Section 203 model catalogue

AI models for professionals bound by secrecy

Which models carry German professional secrets when you procure them through us - with the vendor version, the vendor's list price per million tokens and the date behind every entry.

To the models German catalogue

The route decides, not the model

German law treats a lawyer's, notary's, tax adviser's or doctor's file as a criminal-law secret. Section 203 of the German Criminal Code permits disclosing it to a participating service provider - an AI provider among them - insofar as this is necessary for using that provider's services, and it makes the professional liable if the provider was not put under an obligation of confidentiality. Text form and an instruction on criminal liability are added by the professional rules, not by section 203 itself.

That is why the same model can be usable on one route and unusable on another. This catalogue therefore lists a status per model for procurement through us: whether the chain is closed, whether one piece is still open, or whether the provider excludes something the law requires. The German original, where the full route matrix can be requested, is at ki-modelle-berufsgeheimnistraeger.

Two figures accompany every entry: the vendor version actually running, and the vendor's list price per million tokens, without a mark-up. Google lists its prices in US dollars, so the Google routes appear here in dollars; they are invoiced in euros at the European Central Bank reference rate. Both figures are maintained in one place - the versions are refreshed weekly, the prices daily - and this page reads them, it does not keep its own copy.

34 models by status

Grouped by the question a firm actually arrives with: which of these can I use at all?

The price next to a model is the blend per million tokens of the vendor's list price, without a mark-up - three quarters input, one quarter output. The providers set these prices; they can change at any time, and our figures may contain errors. The list price in force at the time is authoritative.

Available through us

Everything section 203 requires is settled, including the provider's confidentiality undertaking, and nothing is stored at the provider, apart from a technical cache of a few minutes for Claude (zero retention). You do not have to clarify anything further.

  • Claude Opus claude-opus-5.5 USD 8.80 per million tokens Anthropic Vendor: claude-opus-5.5, as of 29 September 2026 Blended from input USD 4.40 · output USD 22.00 Vendor's list price, as of 11 October 2026 US dollars as listed by Google; invoiced in euros at the ECB reference rate
  • Claude Sonnet claude-sonnet-5.5 USD 4.40 per million tokens Anthropic Vendor: claude-sonnet-5.5, as of 29 September 2026 Blended from input USD 2.20 · output USD 11.00 Vendor's list price, as of 25 September 2026 US dollars as listed by Google; invoiced in euros at the ECB reference rate
  • Claude Haiku claude-haiku-4.5 USD 2.20 per million tokens Anthropic Vendor: claude-haiku-4.5, as of 29 September 2026 Blended from input USD 1.10 · output USD 5.50 Vendor's list price, as of 11 October 2026 US dollars as listed by Google; invoiced in euros at the ECB reference rate
  • Gemini Flash gemini-3.8-flash USD 1.65 per million tokens Google Vendor: gemini-3.8-flash, as of 29 September 2026 Blended from input USD 0.825 · output USD 4.125 Vendor's list price, as of 11 October 2026 Announced price change from 1 January 2027: USD 3.30 per million tokens US dollars as listed by Google; invoiced in euros at the ECB reference rate
  • Llama llama-4-maverick Meta Vendor: llama-4-maverick, as of 29 September 2026
  • Mistral Mistral 4 119B EUR 0.30 per million tokens Mistral AI Vendor: mistral-small-2603, as of 29 September 2026 Blended from input EUR 0.20 · output EUR 0.60 Vendor's list price, as of 12 October 2026
  • Qwen Qwen 3.6 35B A3B EUR 0.2375 per million tokens Alibaba Cloud (Qwen) Vendor: qwen3.6-35b-a3b, as of 29 September 2026 Blended from input EUR 0.15 · output EUR 0.50 Vendor's list price, as of 12 October 2026
  • Qwen Bildverstehen Qwen 3.8 27B EUR 0.775 per million tokens Alibaba Cloud (Qwen) Vendor: qwen3.8-27b, as of 29 September 2026 Blended from input EUR 0.30 · output EUR 2.20 · cache hits EUR 0.10 Vendor's list price, as of 11 October 2026
  • Gemma Gemma 4 26B A4B EUR 0.20 per million tokens Google Vendor: gemma-4-26b-a4b-it, as of 29 September 2026 Blended from input EUR 0.10 · output EUR 0.50 Vendor's list price, as of 12 October 2026
  • Apertus Apertus 70B EUR 1.4375 per million tokens Swiss AI Initiative (EPFL, ETH Zürich) Vendor: Apertus-v1.5-70B, as of 29 September 2026 Blended from input EUR 1.25 · output EUR 2.00 Vendor's list price, as of 12 October 2026
  • GPT-OSS GPT-OSS 120B EUR 0.25 per million tokens OpenAI Vendor: gpt-oss-120b, as of 29 September 2026 Blended from input EUR 0.15 · output EUR 0.55 Vendor's list price, as of 12 October 2026
  • DeepSeek DeepSeek Flash v4 0731 EUR 0.275 per million tokens DeepSeek Vendor: deepseek-v4.1-flash, as of 29 September 2026 Blended from input EUR 0.20 · output EUR 0.50 · cache hits EUR 0.10 Vendor's list price, as of 12 October 2026
  • Muse Glimmer muse-glimmer-30b Meta Vendor: muse-glimmer-30b, as of 29 September 2026
  • Nemotron nemotron-3.5-lightning NVIDIA Vendor: nemotron-3.5-lightning, as of 29 September 2026
  • GLM GLM 5.3 754B EUR 1.625 per million tokens Z.ai (Zhipu AI) Vendor: glm-5.3-flash, as of 29 September 2026 Blended from input EUR 1.00 · output EUR 3.50 · cache hits EUR 0.25 Vendor's list price, as of 11 October 2026
  • Phi phi-4 Microsoft Vendor: phi-4, as of 29 September 2026
  • Gemini Flash Lite gemini-3.5-flash-lite Google Vendor: gemini-3.5-flash-lite, as of 29 September 2026

