Section 203 model catalogue

AI models for professionals bound by secrecy

Which models carry German professional secrets when you procure them through us - with the vendor version, the purchase price per million tokens and the date behind every entry.

To the models German catalogue

The route decides, not the model

German law treats a lawyer's, notary's, tax adviser's or doctor's file as a criminal-law secret. Section 203 of the German Criminal Code permits handing it to a participating service provider - an AI provider among them - only if that provider is put under a written confidentiality obligation, and it makes the professional liable if that is missing.

That is why the same model can be usable on one route and unusable on another. This catalogue therefore lists a status per model for procurement through us: whether the chain is closed, whether one piece is still open, or whether the provider excludes something the law requires. The German original with the full route matrix is at ki-modelle-berufsgeheimnistraeger.

Two figures accompany every entry: the vendor version actually running, and the purchase price per million tokens, passed through without a mark-up. Both are maintained in one place and refreshed weekly - this page reads them, it does not keep its own copy.

37 models by status

Grouped by the question a firm actually arrives with: which of these can I use at all?

Available through us

Everything section 203 requires is settled, including the provider's confidentiality undertaking. You do not have to clarify anything further.

  • ChatGPT gpt-5.5 EUR 3.16 per million tokens OpenAI · version as of 29 August 2026
  • Claude Opus claude-opus-5 EUR 9.20 per million tokens Anthropic · version as of 29 August 2026
  • Claude Sonnet claude-sonnet-5 EUR 3.68 per million tokens Anthropic · version as of 29 August 2026
  • Claude Haiku claude-haiku-4.5 EUR 1.84 per million tokens Anthropic · version as of 29 August 2026
  • Gemini Flash gemini-3.7-flash EUR 0.78 per million tokens Google · version as of 29 August 2026
  • Llama llama-4-maverick EUR 0.65 per million tokens Meta · version as of 29 August 2026 Blended from input EUR 0.65 · output EUR 0.65
  • Mistral EUR 0.30 per million tokens Mistral AI Blended from input EUR 0.20 · output EUR 0.60
  • Mistral Small mistral-small-2603 Mistral AI · version as of 29 August 2026
  • Qwen qwen3.8-flash EUR 0.238 per million tokens Alibaba Cloud (Qwen) · version as of 29 August 2026 Blended from input EUR 0.15 · output EUR 0.50
  • Gemma gemma-4-26b-a4b-it EUR 0.20 per million tokens Google · version as of 29 August 2026 Blended from input EUR 0.10 · output EUR 0.50
  • Apertus EUR 1.44 per million tokens Swiss AI Initiative (EPFL, ETH Zürich) Blended from input EUR 1.25 · output EUR 2.00
  • GPT-OSS gpt-oss-120b EUR 0.25 per million tokens OpenAI · version as of 29 August 2026 Blended from input EUR 0.15 · output EUR 0.55
  • DeepSeek deepseek-v4-pro-0813 EUR 0.275 per million tokens DeepSeek · version as of 29 August 2026 Blended from input EUR 0.20 · output EUR 0.50 · cache hits EUR 0.10
  • Muse Glimmer muse-glimmer-30b Meta · version as of 29 August 2026
  • Nemotron nemotron-3.5-lightning NVIDIA · version as of 29 August 2026
  • GLM glm-5.3-flash Z.ai (Zhipu AI) · version as of 29 August 2026
  • Phi phi-4 Microsoft · version as of 29 August 2026
  • ChatGPT mini gpt-5.4-mini OpenAI · version as of 29 August 2026
  • ChatGPT kompakt gpt-5.4-nano OpenAI · version as of 29 August 2026
  • ChatGPT Reasoning o3 OpenAI · version as of 29 August 2026
  • Mistral Large mistral-large-2512 Mistral AI · version as of 29 August 2026
  • Mistral Medium mistral-medium-3-5 Mistral AI · version as of 29 August 2026
  • Gemini Pro gemini-2.5-pro Google · version as of 29 August 2026
  • Gemini Flash Lite gemini-3.5-flash-lite Google · version as of 29 August 2026

Usable, but one piece is still open

You can work with it - but part of the safeguard is open: either the provider does not commit to confidentiality itself, or it depends on an agreement you still have to conclude. Which of the two applies to which route is set out in the full matrix.

Not usable for client data

The provider excludes something section 203 requires - usually the confidentiality commitment or the purpose limitation on your inputs. With client data this route does not work.

Not obtainable through us

In the catalogue because you need to know this as well.

Components, not choices

31 further entries do not answer questions - they make a corpus findable, turn speech into text or read scans. You do not pick them; they work underneath. They are listed because they see the same files, and the same contractual question applies to them.

Task classes

Firms do not choose a model by name but by task. The German catalogue sorts the models into these 7 classes and names the tasks per profession:

  • Document and file summarisation
  • Pleading and drafting work
  • Contract analysis and clause review
  • Research preparation
  • Data extraction from receipts
  • Correspondence
  • Dictation and transcription

The task-by-task breakdown exists in German only for now - see the German catalogue.

Questions we get about this catalogue

What is section 203 of the German Criminal Code?

It makes it a criminal offence for members of certain professions - lawyers, notaries, tax advisers, auditors, doctors, psychotherapists and others - to disclose a secret entrusted to them in that capacity. Since a 2017 reform, subsection 3 sentence 2 expressly permits disclosure to participating persons such as IT service providers, and subsection 4 makes the professional criminally liable if that provider is not put under a written confidentiality obligation. That single sentence is why this catalogue exists: for German professional secrets, the question is not which model you use but who stands between you and it, and what they have signed.

Why does the route matter more than the model?

The same model can carry professional secrets on one route and not on another. Claude via the Google EU platform is covered, because the platform operator has signed a confidentiality agreement under section 203; the identical model bought directly from the vendor is not. The status in this catalogue therefore always refers to procurement through us - it is a statement about a contract chain, not about model quality.

What does covered mean?

That the chain is closed for this model when you procure it through us: confidentiality undertaking under section 203(4) in text form with instruction on criminal liability, chain obligation onto the subcontractors, a data processing agreement, and the technical commitments on non-retention. Nothing is left to be obtained. 47 of the entries in this catalogue are in that position.

Does this replace our own professional assessment?

No. The catalogue documents the contractual and technical position with a date and sources. Assessing the individual case - client structure, consents, the bar on foreign processing, chamber requirements - stays with the firm and its professional-law advice.

We are not a German firm. Does any of this apply to us?

Section 203 is German criminal law. It binds you if you practise in Germany, and it becomes relevant to a foreign firm through German mandates, German subsidiaries or German clients whose data you process. The substance we can evidence - who signed what, where processing takes place, who has access - is independent of jurisdiction; the legal assessment is not. For Austria and Switzerland we map the equivalent norms on separate pages, in German.

Which combination fits your work?

We go through your tasks - the files, the client structure, the IT situation - and name the models that carry them, together with the chain they stand on.

Arrange a conversation