Answer

Do I Have to Tell Clients That I Use AI?

By Saba Khalvashi, Co-Founder & CEO

Published · Updated · Legal status October 2026

The question sounds simple, but it mixes four legally separate topics: disclosure as a professional duty, consent to a recording, the privacy notice, and the transparency rules of the EU AI Act. This article separates them, using the FAQ of the Federal Chamber of Tax Advisors (Bundessteuerberaterkammer, BStBK) of 27 October 2026 and the statutes.

Is there a professional duty to disclose?

Not expressly, at present. The BStBK states that there is currently no express professional duty to tell clients that AI was used on their matter. In principle the professional decides. Tax advisors must, however, keep clients informed about all material aspects of the engagement, and according to the FAQ whether AI counts as one is still under debate within the profession.

The chamber sums up the position like this: "es muss nicht ungefragt offengelegt werden, aber Offenheit schafft Vertrauen", meaning it need not be disclosed unprompted, but openness builds trust. Where client data is involved or AI influenced the work product, it calls informing clients fair and advisable, at least on request.

For lawyers, the Federal Bar (Bundesrechtsanwaltskammer, BRAK) reached the same result as of December 2024 and recommends a contractual clause if in doubt. Both chambers point out that transparency duties can arise from other areas of law, such as contract law or unfair competition law (UWG).

This answer concerns professional law only. The following sections can still create a duty.

What applies if a conversation is recorded?

Then everyone involved must consent in advance. § 201 of the Criminal Code (StGB) makes it an offence to record the non-public spoken word without authorisation, and according to the BStBK consent after the fact is not enough. This applies to every person in the conversation, including third parties who are not the client.

This consent relates to the recording. It replaces neither the privacy notice nor the contract with the vendor. In practice, though, it already answers the original question: anyone who wants to record has to raise it and should say that an AI tool will process the conversation. If the firm bases the processing on consent under data protection law, which the BStBK names as the usual case for dictation AI, Art. 4(11) GDPR requires that consent to be informed. The details are in the article May an AI tool transcribe client meetings?.

What does the GDPR require?

If personal data flows to an AI service, information is required. The BStBK advises explaining in the firm's privacy notice that AI tools are used and which categories of data are processed.

The basis is Art. 13 GDPR. At the time of collection it requires, among other things, details of purposes, legal basis, recipients or categories of recipients, transfers to third countries, storage period and data subject rights. A processor can be a recipient too, because Art. 4(9) GDPR does not depend on whether the body is a third party. The duty does not apply where the person already has the information (Art. 13(4)).

For people who are only talked about in a conversation, Art. 14 GDPR applies. Its paragraph 5(d) contains an exception for data subject to professional secrecy, and § 29(1) of the Federal Data Protection Act (BDSG) adds to it.

For the content of the notice, the firm depends on the vendor. According to the guidance of the German data protection authorities (Datenschutzkonferenz), it must make sure the vendor provides sufficient information (para. 21).

Does the AI Act require a notice to clients?

Only in specific cases. Under Art. 113, Art. 50 of the AI Act has applied since 2 August 2026, and it names individual situations.

AI systems for direct interaction with people, such as chatbots, must be designed so that people learn they are interacting with AI. The wording of paragraph 1 is addressed to providers. The BStBK concludes from it that firms using chatbots must also make sure this information is given. Deployers of an emotion recognition or biometric categorisation system must inform those affected under paragraph 3. Paragraph 4 requires disclosure for deep fakes and for AI text published to inform the public on matters of public interest. For such text the duty falls away after human review or editorial control, if someone holds editorial responsibility.

According to the BStBK, internal drafts and meeting notes generally need no label. Art. 50 contains no general duty to tell clients about AI in everyday casework. Other transparency duties remain unaffected under paragraph 6.

When is information not enough?

