AI in a tax firm: professional secrecy, GDPR and client consent

Austria. Under § 80(1) WTBG 2017, licensed professionals must keep secret the matters entrusted to them. Subsection 2 extends the duty to personal circumstances and to business and trade secrets. The duty lapses, among other cases, when the client has expressly released the professional from it (subsection 4, item 2). Subsection 5 extends the provisions to vicarious agents (Erfüllungsgehilfen), partners and trainees. § 80 does not state expressly whether a cloud or AI provider counts as a vicarious agent. Clarify this question for your firm with your professional chamber or a legal adviser. § 80 WTBG 2017 in the RIS.

Germany. § 57(1) StBerG requires tax advisers to keep secret everything that became known to them in the exercise of the profession. The only exceptions are facts that are public and facts that do not need confidentiality. § 57 StBerG.

Service providers in Germany. § 62a StBerG governs the use of external service providers. The firm may give service providers access to protected facts as far as this is necessary for the service. It must select the provider carefully. The contract must be in text form and must bind the provider to secrecy, with a notice of the criminal consequences of a breach. The provider may only obtain knowledge as far as this is necessary for the contract. For services provided abroad, the protection of secrets there must be comparable to the protection in Germany. The data protection rules remain unaffected (subsection 8). § 62a StBerG.

Data protection in addition. The GDPR applies alongside professional law. If a provider processes personal data on behalf of the firm, Article 28 GDPR requires a data processing agreement. Article 32 GDPR requires technical and organisational measures that take the state of the art into account. GDPR on EUR-Lex.

The AI Act defines a deployer as a person or body that uses an AI system under its authority, except for personal, non-professional use. A provider is a person or body that develops an AI system, or has one developed, and places it on the market or puts it into service under its own name. Definitions in Article 3.

A firm that uses a chat tool or a feature in BMD or DATEV at work is therefore normally a deployer. The role can change if the firm offers its own system under its own name, for example an assistant for clients. As a deployer, Article 4 on AI literacy applies to you, among other provisions. Our article on AI literacy under Article 4 shows how to do this in a small team. The deadlines after the Digital Omnibus are summarised in our article on the EU AI Act for SMEs.

Firm-wide tools. An AI tool that the whole firm uses, with a data processing agreement and checked security measures, is in a similar position to other cloud services your firm already uses, for example email or document storage. In Germany, § 62a(1) to (3) StBerG sets the frame for this. This is our assessment for practice, not a statement by an authority or a chamber.

Consent for a single engagement. In Germany, § 62a(5) StBerG requires the client's consent if a service directly serves a single client engagement. In Austria, § 80(4) item 2 WTBG 2017 names the express release by the client.

When a release makes sense. A separate release by the client can also make sense in other cases:

• for a special purpose, for example the analysis of all of a client's documents for an expert opinion
• for special data, for example health data in a tax return
• for a tool that you are still testing and for which the contracts are not yet complete

The following table shows the details that a written release for a specific AI system should name.

Conditions. Four conditions should be met before use:

1. A data processing agreement under Article 28 GDPR is in place.
2. The provider keeps all disclosed information confidential, not only personal data. This matches the scope of secrecy under § 57 StBerG and § 80 WTBG 2017.
3. The provider's staff are bound to confidentiality. Article 28(3)(b) GDPR requires this for persons who process personal data.
4. The provider applies technical and organisational measures at the state of the art (Article 32 GDPR).

A release by the client does not replace these conditions. In Germany, the requirements of § 62a(2) and (3) StBerG also apply when the client has consented, unless the client expressly waives them (§ 62a(6) StBerG).

Business accounts. Use business plans for which the provider offers a data processing agreement. Private plans usually run under consumer terms. Our article on ChatGPT for business and the GDPR compares the plans of one provider in detail.

One account per person. Do not share one account between several people. Each person should see only the client files they need for their work. With a shared account, every person sees the full history, and you cannot trace who made which input.

No private accounts. Prohibit private accounts for client work. Put this in a written rule. Our article on an AI usage policy for SMEs shows what such a rule looks like.

Sign-in. Turn on multi-factor authentication or passkeys for all accounts. If your firm uses central sign-in, connect the AI tool to it. You can then remove a person's access in one place when they leave.

Check in the provider's documentation, for each plan, whether inputs are used to train models. General claims such as "free tools always train on your data" are not reliable. The statements differ.

The table summarises the statements of three providers as of 3 October 2026.

Feedback. All three providers name an exception: if a person rates an answer with thumbs up or thumbs down, the provider can use the conversation for training. Set a rule in the firm that no feedback is given on client data.

Training is not the only question. Even without training, the provider stores inputs for a certain time, and the provider's staff can have access in defined cases. Read the statements on retention and access as well.

Data Privacy Framework. Transfers to US companies certified under the EU-U.S. Data Privacy Framework are covered by the Commission's adequacy decision. Implementing Decision (EU) 2023/1795. Check the certification in the official participant list.

