All insightsInsights

How German attorney service-provider rules apply to AI tools in a law firm.

Name the service-provider chain for law-firm AI tools: selection, text-form programme, config, human review. Not legal advice — a working map for counsel and ops.

September 25, 20265 min read

When a law firm puts an AI tool near matter files, the hard question is not which model brand to buy. It is which service-provider chain you are opening — and who may release which object into that chain.

German attorney professional law sets rules for using external service providers around confidential mandate work. In practice the statute most often named for this path is BRAO §43e (attorney service-provider rules). This piece is not legal advice. Counsel owns the pathway. We map the operational chain so selection, contract, config, and human approval stay visible — the same pattern agents on Spectacle use when proposals must wait for release.

The chain, not the chat skin

Name four steps before any prompt leaves the trust zone:

Selection — What work does the tool do? Which objects does it need (excerpt, metadata, full document, log, embedding)? Is it firm infrastructure or mandate-specific? Who is the provider, where do prompts and outputs land, and which subprocessors sit behind the endpoint?
Text-form programme — Attorney service-provider rules expect a written programme with the provider covering confidentiality, purpose limits, and subcontractor control — among other points counsel must check against the statute and chamber guidance. Do not invent clause text here.
Config — Access, retention, no-train claims to verify, region, logging, and which classes of object may actually reach the endpoint. A signed programme that never reaches the config is theatre.
Human review — A person with professional responsibility releases the object (or refuses). The model may draft. The name under the filing stays human. See without approval the agent sleeps.

That is the service-provider chain for law-firm AI tools. Chat alone is not the chain.

Once, in body: a data processing agreement is not the whole programme

Under GDPR, a data processing agreement (often called an AVV in German practice) can be necessary when a processor handles personal data. Recurring professional-law debate says that agreement alone does not replace the attorney service-provider programme under BRAO §43e. Say it once. Do not turn it into a slogan title. Counsel decides how the two layers sit for your firm.

Chamber materials (BRAK / DAV and related guidance) are guidance and debate, not settled holdings we invent. Read them with counsel. Do not treat a PDF tip sheet as a finished compliance certificate for any stack.

What the programme must touch in the operation

The contract language only bites if it maps to objects you already name in the firm:

Which matter objects may leave which trust zone (sensitive data needs a case graph; objects from the operation).
Whether the path is firm-wide infrastructure or a mandate-specific service that may need client consent under the statute’s consent gate — counsel decides the fork.
Abroad / comparable secrecy questions when the endpoint or a subprocessor sits outside the assumed protection zone — again counsel, not a landing page.
Logging: who released which object into which provider path, and when.

Sovereign hosting such as STACKIT can be a residency option for inference. Hosting is not the operation — models on STACKIT are not the operation. Cite only; do not republish that cousin. Residency does not finish the service-provider chain.

Approval still holds the switch

Agents on Spectacle may propose language grounded in objects the stack already holds. Without approval the agent sleeps. Sealed systems of record are not written back. Arithmetic stays in code. The model only writes language. We do not invent hours, ROI, euros, or accuracy bands.

What we are not selling

Not legal advice. Not a remake of live STACKIT or case-graph cousins. Not a named competitor law-firm AI suite. Not “AI for hospitality” or restaurant software. Not a deep-tech kernel pitch. Not silent write-back. Not a claim that any cloud or on-prem stack is “§43e-safe” by brand.

One core, every kind of business — one core, every operating type. Six sector bands equal. Law is one configuration of the same operating pattern — objects, zones, approval — not the only reader of this desk.

FAQ

Is this legal advice?
No. It is an operational map of the service-provider chain. Counsel owns BRAO §43e, secrecy, and consent pathways.

What is the service-provider chain for law-firm AI tools?
Selection → text-form programme with the provider → config that matches the programme → human review before objects leave the trust zone.

Does a GDPR data processing agreement finish the job?
Often necessary for personal data processing — and, in professional-law debate, not by itself the full attorney service-provider programme. Say it once; counsel decides the stack of layers.

Can we name STACKIT?
Yes as infrastructure vocabulary. No as a claim that hosting alone satisfies attorney service-provider rules.

Do agents answer without approval?
No. They propose. You release. Without approval the agent sleeps.

Is this only for law firms?
The statute cited is attorney-specific. The operating pattern — classify objects, choose the zone, log, approve — repeats across regulated white-collar work. Six bands equal.

Where should I start?
Spectacle. The Insights series is how we write about the operation. Bring counsel for the statute.

CTA

If AI tools sit near matter files and the service-provider chain is still unnamed — selection, programme, config, human review — request an initial analysis. Twenty minutes is enough to see whether objects, zones, and approval are visible before any prompt leaves. If the data cannot answer, we say so. Counsel still owns the law.

Keep reading.

See all insights Email us