Through us once the provider clears it

The confidentiality agreement under section 203 of the German Criminal Code is signed. We set the route up without storage at the provider (zero retention) once the provider has committed to it - at Microsoft through the exception from abuse monitoring, which usually takes months. Until then, storage and review by the provider are not ruled out.

  • ChatGPT gpt-6-sol EUR 4.2239 per million tokens OpenAI Vendor: gpt-6-sol, as of 29 September 2026 Blended from input EUR 2.1119 · output EUR 10.5597 Vendor's list price, as of 10 October 2026
  • ChatGPT mini gpt-5.6-terra OpenAI Vendor: gpt-5.6-terra, as of 29 September 2026
  • ChatGPT kompakt gpt-6-luna OpenAI Vendor: gpt-6-luna, as of 29 September 2026
  • Mistral Large mistral-large-2512 Mistral AI Vendor: mistral-large-2512, as of 29 September 2026
  • Mistral Medium mistral-medium-3-5 Mistral AI Vendor: mistral-medium-3-5, as of 29 September 2026

Usable, but one piece is still open

You can work with it - but part of the safeguard is open: either the provider does not commit to confidentiality itself, or it depends on an agreement you still have to conclude. Which of the two applies to which route is set out in the full matrix.

Not usable for client data

The provider excludes something section 203 requires - usually the confidentiality commitment or the purpose limitation on your inputs. With client data this route does not work.

Not obtainable through us

In the catalogue because you need to know this as well.

Components, not choices

31 further entries do not answer questions - they make a corpus findable, turn speech into text or read scans. You do not pick them; they work underneath. They are listed because they see the same files, and the same contractual question applies to them.

Task classes

Firms do not choose a model by name but by task. The German catalogue sorts the models into these 7 classes and names the tasks per profession:

  • Document and file summarisation
  • Pleading and drafting work
  • Contract analysis and clause review
  • Research preparation
  • Data extraction from receipts
  • Correspondence
  • Dictation and transcription

The task-by-task breakdown exists in German only for now - see the German catalogue.

Questions we get about this catalogue

What is section 203 of the German Criminal Code?

It makes it a criminal offence for members of certain professions - lawyers, notaries, tax advisers, auditors, doctors, psychotherapists and others - to disclose a secret entrusted to them in that capacity. Since a 2017 reform, subsection 3 sentence 2 permits disclosure to participating persons such as IT service providers insofar as it is necessary for their work, and subsection 4 makes the professional criminally liable if such a person was not put under an obligation of confidentiality and then discloses the secret; text form and an instruction on criminal liability come from the professional rules, not from section 203 itself. That single sentence is why this catalogue exists: for German professional secrets, the question is not which model you use but who stands between you and it, and what they have signed.

Why does the route matter more than the model?

The same model can carry professional secrets on one route and not on another. Claude via the Google EU platform is covered, because the platform operator has signed a confidentiality agreement under section 203; the identical model bought directly from the vendor is not. The status in this catalogue therefore always refers to procurement through us - it is a statement about a contract chain, not about model quality.

What does covered mean?

That the chain is closed for this model when you procure it through us: confidentiality undertaking under section 203(4) in text form with instruction on criminal liability, chain obligation onto the subcontractors and a data processing agreement; no link in the chain is left to be obtained. For the 25 entries listed as "Available through us", the technical commitments on non-retention (zero retention) are in place as well. For the entries listed as "Through us once the provider clears it", zero retention follows with the provider's exception - at Microsoft, the exception from abuse monitoring, which usually takes months; until then, storage and review by the provider are not ruled out.

Does this replace our own professional assessment?

No. The catalogue documents the contractual and technical position with a date and sources. Assessing the individual case - client structure, consents, the bar on foreign processing, chamber requirements - stays with the firm and its professional-law advice.

We are not a German firm. Does any of this apply to us?

Section 203 is German criminal law. It binds you if you practise in Germany, and it becomes relevant to a foreign firm through German mandates, German subsidiaries or German clients whose data you process. The substance we can evidence - who signed what, where processing takes place, who has access - is independent of jurisdiction; the legal assessment is not. For Austria and Switzerland we map the equivalent norms on separate pages, in German.

Which combination fits your work?

We go through your tasks - the files, the client structure, the IT situation - and name the models that carry them, together with the chain they stand on.

Arrange a conversation