Correspondence drafts, assessments condensed to their decisive points, the endless chase for missing documents, a firm knowledge base that answers instead of interrupting a colleague. That is the writing and searching work that currently ties up the people you cannot hire more of. It is also work that sits squarely inside professional secrecy under § 203 StGB — which is precisely why a client matter does not belong in a consumer chat window.
Few professions combine this much text work with this strict a duty of confidentiality. Deadlines do not move, qualified people are hard to find, and every assessment, every email, every set of annual accounts contains material that is protected.
So the obvious shortcut — paste it into whatever tool is open — is not a grey area. It is a professional risk, and it is being taken quietly in a lot of firms right now precisely because nobody has offered a defensible alternative.
The answer is not to sit out AI while other firms get faster. It is to decide, task by task, what may run where.
Not every office needs all of these. Which ones are worth building depends on your workflows, your systems and what the hours actually cost you.
Reply drafts, reminders and accompanying letters pre-written in the firm's tone. The professional reads, adjusts and sends.
Long assessments, audit reports and contracts condensed to the decisive points before the file is opened properly.
Missing items identified per client, request lists and follow-up letters drafted — instead of the perpetual hunt by individual email.
Working instructions, model cases and internal notes, searchable and answering. New staff find in seconds what otherwise costs a colleague an interruption.
A briefing before each client meeting: current position, open points, deadlines, assembled from your own filing with the source shown.
Tax assessment, structuring advice, signatures. The reserved tasks stay with the professional; the AI takes the preparatory work, never the responsibility.
Three routes are normally on the table, and the right one is decided per task rather than per company.
If tools already cleared by your organisation can do the job, using what you have is usually the shortest route and the easiest to defend.
For work that does not touch confidential material, a European service under a proper processing agreement is often the proportionate answer.
Where genuinely confidential material is processed, keeping the system inside the building can be the more sensible option. It is a possible answer, not automatically the right one.
Nothing gets built before the numbers are on the table. The first step is short, deliberately bounded, and useful even if you stop there.
One to two weeks. Your workflows mapped, the real effort quantified, the data classes sorted, your systems examined for what they actually allow — ending in a prioritised list and a plan for the first thing worth doing. The report is yours to keep.
One use case taken to production against acceptance criteria agreed in advance, measured against the baseline from the check, and handed over with the training to run it.
Keeping it current and monitored once it is live, with a periodic review of whether it is still earning its place — and the training record the EU AI Act expects of anyone whose staff use AI.
Scope, timing and a fixed price are agreed in writing before any work begins.
An honest filter costs both of us less than a wasted first meeting.
No. Much of the useful work involves no client-identifying material at all. Where it does, the check establishes what is defensible before anything is set up, with professional secrecy as the frame rather than an afterthought.
It is designed to work beside them, not replace them. Which exports or interfaces are genuinely available is something the check verifies rather than assumes.
It applies in addition to data-protection duties, and a processing agreement does not substitute for it. Any external party involved has to be bound accordingly. That is a contract question we work through, not a technical one we design around.
The professional, exactly as with any preparatory work. Nothing is configured to send or file on its own; every draft waits for a human release.
From your own hours in the affected workflows, set against the expected effort of the solution. If a use case does not carry itself, that goes in the report.
Bring a rough sense of where the hours go — correspondence, document chasing, summarising, onboarding new staff. That is enough to say whether there is anything here worth building.
Request a callFree and without obligation · direct with the founder
