AI that helps law, tax and audit firms research and draft faster, without client secrets leaving the firm

Firms already use AI. Using it on client data is the harder part. In the Wolters Kluwer benchmark for smaller firms, reported by Haufe in 2026, 63.3% of German small firms use AI, against 61% in Europe, and among non-users 58.3% cite unfamiliarity and 38.9% data protection. In companies, KPMG reported in 2026 that 71% of tax departments use AI tools. In Noerr's 2024 survey of in-house legal departments, about 25% already used AI tools but only 15% had AI guidelines.

Once AI runs on the firm's own data, a question about how the firm handled a clause or a tax issue before is answered from its own precedents and memos, with the source shown. First drafts of letters, memos and contract markups need less typing. Incoming contracts are checked against the playbook before a lawyer reads them. The professional judgement, the final review and the responsibility stay with the lawyer, tax adviser or auditor.

Mostly in research, drafting and review, where an assistant prepares the work and the professional keeps the judgement. Knowledge management and document processing each have their own page under Use cases, linked at the end of this page.

Buy before you build where a product fits. Legal products such as Noxtua and Harvey, the research tools of legal publishers and Microsoft 365 Copilot already cover part of this work. Building pays off where the answer is in your own documents and playbook, where client data must not leave your servers, or where you need test results on your own matters.

• Research assistant on the firm's own knowledge: precedents, memos, opinions, model clauses and internal guidance, searchable in plain language, with every answer citing the document and passage. Citations are tested, so the assistant does not point to a source that does not exist.
• Drafting assistant: first drafts of client letters, memos, file notes and standard submissions from the firm's templates and the matter file, marked as drafts for the professional to check and sign.
• Contract review against the firm's playbook: incoming contracts, NDAs and supplier terms compared clause by clause with your standard and fallback positions, deviations listed with the clause and the playbook rule, and a suggested markup for the lawyer to accept or reject. For in-house legal teams, the playbook is the company's own.
• Document analysis in due diligence and audits: data room documents, lease contracts or supporting documents read and summarised into a list of findings, each linked to the page it came from.
• Tax work around DATEV: many firms keep bookkeeping and tax data in DATEV, which offers its own AI features, so use those first where they cover the task. We build what sits around it, such as an assistant on the firm's own memos, circulars and client correspondence, and we check which DATEV interfaces your setup offers before promising any connection.

Professional secrecy is the decisive point. Section 203 of the German Criminal Code (§ 203 StGB) makes it an offence for lawyers, tax advisers and auditors to disclose client secrets without authorisation. According to a 2026 report by the vendor Gosign, the German Bar Association (DAV) treats storing client data with an external provider as disclosure. In the DAV's view, § 43e of the Federal Lawyers' Act (BRAO) and § 203 (3) sentence 2 StGB allow it where it is necessary and safeguarded. The guide of the Federal Bar (BRAK) of December 2024 is stricter. It considered sending client secrets to language models not necessary under the state of the art at the time.

The BRAK guide, as summarised by iww in 2025, says documents should be anonymised before upload and makes the lawyer's final review of AI results mandatory. The DAV, as reported by beck-aktuell in 2025, considers data protection requirements manageable, sees most AI systems in law firms as not high-risk under the AI Act, and states that the final assessment, creative argument and responsibility remain with the lawyers. For tax advisers, the Federal Chamber of Tax Advisers (BStBK) has published rules and an FAQ catalogue on AI in tax firms, reported by iww in 2026. Similar confidentiality duties apply when tax advisers and auditors use service providers.

We describe the technical side here. Whether a setup meets your professional duties is decided by your firm, advised by your data protection officer, your chamber's guidance and your own lawyers. None of this is legal advice.

• The professional reviews every AI result before it goes to a client, a court or an authority.
• Legal and tax advice, audit opinions and every judgement stay with the lawyer, tax adviser or auditor.
• Matters behind information barriers stay excluded through access rights, so the assistant cannot use them in answers for other teams.

Because of § 203 StGB, where the system runs matters more than which model it uses. We set it up on your own servers, in your data centre or a colocation rack, with an open-weight model, which is a model whose weights you can run on your own hardware, so client data does not leave your control. Where a firm prefers the cloud, we use your own cloud account in an EU region, single-tenant where possible, with the contract chain the DAV position points to: a confidentiality undertaking in text form, a data processing agreement and a list of subprocessors. Gosign's 2026 vendor report notes that US groups in the provider chain bring exposure to the US CLOUD Act, which you should weigh with your lawyers.

We connect your document management system or law firm software, SharePoint and Outlook through the interfaces they offer, and carry their access rights into every search, so a lawyer only gets answers from matters they may open. Where the BRAK guidance or your own policy asks for it, names and identifiers are pseudonymised before the model sees them and restored only in the result shown to the authorised user.

All model calls go through one LLM gateway, a single controlled access point with keys, budgets and logs, and the logs stay in your own store. They record which matter and which documents were used, with retention agreed with your data protection officer, so the firm can show later what the assistant did.

Before go-live we build an acceptance test from your own past matters: questions with known answers and sources, contracts with known deviations from the playbook, and drafts a partner has already corrected. We measure whether the answer is right, whether every cited source exists and supports the statement, and how many playbook deviations the review finds and misses.

The partners set the pass mark before the first test run. After go-live the same tests run after every change to the model, prompts or document base, and we track how often professionals accept drafts with no or minor edits. Haufe's 2026 report found that firms invest first where the benefit is immediately visible, in research, so that is usually where we start measuring.

Start with one task that has many similar cases and a clear reviewer, such as NDA review against your playbook or a research assistant on the firm's own memos. This fits mid-sized firms and in-house legal and tax teams best, because they have enough matters to measure and their own documents to build on.

In a free 30-minute first call with an engineer, which needs no access to your systems or client data, we work out the task, where the system should run and what the acceptance test must show. Each step after that has a fixed price, agreed in writing after the first call.