All tools

§ 203 vendor check

May this vendor see your client data?

Seven criteria decide whether an AI vendor can be engaged as an assisting person under § 203 (3) StGB. Answer them for one specific vendor — including the one you already use.

Seven criteria that decide whether a vendor can be engaged as an assisting person under § 203 (3) StGB. Answer for one specific vendor — including the one you already use.

01

Obligation to secrecy

critical

Can the vendor produce the § 203 StGB obligation to secrecy concretely — as a document you can file, rather than a general reference?

Your assessment
02

The whole chain obligated

critical

Does the vendor also obligate its staff and any subprocessors in writing — and produce those declarations on request?

Your assessment
03

Processing inside the EU

Is it contractually fixed that processing happens inside the EU — including any subprocessors?

Your assessment
04

Art. 28 GDPR processing agreement

Is there a processing agreement covering instruction-binding, technical and organisational measures and deletion duties?

Your assessment
05

No training on your inputs

Is it contractually assured that prompts, uploads and protected client or patient data are not used to train the models?

Your assessment
06

Roles, permissions and logging

Can access to protected secrets be evidenced through roles, SSO and audit logs?

Your assessment
07

Client and patient separation

Can cases, mandates or patient data be kept properly separate instead of sitting in one shared context?

Your assessment

Answer all criteria first — "Don't know" is a valid answer and is carried as an open question.

Overview

What this is about

For professionals bound by secrecy, AI is not a data-protection question but a criminal-law one: § 203 StGB makes unauthorised disclosure of entrusted secrets an offence, and subsection 4 extends that to anyone you engage to assist. This sheet checks the seven points that decide it — two of them are critical: without them the setup is not permissible, however good the rest looks. No login, free. It informs and does not replace legal advice.

FAQ

Good to know

What do I get?
An assessment of your answers about one specific vendor, the gaps and the open questions — plus a checklist with the reasoning per criterion.
Does the check rate specific vendors?
No. It assesses only what you enter yourself. No vendor data is stored and no vendor is compared with another.
Does this replace legal advice?
No. The sheet informs. Whether and how AI may be used in your specific profession is something to settle with your chamber and legal counsel.