// FAQ
The questions law firms ask.
Professional conduct, costs, timelines, data residency: the questions firms put to us most often before introducing AI.
Professional conduct, costs, timelines, data residency: the questions firms put to us most often before introducing AI.
That depends on the service and on how it is set up. Among the things that decide it: whether the provider is contractually bound to professional secrecy (§ 203 StGB, the criminal provision on breach of secrets, and § 43e BRAO, the professional rule on engaging service providers), whether there is a data processing agreement under Art. 28 GDPR, and whether your inputs are used for training. We set the environment up so that these points are documented and can be checked afterwards. The assessment under professional conduct rules in the individual case stays with you.
More on this: § 43e BRAO: a checklist for the cloud contract
You have to separate consumer services from enterprise setups here. Freely available consumer offerings are usually neither bound to professional secrecy nor covered by a data processing agreement. Enterprise and cloud setups, for instance via AWS Bedrock (the language model service of the cloud platform Amazon Web Services), can be run with a processing agreement, a written secrecy undertaking for holders of professional secrets, and logging. Which route fits your firm is something we settle before the first use.
More on this: Enforce EU hosting, do not just select it
That depends on the scope: a starter package with your own AWS account is a much smaller piece of work than building a knowledge base across your entire file inventory. We work in four self-contained modules that can be commissioned individually or one after another. We work out the right scope for your firm in the free initial call.
More on this: AI belongs in non-billable work first
One to two weeks is typical for the starter package, two to four weeks for the context layer, and four to six weeks for AI agents (programs that carry out several work steps on their own) or the knowledge base. What decides it is mostly how available your data is and how decisions get made in the firm. We deliberately start with one small, self-contained module.
Your data sits in Frankfurt. The model call itself can take place in another European region when EU-wide inference profiles are used (requests are spread across several EU data centre regions so that capacity and response times hold up). It does not leave the EU, but the difference can count for the assessment under professional conduct rules, so we say it in advance. Which models are available in which region is something we fix before the rollout and document.
More on this: Enforce EU hosting, do not just select it
No. We set up the account, the access and the working interface, and hand over a documented configuration. For day-to-day operation, one contact person in the firm is enough in smaller units; on request we support maintenance and further development.
More on this: Security basics for a law firm AWS account
As a question about the model, this is too coarse: under professional-secrecy rules the access route decides, not the model. The same model can be impermissible for client data through a chat interface and workable as a cloud deployment in your own account, provided the confidentiality undertaking, the data processing terms and the processing location are settled. We work through this with you for your firm; the professional-conduct assessment in the individual case stays with you.
More on this: The access route decides, not the model
No, not on its own. A DPA under Art. 28 GDPR satisfies data protection law; lawyers' professional secrecy is a separate regime with its own requirements, above all § 43e BRAO. A provider can fully serve one without touching the other, which is why we check both separately.
More on this: Why a data processing agreement is not enough for law firms
Yes, and it should be short and concrete. It answers four questions: which systems are approved, which data may go in, who checks the output, and what happens when something goes wrong. Without one, shadow AI appears: tools nobody approved or documented. A ban alone only moves the use elsewhere; it does not end it.