Sample · Kit

Purpose and structure

In brief: What the sector edition of the evidence kit is, what it is not, in which order it is filled in, and how you can tell it is finished.

This kit is for three professions in which confidentiality is not one rule among many but the foundation of the profession: the law firm (Rechtsanwaltskanzlei), the tax advisory firm (Steuerberatungskanzlei) and the medical practice (Ordination). It takes the five records of the general AI evidence kit — usage policy, tool register with approval form, training record, labelling checklist, entry-into-force plan — and sharpens them to what is different in these professions: which data an assistant must never see there, how the register and the approval check treat these types of data, who is bound by confidentiality, and which questions the business clarifies with its chamber or a professional before use. Three files are added that the general kit does not have: a supplement sheet to the policy per profession, a page “What never goes in here” per profession, and a chamber checklist.

What the kit is

A set of forms in which the passages where the business has to decide are highlighted in yellow and set in square brackets. Next to each of these passages stands one sentence in italics: what the decision means and where in the handbook “AI Policies for the Workforce” (Volume 2 of the series) or in this guide the basis is given. That is the rule which sets this kit apart from a collection of templates: every gap is marked and explained. A template in which you only enter the name of the firm decides, in the business's place, things it cannot see — and in these three professions those are things for which the licensed professional is personally answerable.

The sector edition is self-contained: whoever has it does not need the general kit alongside. Whoever has already filled in the general kit will recognise its files and will find, for each file in this guide, the section “What is different compared with the general kit”.

What the kit is not

It is not legal advice and not a legal opinion. And in this edition a second sentence applies that matters even more: The kit never says what confidentiality permits. Whether entering the facts of a case into an AI tool is a disclosure, whether a contract with the provider suffices, whether the client or the patient must be informed, whether an anonymised input is permissible — no file in this kit answers any of these questions. The files record what the business has decided and name the place where it has this checked: the chamber or a professional. The chamber checklist is therefore not an enclosure but step 2 of the plan, before any procurement.

Nor does the kit establish any legal position anew. The legal bases of confidentiality that appear in the files as examples — the Rechtsanwaltsordnung (Austrian Lawyers' Code), the Wirtschaftstreuhandberufsgesetz 2017 (Austrian Public Accountants' Act), the Ärztegesetz 1998 (Austrian Physicians' Act) — come from search extracts that could not be read in the original for this kit; this is stated in every file that names them and in the annex. The business reads the provision in the Federal Legal Information System and enters version and date. What this guide says about the publications of the chambers, it says with a date and with the note that they were not read.

The kit contains no names of tools or providers. It supplies the empty register and the procedure by which the business keeps it itself, with a date in every row.

The three professions — and who else

The files speak of the “licensed professional” (Berufsträgerin oder Berufsträger) and mean the person who carries confidentiality under professional law: the lawyer, the tax advisor, the physician. In the three professions that is almost always also the management, and so this person appears in the files where the general kit says “management”. Notaries, pharmacies, psychotherapy and other professions bound by confidentiality are not the subject of this kit; the structure probably fits there too, but the legal bases and chambers are different and were not researched.

The market of this kit is the Union; the examples come from Austria and are marked as such. Professional law is national. What the kit names as legal bases and chambers applies to Austria; a business in another Member State fills the same fields with its own provisions and its own chamber and puts the same questions to the chamber. The guide mentions at one place what is said to be regulated differently in Germany — as a hint, not as a survey.

The order

1. Open the chamber checklist (kammer-pruefliste-en.docx) and open the entry-into-force plan (inkraftsetzung-en.xlsx). The checklist is step 2 of the plan, and it belongs at the start, because the answers there decide which tools are eligible for which data at all. The questions are asked before a tool is procured or an account is set up.
2. Fill in the supplement sheet of the profession (ergaenzung-kanzlei-en.docx, -steuerberatung-en.docx or -ordination-en.docx). Read the legal basis in the original, chamber, auxiliary persons, the rule for data under professional secrecy, informing clients or patients, and the table of clarifications.
3. Fill in the usage policy (nutzungsrichtlinie-en.docx). The section “Professional secrecy and confidentiality” and the nine areas of regulation.
4. Tick, delete and add on the page “What never goes in here” (nie-hinein-<profession>-en.docx, the same page as PDF) and post it.
5. Create the tool register (tool-register-en.xlsx, freigabeformular-en.docx). Every tool one row, including the one in the practice software and the one on the private phone; for data under professional secrecy, rows 8 to 10 of the approval check and the clarification.
6. Hold the briefing and record it (schulungsnachweis-en.docx, schulungsnachweis-en.xlsx) — with every person who has access to data under professional secrecy, even if they use no tool.
7. Create the labelling checklist (kennzeichnungs-checkliste-en.docx); point 10 is always completed, even if the business publishes nothing.
8. Complete the entry into force. Tick the last rows, enter the follow-up — with the fifth trigger that exists only in this edition: a publication by the chamber.

How you can tell it is finished

The kit is finished when a folder — on paper or as a file store — contains the records that together answer two questions: What have we regulated, since when, for which tools, and who knows about it? and, new in this edition: Whom did we ask, when, and what was the answer?

• The usage policy with effective date, version line and signature; no yellow passage left open.
• The supplement sheet of the profession with the legal basis read, the rule for data under professional secrecy and at least one row in the table of clarifications that carries date and evidence.
• The page “What never goes in here”, ticked and struck through, posted.
• The tool register, in which every tool has a row with review date, the column “professional secrecy affected” is completed, and an approval form is filed for every approved tool.
• The training record with one signature per person and the date of their confidentiality declaration.
• The labelling checklist with point 10 — or a dated note that nothing is currently published and no system speaks directly to persons.
• The chamber checklist, on which every row carries a date and evidence, including those answered “this is not settled”.
• The entry-into-force plan, in which every one of the eighteen rows carries a date and the follow-up is entered.

The three example businesses

The examples in this guide refer to three fictitious businesses in Austria. People appear by their role, never by name; the businesses do not exist.

The law firm: two lawyers, one trainee lawyer (Konzipientin), three office staff, one external IT contractor; focus on contract and tenancy law, occasionally family matters. One lawyer has for months been using a text-assistant tool through a private account for summaries of court decisions and first drafts; one member of the office staff has client letters “polished” — with names.

The tax advisory firm: one tax advisor as owner, five staff in bookkeeping and payroll, one office manager, two apprentices, one external IT contractor. The office manager uses a text-assistant tool through a business account for client letters about deadlines; one apprentice has a tool on his phone with which he has receipts “explained”.

The medical practice: one general practitioner, two practice assistants, one intern, one cleaner, practice software from a provider with a maintenance contract. The physician dictates physician's letters into a transcription app on her private phone; one assistant has patient information on the flu vaccination worded by a text-assistant tool — without personal data.

None of the three businesses has an IT department, none has appointed a data protection officer. In all three, something is happening that the policy must regulate before anyone asks.

Choice of words

The files and this guide say tool; the German edition of the handbook says Werkzeug at the same places. What is meant is the same: an AI system that the business uses as deployer and did not develop itself. Professional secrecy and confidentiality are used side by side: confidentiality is the person's duty, professional secrecy is what it protects; the files say “data under professional secrecy” for everything the profession's duty of confidentiality covers. Auxiliary persons (Hilfspersonen) is the word of the Physicians' Act and means here everyone who has access to such data in a firm or practice without being a licensed professional. Chamber (Kammer) means the statutory professional body responsible for the business; where it gives no information, a professional takes its place. Record means a sheet that shows, with date and signature, that something was regulated, reviewed, asked or carried out — not that it is legally sufficient.