ÖRAK AI checklist: completed and signed by CASUS

What CASUS confirms in the checklist

The checklist covers ten requirements across three areas: professional and data protection obligations, data storage and processing, and transparency and cooperation.

1. Professional confidentiality

   Preserving lawyers’ professional confidentiality through technical and organisational measures.

2. Agreement under section 40(3) RL-BA

   Willingness to enter into a compliant agreement under section 40(3) RL-BA.

3. Data processing agreement

   Willingness to enter into a data processing agreement under Article 28 GDPR.

4. No model training

   Data entered by the law firm is not used to train AI models.

5. Secure deletion

   Secure and final deletion of entered data when the collaboration ends.

6. Storage and processing locations

   Processing and storage on servers in the EU or a safe third country covered by a European Commission adequacy decision.

7. Sub-processors

   Sub-processors also meet the relevant checklist requirements.

8. Notification of searches

   Prompt notification of searches at the provider or its sub-processors. The checklist provides an exception for sub-processors that store data only briefly and non-permanently and process it fully automatically without human access.

9. Evidence of security measures

   Disclosure of technical and organisational data protection measures on request.

10. Notification of changes

    Immediate notification if a requirement is no longer met or is at risk of no longer being met.

Documentation for your law firm

Use the signed checklist alongside contractual and security documentation for your provider assessment. Find further information about data processing, sub-processors and security measures on our security page and in the CASUS Trust Center.

• CASUS security
• CASUS Trust Center

Questions about the ÖRAK AI checklist