§ 43e BRAO: a checklist for the cloud contract

A confidentiality agreement under § 43e BRAO (the German Federal Lawyers’ Act) is the contract by which a firm binds an external service provider to the duty of professional secrecy. It has to do four things, all of them: text form, a confidentiality undertaking coupled with a formal warning about the criminal consequences of a breach, access limited to what is necessary, and an obligation running through to subcontractors. Miss one of these and the agreement does not meet the standard.

Firms that want to use current AI models in house will find a workable technical basis in AWS Bedrock (the language model service on Amazon’s cloud platform) with EU hosting. The deployment only becomes defensible under professional conduct rules once the contracts are right, and the first hurdle there is the confidentiality agreement.

What must a confidentiality agreement under § 43e BRAO contain?

The governing provision is § 43e BRAO. Under subsection 3, the contract with the provider must do four things, and it must do all four.

1. Text form. The agreement has to be concluded in text form. A verbal assurance during a sales call is not enough, and a general reference to standard terms does not replace the agreement.

2. Confidentiality undertaking with a formal warning. The provider must be bound to secrecy, and that obligation has to be paired with a warning about the criminal consequences of a breach. The second half is what gets missed most often in practice. A confidentiality clause without the warning does not satisfy the provision, however strictly it is drafted.

3. Need to know. Access to client data must be limited to what is necessary. This is where contract and technology meet: the contractual promise only bites once the access rights in the system reflect it, technically for example through hardening the AWS account.

4. Subcontractors. The provider has to ensure that it binds its own subcontractors in text form as well. With a cloud provider this is no fringe issue but the chain at whose end the actual operation takes place.

Requirement	Provision	Question to ask of the contract
Text form	§ 43e(3) sentence 1 BRAO	Is the undertaking agreed in text form, rather than promised verbally or covered by a general reference to standard terms?
Secrecy with a formal warning	§ 43e(3) sentence 2 no. 1 BRAO	Does the contract bind the provider to secrecy and warn about the criminal consequences of a breach?
Need to know	§ 43e(3) sentence 2 no. 2 BRAO	May the provider learn client secrets only as far as performing the contract requires?
Subcontractors	§ 43e(3) sentence 2 no. 3 BRAO	Does the contract settle whether further persons may be brought in, and must they be bound to secrecy in text form?

Run these four points as a checklist against a draft contract someone hands you and it becomes clear quickly whether the document was built for a law firm or for an industrial company with different confidentiality needs. Whether a particular agreement is sufficient in a given case depends on how it is drafted and cannot be answered in the abstract.

A data processing agreement under Art. 28 GDPR does not replace this agreement: it satisfies data protection law, not professional conduct rules. More on that: why a processing agreement is not enough for law firms.

Does AWS sign an agreement under § 43e BRAO?

Yes, though so far case by case rather than as routine. I am currently guiding the setup for the first firms, and we took on the confidentiality agreement together. The surprise was not the content but the route: Amazon evidently has no established process for the agreement § 43e BRAO requires.

This is not an exotic special request. It is the provision that applies to every German law firm using an external service provider with access to client data. You would expect a provider of that size to have a standard route for a contract building block that gets asked for often.

It took a fair amount of back and forth before both sides’ requirements were properly reflected. That it worked in the end was down to individual attention from customer service and the legal department. After the negotiation, signing and the initial setup were done comparatively quickly. So the result is reachable. It is just not routine yet.

Why the contract question belongs at the start of the project

For direct use of current frontier models, law firms have few alternatives. Technically the place of processing can be locked down via the inference profile; the contractual question is untouched by that. If the relevant provider has no established process for a standard professional conduct requirement, the obvious inference is that the requirement has rarely been raised.

My reading: German firms have so far used AI mostly in isolated spots, through familiar tools and wrappers where the contract question is either solved by the intermediary or simply never asked. The step of treating AI not as one more tool alongside the practice management software but as the basis of the whole work is still rare. That step is exactly what makes the contract question unavoidable, because a wrapper does not shift responsibility, it only hides it.

I am happy to be corrected here, since this reading rests on a single data point. Anyone who has been through the same process, with the same outcome or a different one, holds the more valuable information.

For firms facing the same question, the practical consequence is clear either way: contract drafting belongs at the start of the project, not at the end. It takes longer than the technical setup, and it decides whether the technical setup may be used at all. What else needs clarifying is covered in the FAQ.