Before your Austrian law firm uses an AI service with client data, collect concrete commitments about confidentiality, processing and contractual arrangements. The ÖRAK AI checklist brings these questions together. This guide explains how to collect documentation and record your provider assessment.
Download CASUS’s completed and signed ÖRAK AI checklist. PDF in German · 1 page · Updated 7 October 2026.
Collect the documentation for your assessment
Keep the signed checklist alongside contracts, data processing information, details of storage and processing locations, sub-processors, security measures and deletion arrangements. Record each document’s version or date and the questions it answers. CASUS provides its signed checklist, a security page and a Trust Center.
Step 1: Define the planned use
Describe the tasks, the data entered, the people involved and the outputs expected. A general legal research question and an analysis of a client document involve different inputs. This description provides the reference point for reviewing the provider’s documents.
Step 2: Obtain the provider’s commitments
The ÖRAK AI checklist covers ten requirements concerning professional confidentiality and data protection, storage and processing, and transparency and cooperation. Ask for a completed and signed confirmation. CASUS has completed and signed the checklist, and makes the confirmation available for your law firm’s provider assessment.
Read the ten requirements, including contractual arrangements, model training, deletion, data locations, sub-processors and notification obligations.
Step 3: Review the checklist together with the contracts
Match each topic to the relevant contract or security document. Record where the commitment appears, what the documentation explains and what remains unanswered for your use case. A table containing the topic, document, date, open question and responsible person can help.
The checklist addresses willingness to enter into an agreement under section 40(3) RL-BA and a data processing agreement under Article 28 GDPR. Review the contractual documents for your actual collaboration alongside those commitments.
Step 4: Resolve questions and record the decision
Clarify open questions with the provider before the approved workflow starts using client data. Keep the answers with your documents. Record the approved tasks, applicable rules and person responsible for approval.
Define how your team will verify statements, citations and drafting suggestions. Assessing the provider and checking AI outputs are both part of the firm’s working process.
Step 5: Keep the record current
Assign responsibility for reviewing provider updates. The checklist includes notification if its requirements are no longer met or are at risk. Keep such updates and resulting decisions in your assessment record. Review the approval when your use changes, including new data types, workflows or users.
Use the AI and data security guides together
The ÖRAK AI guide addresses AI use and contains the provider checklist. The ÖRAK data security guide complements it with a view of the firm’s IT environment. Use each document for its subject: the AI checklist for provider commitments and data security documentation for organisational and technical arrangements. Find the original material at the Austrian Bar.
Frequently asked questions
Where is CASUS’s signed ÖRAK AI checklist?
The CASUS checklist page provides the PDF and an overview of the ten requirements.
What other documentation should my firm review?
Collect the contractual and security documents for your planned use, including processing and storage, sub-processors, security measures and deletion.
How should I record the assessment?
Keep the planned use, dated documents, open questions, provider answers and the responsible approval together.
When should I revisit the assessment?
Review relevant provider changes and changes to your own use, and assign responsibility for evaluating them.
