Sample · Part I · Section 1 · What is different in the three professions

Professional secrecy and confidentiality — what the kit records and what it does not

In brief: The three duties of confidentiality, whom they cover, what the chambers have published on the subject — and the line this kit does not cross.

In an electrical business the question of what may go into an AI tool is a question of caution: calculations are trade secrets, customer data are personal, both are better left out. In a law firm or medical practice the same question is a question of the profession. The lawyer, the tax advisor and the physician are bound to confidentiality by the professional law of their country; the duty is the reason people entrust them with anything, and according to the wording of the provisions it covers not only the licensed professionals but also their auxiliary persons. An AI tool of a third-party provider is a third party. Whether an input there is a disclosure, under which conditions it is not, and what a contract with the provider changes — these are the questions this kit revolves around, and it answers none of them. It records what the business has decided and names the place where it has this checked.

1.1 The three legal bases — as examples, not as information

For the three professions the files each name one provision as an example for the gap “legal basis of confidentiality in our profession”. All three come from search extracts: the Federal Legal Information System and the chambers' pages were not reachable from the working environment in which this kit was produced. The wordings agree across several independent extracts; which version applies and which paragraphs belong to it has not been established. Therefore every file that names one of the three provisions carries the addition “verify version against the original” — and the business enters version and date after reading.

Law firm. According to the search extract, the first sentence of the second paragraph reads: the lawyer is bound to confidentiality about the matters entrusted to them and the facts that otherwise became known to them in their professional capacity, the secrecy of which is in the interest of their party. The same paragraph is said — according to a summary, not the wording — to cover shareholders and supervisory bodies of a law firm company and to oblige the lawyer to bind them and their auxiliary staff to confidentiality and to take sufficient precautions for compliance.

Tax advisory firm. According to the search extract, the first paragraph reads: licensed professionals are bound to confidentiality about the matters entrusted to them. Which paragraph or which other provision covers the office staff or requires their obligation has not been established; what is known is that the Chamber of Tax Advisors and Auditors (Kammer der Steuerberater:innen und Wirtschaftsprüfer:innen) provides a template “Erklärung zur Verschwiegenheitspflicht” (confidentiality declaration) for office staff.

Medical practice. According to the search extract, the first paragraph reads: the physician and their auxiliary persons are bound to confidentiality about all secrets entrusted to them or that became known to them in the exercise of their profession. This is the only one of the three provisions that names auxiliary persons in its first sentence itself. In addition, what applies to all three but concerns every row in the practice: health data are a special category of personal data whose processing is prohibited under the General Data Protection Regulation unless one of the exceptions applies — among them care and treatment by professional staff subject to professional secrecy or by another person who is likewise subject to an obligation of secrecy. Whether an AI provider can be such another person, this kit does not say; the handbook “AI in the Company” (Volume 1) covers the data protection side in section 11.

1.2 Whom confidentiality covers — and why that changes the training list

All three provisions cover auxiliary persons according to the search extracts: the practice assistant, the office clerk, the trainee lawyer, the apprentice in bookkeeping. The medical chambers advise, according to the same extracts, to inform auxiliary staff in writing about the duty of confidentiality and to file the signed copy in the personnel file; the tax advisors' chamber provides a template. For the criminal provision that protects professional secrecy in the health sector, auxiliary staff and persons in training are said, according to the search extract, to be treated in the same way as the professionals — the kit names this provision in no file, because it names no penalty as an assertion; the annex states that it exists.

For the kit a simple rule follows, set out in section 5: Every person who has access to data under professional secrecy belongs on the training record — even if they use no AI tool. The cleaner who is alone in the treatment room in the evening, the intern, the external IT contractor with remote access. Whether they use a tool decides which parts of the briefing concern them; whether they belong on the list is decided by access. The confidentiality declaration itself is not a sheet of this kit — there are chamber templates — but the overview per person records when it was signed.

1.3 What the chambers have published on AI — with date, without content

The kit names chamber publications with title and date and says in every file that it has not read them. That is not negligence but the only honest form: passing off a second-hand summary as the content of a binding professional rule would be worse than the admission.

Austrian Bar. There is a leaflet “Künstliche Intelligenz (KI) in Anwaltskanzleien” (artificial intelligence in law firms) of the Österreichischer Rechtsanwaltskammertag, updated in September 2025 according to the search extract. It is said to contain a checklist that can be presented to AI providers for written confirmation of professional requirements, and to state that responsibility for client data and for checking results remains with the lawyer. Whether it is a recommendation or a binding rule has not been established. In addition, there is a conduct rule that matters for the approval check: § 40(3) of the Richtlinien für die Ausübung des Rechtsanwaltsberufes (RL-BA 2015, rules of professional conduct) is said — according to a summary — to tie the use of external providers of electronic data processing without the client's consent to five conditions: preservation of the client's interests, careful selection of the provider, its contractual duty to give notice in the event of a search of premises, technical and organisational measures according to the state of the art, informing the client. Whether an AI tool is such a provider, the kit does not say; the approval check has five rows K1 to K5 for the law firm that correspond to the five conditions, and the chamber checklist has the question whether the rule applies.

Chamber of Tax Advisors and Auditors. As of 15 September 2026 the search found no recommendation, guide or binding rule of the chamber on the use of AI. According to the search extract the chamber has an expert committee for IT, digitalisation and artificial intelligence. The kit says in the file: “Whether the chamber has published a recommendation or rule on the use of AI is to be asked of the chamber before use.” It does not say “there is none” — a search that could not open the chamber's pages cannot know that.

Austrian Medical Chamber (Österreichische Ärztekammer). On 24 October 2024 the chamber called, in a press release, for mandatory labelling of AI-generated diagnostic images — a non-removable watermark, because a note in the metadata is too easy to remove; final responsibility must lie with the physician. That is a demand addressed to the legislator, not a binding rule and not a recommendation to practices; the labelling checklist takes it up in point 10 as a reason to consider AI-generated images in findings separately. A chamber recommendation on the use of generative AI in practices the search did not find. Known is a practice handbook of the Vienna medical chamber with a chapter on data protection and IT security, whose content was not read.

1.4 The data protection authority — and the note on other Member States

The Austrian data protection authority has published questions and answers on AI and data protection; according to summaries it says that entering personal data into a generative AI system is processing, that input, output and transmission to the provider are subject to the General Data Protection Regulation, and that accuracy is a challenge with generative text systems. Whether it addresses professionals bound by secrecy has not been established. The chamber checklist has question 10 for this.

Professional law is national. A business in Germany would enter different provisions in the gap “legal basis”; according to search extracts, the inclusion of “participating persons” — IT service providers, AI providers — in professional secrecy is said to have been expressly regulated there since 2017 under conditions, and the Federal Bar and the Federal Chamber of Tax Advisors are said to have published their own guidelines and question catalogues on AI, the latter with status of 27 January 2026. None of this was read, none of it is contained in the kit as a requirement. It only shows why the fields of the supplement sheet are delivered empty: the business fills them with its own law and its own chamber.

1.5 The line in one sentence

The general kit says: every gap is marked and explained. This edition adds: every question to professional law is marked and passed on to the chamber. Whoever fills in the files takes decisions; whoever fills in the chamber checklist shows that they asked before the decisions. Both together are the evidence a business bound by professional secrecy needs — and this kit claims no more.