When the service directly serves a single engagement. Under § 62a(5) of the Tax Advisory Act (StBerG) the vendor may then only gain access if the client has consented. According to the BStBK this does not apply to the firm's general working tools. Whether AI used on a single engagement is covered cannot, in the chamber's words, be answered without doubt. For sensitive client data it advises obtaining consent in advance, or anonymising or pseudonymising. The contract with the vendor is a separate matter: Confidentiality agreement under § 62a StBerG.

Which rule applies in which situation?

What counts is what happens to which data.

SituationWhat the firm doesBasisTiming
Conversation is recordedObtains consent from everyone involved§ 201 StGBBefore recording
Personal data flows to an AI serviceInforms those affected, for example in the privacy noticeArt. 13 GDPRAt collection
Service directly serves a single engagementObtains the client's consent§ 62a(5) StBerGBefore the vendor gains access
Chatbot communicates with clientsPoints out that it is AIArt. 50(1) AI Act, BStBK FAQAt the first interaction at the latest
AI text is published on matters of public interestDiscloses it, unless there is editorial control and responsibilityArt. 50(4) AI ActAt first contact with the text at the latest
Internal AI draft without client dataNo duty, openness remains voluntaryBStBK FAQNone

How do I raise the subject?

The simplest way is once in general and then case by case. As an example, the BStBK names a note in the engagement agreement, or when new technology is introduced, that AI software serves as a tool and final review stays personal. Some professionals cover this in the client contract. The chamber deliberately gives no general recommendation, because clients react differently.

For recordings, this does not replace asking before the conversation. That matters especially for tools without a meeting bot: with TaxMeet (Next Intelligence GmbH, Berlin) no bot joins the call and capture runs per participant on the device. The client therefore sees no additional participant, and the firm still has to ask expressly.

The overall framework is described in the guide AI in German tax firms, and the chamber's statements are summarised in The FAQ in 12 points.

Common questions.

Do I have to tell clients about AI without being asked?

Under professional law the BStBK sees no express duty at present. Data protection law does require information once personal client data flows to an AI service. Recording a conversation always needs prior consent from everyone involved.

Is a line in the privacy notice enough for a recording?

No. The privacy notice meets the information duty under Art. 13 GDPR. A recording also needs prior consent from everyone involved under § 201 StGB.

May someone refuse the recording?

Yes. Without consent from everyone involved, no recording may be made. The conversation then takes place without one.

Do AI drafts of client letters need a label?

Art. 50(4) of the AI Act concerns text published to inform the public on matters of public interest. It does not mention a letter to an individual client. The BStBK considers openness advisable where AI influenced the work product.

Sources

  1. Bundessteuerberaterkammer: FAQ: KI im steuerberatenden Berufsstand (as of 27 October 2026, in German), accessed 30 October 2026
  2. Gesetze im Internet: § 201 StGB, violation of the confidentiality of the spoken word (in German), accessed 30 October 2026
  3. Gesetze im Internet: § 62a StBerG, use of service providers (in German), accessed 30 October 2026
  4. EUR-Lex: Regulation (EU) 2016/679 (GDPR), Official Journal text, accessed 30 October 2026
  5. Gesetze im Internet: § 29 BDSG, data subject rights where secrecy obligations apply (in German), accessed 30 October 2026
  6. European Commission, AI Act Service Desk: AI Act, Art. 50 transparency obligations (consolidated version of 27 July 2026), accessed 30 October 2026
  7. European Commission, AI Act Service Desk: AI Act, Art. 113 entry into force and application (consolidated version of 27 July 2026), accessed 30 October 2026
  8. Datenschutzkonferenz: Orientierungshilfe Künstliche Intelligenz und Datenschutz, version 1.0, 6 May 2024 (in German), accessed 30 October 2026
  9. Bundesrechtsanwaltskammer: Hinweise zum Einsatz von künstlicher Intelligenz (KI), December 2024 (in German), accessed 30 October 2026

This article is for information only and is not legal or tax advice.

See TaxMeet on a sample conversation.

See in 30 minutes how a confidential client meeting becomes finished work.