Status on 3 October 2026. Microsoft Corporation is listed for the EU-U.S. Data Privacy Framework with the status "Active – Re-certification under Review" (Microsoft Corporation entry). In the participant list we downloaded on 3 October 2026, we found no entry for OpenAI and none for Anthropic. The status can change. Check it again before you decide.

Without certification. If the recipient is not certified, many providers rely on standard contractual clauses under Article 46 GDPR. Clause 14 of these clauses requires the parties to assess the law in the destination country and to document the assessment. This assessment is often called a transfer impact assessment. Standard contractual clauses, Implementing Decision (EU) 2021/914.

Contracting entity and data flow. Your contracting entity can be a company in the EU even if the data is processed in the US. Read the section on third-country transfers in the data processing agreement and the list of sub-processors. In Germany, § 62a(4) StBerG also requires that the protection of secrets abroad is comparable to the protection in Germany.

Microsoft describes "enterprise data protection" for Microsoft 365 Copilot and Copilot Chat. According to Microsoft, the products are now named Microsoft Copilot and Microsoft Copilot Chat. Microsoft Learn: Enterprise data protection, checked on 3 October 2026.

Microsoft states the following points there:

• Use by organisations is covered by the Data Protection Addendum and the Product Terms. Microsoft acts as a data processor.
• Prompts and responses are covered by the same contractual commitments as emails in Exchange and files in SharePoint.
• Prompts, responses and data accessed through Microsoft Graph are not used to train foundation models.
• Web searches through Bing are not covered by this addendum. For these queries, Microsoft acts as an independent controller.
• The EU Data Boundary does not apply to web searches. According to Microsoft, Anthropic models are currently excluded from the EU Data Boundary.

What the commitment does not do. A provider's commitment on the GDPR does not automatically cover national professional-secrecy law. For Germany, check whether the contract meets the requirements of § 62a(3) StBerG. For Austria, check whether the confidentiality matches the scope of § 80 WTBG 2017. Also decide whether web search in Copilot stays switched on for client work.

Certification. In our view, certification under ISO/IEC 27001 is a strong signal. It shows that an external body has audited an information security management system. Check the scope of the certificate: it must include the service you use.

Without a certificate. Many small providers do not have such a certificate. In that case, ask for the description of the technical and organisational measures. Ask about encryption, access rights, storage location, retention, deletion and sub-processors. If the provider cannot answer these questions, do not use the service for client data.

Fallback. If the check of one provider stays open, a provider based and processing in Europe can be an alternative. Check the contract, training and security measures there too. A European location alone does not answer these questions.

If you want to remove data before input, the data must really be gone from the file. A black bar placed over text in a PDF only covers the text. The text can still be readable underneath, for example by copying it. A marker on a printout that is then scanned often leaves text legible.

Proceed as follows:

1. Use a real redaction function that removes the text from the file.
2. Remove metadata, comments and earlier versions.
3. Check the result: copy the text from the redacted file and search for names and numbers.

Your firm is responsible for everything it sends to clients or authorities, even if an AI tool wrote the draft. Check figures, deadlines and legal bases against the original sources.

A case from Canada shows the principle. In Moffatt v. Air Canada, 2024 BCCRT 149, a chatbot on the airline's website gave wrong information about a special fare. Air Canada argued that the chatbot was responsible for its own statements. The Civil Resolution Tribunal of British Columbia rejected this on 14 February 2024: Air Canada is responsible for all the information on its website, whether it comes from a static page or a chatbot. Decision Moffatt v. Air Canada. The decision was made under Canadian law and does not bind courts in Austria or Germany.

Legal basis. A recording contains personal data and needs a legal basis under Article 6 GDPR. In practice, this is usually the consent of all participants. Consent must be freely given and can be withdrawn at any time (Article 7 GDPR).

Criminal law. In Germany, § 201 StGB makes it an offence to record the non-publicly spoken word of another person on a sound carrier without authorisation (§ 201 StGB). In Austria, § 120(2) StGB makes it an offence to make a recording of a non-public statement accessible to a third party for whom it is not intended, without the speaker's consent (§ 120 StGB in the RIS).

Procedure. Before each recording, obtain the consent of all participants and document it. Say which tool processes the recording, how long you keep the recording and the transcript, and when you delete them. Clarify individual cases with a legal adviser.

The following table lists the points to check before the first input of client data.

This article describes statutory texts and provider statements as of 3 October 2026. It is not legal advice and does not replace a review by your professional chamber or a legal adviser.

These articles go deeper into the topics of this guide:

• EU AI Act for SMEs: duties and current deadlines
• AI literacy under Article 4 AI Act: what SMEs must do after the omnibus
• ChatGPT for business: GDPR, plans and costs
• AI usage policy for SMEs
• AI automation for tax firms