) and without a training exclusion are unsuitable for client and patient data.
• Even with a business contract: enter as little protected data as possible, examine anonymisation critically, restrict access internally.
• AI is less critical where it concerns internal know-how with no reference to a client mandate or patient – templates, processes, the specialist knowledge of the firm or practice.
• Where the data is processed, which sub-processors are involved, whether there is access from third countries and whether a training exclusion and sources have been agreed are the questions that professionals bound by secrecy should ask every provider – the assessment of the answers remains with the firm or practice.

Why is professional secrecy stricter than the GDPR?

Data protection and professional secrecy are often lumped together, but they are two separate levels. The GDPR protects personal data of all kinds and governs how its processing must be organised. The duty of confidentiality protects something else: the relationship of trust between the professional and the client or patient. It is a professional duty and exists regardless of whether data processing has been set up properly under data protection law.

It is anchored in the relevant professional law: for lawyers in the Rechtsanwaltsordnung (§ 9 RAO, the Austrian Lawyers’ Act), for doctors in the Ärztegesetz (§ 54 ÄrzteG 1998, the Austrian Physicians Act), for tax advisers and auditors in the Wirtschaftstreuhandberufsgesetz (the Austrian act governing public accountants and tax advisers). Breaching professional secrets can also have consequences under criminal and disciplinary law. The legal texts are available in the Austrian federal legal information system RIS (ris.bka.gv.at).

For the use of AI, this means: ‘The tool is GDPR-compliant’ is a necessary but not a sufficient answer. The second question is always: is passing data to this service provider compatible with my duty of confidentiality – and have I safeguarded it contractually and technically in the way my professional law expects?

Where exactly is the risk with AI tools?

The basic problem is quickly explained: whatever is entered into an AI tool leaves the protected area of the law firm or practice and sits with the provider. Five risk points deserve particular attention:

• No DPA: free and private versions generally do not offer a data processing agreement. This means even the basis under data protection law is missing – not to mention professional law.
• Use for training: if the provider reserves the right to use inputs to train its models, you are handing over protected information for someone else’s purposes. In industries bound by confidentiality, a contractual training exclusion is the point that is scrutinised most closely.
• Third-country transfer: if the data is stored outside the EU or there is remote access from there, the whole complex of third-country transfers comes into play.
• Storage of histories: even without use for training, many services store inputs and chat histories for a certain time, for example to monitor misuse. How long, where and with what access is one of the contractual questions.
• Shadow IT: the biggest risk in everyday work is employees’ private AI accounts. Where the firm does not provide a suitable tool, people improvise – without a contract, without control, without the knowledge of management.

Professional group	Legal basis	Typically affected data
Lawyers	Rechtsanwaltsordnung (§ 9 RAO)	Mandate content, written submissions, correspondence, strategy
Tax advisers, auditors	Wirtschaftstreuhandberufsgesetz	Income and asset data, accounting, payroll data
Doctors	Ärztegesetz 1998 (§ 54)	Diagnoses, findings, courses of treatment

The list could go on – notaries, pharmacists, consultants with contractual confidentiality agreements. The pattern remains the same: the stricter the duty of secrecy, the higher the requirements for every service provider that comes into contact with the data – AI providers included.

Which questions should a law firm or practice ask an AI provider?

The following six check questions are suitable for every conversation with a provider – and for tools that are already in use. They do not prescribe an answer: whether what a provider promises contractually and technically is sufficient for your own duty of confidentiality is assessed by the firm or practice itself, if in doubt together with its chamber or professional body.

1. Is there a DPA under Art. 28 GDPR – and what does it govern regarding purpose, instructions and sub-processing?
2. Is use for training contractually excluded? Are inputs and documents used to train or improve models – including by the provider of the language model?
3. Where is the data processed, which sub-processors are there, is there access from third countries – and are the guarantees sufficient? The list of sub-processors shows who is involved and whether this includes companies from third countries or groups headquartered outside the EU; how this is to be assessed under professional law is not for the provider to decide.
4. How is access regulated internally? Are there roles and permissions so that only those who are allowed to see something can see it? Professional secrecy does not end at the office door.
5. Does every answer name its source? Can the document from which an AI answer comes be opened for every answer? This is doubly important, because AI can be wrong and a professional cannot hand over professional responsibility for their work to a tool.
6. What do logging and the deletion concept look like? Is it traceable who accessed what and when, and are there clear rules on when what is deleted?

How can law firms and practices use AI sensibly without risking secrecy?

In practice, a tiered model has proven its worth. Tier one: internal know-how with no reference to a client mandate or patient. Every law firm and every practice sits on a mountain of documented knowledge that has nothing to do with confidentiality: templates and model documents, checklists for recurring procedures, process descriptions (‘How do we open a new file?’), deadline logic, QM documents, manuals for the practice management software. This is exactly where the quickest benefit lies: an AI knowledge base for this operational knowledge answers the team’s questions with sources from your own documents – new employees find processes themselves instead of asking the colleague who is currently in a hearing. Typical questions from this everyday work: ‘How do we open a new file correctly?’, ‘Where is the current fee note template?’, ‘How does deadline control work here?’ – all answerable from documents that do not touch any secret.

Tier two: data with a protection reference – only with full safeguards. Only once the check questions above have been answered – contract, training exclusion, place of processing, sub-processors and third-country access, access concept – and the firm or practice has clarified admissibility under professional law for itself, do documents with a reference to a client mandate or patient come into question – with data minimisation as a permanent principle: as little protected data as possible, as much as necessary. At this tier, do not rely on provider advertising, but on the text of the contract and, if in doubt, on information from your chamber or professional body.

One organisational duty applies to both tiers: a written AI policy that tells the team which tools are permitted and which data may be entered where. Without this clarity, shadow IT emerges – and in an industry bound by confidentiality, that is the real risk.

How the DPA, server location and training exclusion work together in detail is shown in the overview article AI and the GDPR in Austria.

As a next step: start where professional secrecy is not affected – with the internal knowledge of the firm or practice. You can see how such an introduction works step by step under how the implementation works.