A chain, not a certificate

Why a chain - and not a certificate

Anyone wanting to test a provider claim such as "§ 203-compliant" needs a grid, not trust. This is that grid: eight links of contract and technology that together carry the supply route. Each is verifiable on its own. If one is missing, the whole statement hangs in the air. The overview page AI under German professional secrecy introduces the chain; this page takes it link by link, with the test question and the form of proof for each.

The doctrinal frame behind it, named openly: § 203 Abs. 3 Satz 2 StGB permits the involvement of assisting persons - which on the prevailing reading includes IT and AI service providers. § 203 Abs. 4 Satz 2 Nr. 1 StGB requires that those persons be obligated to secrecy. The technical line of "no human plaintext access" does not remove the disclosure, though: on the DAV reading (SN 32/2025), merely storing client data on a provider's servers is already a disclosure, because the provider's staff could access it. It counts towards necessity: disclosure is permitted in so far as it is necessary for the service (§ 43e Abs. 1 BRAO, § 203 Abs. 3 Satz 2 StGB), and the DAV requires reasonable safeguards that limit knowledge to what is necessary. The BRAK is stricter: its AI guidance (as at 12/2024) asks for a very careful check whether a cloud provider strictly needs access to client information, and does not consider transmitting client secrets to language models necessary. How strictly necessity is to be read has not been conclusively settled by the courts. The chain therefore runs both lines in parallel - contract and technology as a belt-and-braces risk argument, not as cumulative legal conditions.

Part of the criminal-law precision: § 203 StGB is an intent-only offence and, under § 205 StGB, prosecuted only on complaint. This chain is not about a threat scenario. It is about provability - to whom can a firm evidence that its supply route holds?

Sources: DAV opinion SN 32/2025 (anwaltverein.de), BRAK guidance on AI use, as at 12/2024 (brak.de); each retrieved 22 July 2026.

Link 2: The secrecy obligation (§ 203 Abs. 4 Satz 2 Nr. 1 StGB)

The link most provider assurances cannot evidence: an obligation to secrecy, backed by criminal liability, of the persons assisting at the service provider (§ 203 Abs. 4 Satz 2 Nr. 1 StGB) - backed by criminal liability because those persons are themselves liable under § 203 Abs. 4 Satz 1 StGB if they disclose without authority. Text form and an express notice of criminal liability are required not by § 203 StGB itself but by the professional rules (§ 43e BRAO, § 62a StBerG, § 50a WPO; for notaries § 26a BNotO). The confidentiality clauses customary under the GDPR - "our staff are bound to confidentiality" - do not perform this function: they are employment-law undertakings, not criminal-law ones. Selection and supervision remain with the professional: § 43e Abs. 2 BRAO requires careful selection of the service provider, and ongoing supervision - up to terminating the relationship on breach - stays their responsibility.

The test question for any provider: is the obligation documented and inspectable before the contract is concluded? Established practice for that - a matter of provability, not a requirement of § 203 itself - is a separate instrument rather than a clause inside the main contract. In our own market screening of 22 July 2026, around 8 of some 25 providers examined in the German-speaking market had a substantive contract document at all; the combination of a freely inspectable document before any registration, a separate Abs. 4 instrument as evidence, and legal review was unoccupied at that date.

Link 4: The provider itself as an obligated link

A supply-route provider who defines itself out of the chain has not understood it. Gosign stands in the chain as a processor: its own staff and its sub-processors obligated to secrecy - under § 203 Abs. 4 Satz 2 Nr. 2 StGB, the provision for an assisting person who engages a further one, where Nr. 1 addresses the firm obligating us - and instructed on criminal liability in line with the client's professional rules. It is the same Abs. 4 obligation the firm passes to Gosign and Gosign passes on to staff and sub-processors. Gosign is a named assisting person in the DPA; mapping-key handling and retention are governed contractually.

The architecture is designed for no human access in normal operation: a plaintext-free audit trail and logged break-glass exceptions under four-eyes control. The dedicated firm instance adds a redaction layer that can be switched on per model: pseudonymisation before the model call, re-insertion afterwards. Important in the assessment: this redaction layer is data minimisation and defence in depth. It replaces names and identifiers, not the facts of the case; it is not the condition for satisfying § 203, and where it is switched on it lowers the residual risk under both of the readings set out above (why that is).

Link 6: Third-country transfer - Art. 44 et seq. GDPR, CLOUD Act, DPF status, and the foreign-service bar

Two separate assessments, routinely stirred into one sentence.

Under data protection law (Art. 44 et seq. GDPR): with US providers, CLOUD Act exposure persists even with an EU deployment - the US parent can be compelled to produce. A transfer impact assessment with the DPF status of each provider in the chain and supplementary measures is therefore a mandatory building block, not a formality. Only a chain with no US corporation in it structurally may claim to be free of CLOUD Act exposure - which applies to EU inference of open models and to German data-centre providers with a § 203 secrecy agreement, not to the Azure or Google routes.

Under professional law (the foreign-service bar): § 43e Abs. 4 BRAO, § 62a StBerG and § 50a WPO permit engaging service providers abroad only where secrecy protection is comparable. US sub-processing can therefore be inadmissible under professional law regardless of standard contractual clauses and a completed transfer assessment - a link that pure GDPR checklists systematically miss.

Link 8: Client consent and transparency (Art. 13/14 GDPR)

The last link closes the chain towards the client. First, the transparency duties under Art. 13/14 GDPR: the firm's privacy notice has to reflect the AI processing and the service provider chain. Second - depending on the professional rules - the consent of the client, or of the parties in the case of notaries. § 62a Abs. 5 StBerG and § 50a Abs. 5 WPO regularly require it expressly for matter-related outsourcing; for lawyers, § 43e Abs. 5 BRAO requires the client's consent where the engagement of the service provider relates to an individual matter; for notaries, § 26a Abs. 4 BNotO requires the parties' consent where the service directly serves an individual official act. A provider silent on the consent question leaves its customers to solve the hardest link alone.

Sample consents for clients and for other parties involved, plus a sample transparency notice, are part of the Gosign contract kit (v0.15) and freely inspectable, as samples for case-by-case adaptation by a lawyer, without warranty.