Determines when an in-house AI system falls under the high-risk obligations.
Developed in Germany · Hosted in the EU or on-premises
Delivered together with
Sovereign hosting in Germany, single-tenant from the first user.
Legal, tax and compliance expertise for legally sound deployment.
Advisory and implementation for the public sector, starting with the AI readiness assessment.
The business unit submits a project with a description that only outlines the purpose in broad terms. Compliance and data protection read the same description, classify it independently and arrive at different lists of questions. Until the classification is settled, the project goes back and forth between the units several times.
Once the purpose is classified against the same grid and the list of obligations derived from it, review effort falls by 50%.
The 50% reduction in review effort is this agent's headline figure. Two sets of rules and three coordination rounds describe a typical path to classification; they are not a measured value.
The agent takes in the business unit's submission and breaks it down into purpose, affected persons and data types. It records anything that remains unclear as a question for the business unit.
Project sheet KI-2026-017, purpose in 4 sentences, 3 data types namedThe agent goes through the criteria one by one and notes for each which detail from the project supports it. Criteria without a supporting detail stay open.
Classification against 6 criteria, 2 of them open for lack of detailThe agent compiles the classification, the derived obligations and the open points in a paper. It goes to compliance and data protection for signature.
einordnung_KI-2026-017.docx, 11 derived obligations, 2 open pointsIt presents the classification and the obligations with references. Compliance and data protection sign off the approval.
It names the data types in the project and the questions that follow from them. The data protection officer is responsible for the assessment.
If the purpose stays vague, it records the affected criteria as open. IT governance puts the follow-up question to the business unit.
Connected systems
Operations
A pilot typically runs on your own data within 4 to 6 weeks. The agent connects to your existing systems rather than running as a separate, parallel environment.
EU cloud, private cloud or on-premises. Processing is GDPR-compliant and models are never trained on your data. Details in the Trust Center.
It is based on experience from comparable projects and process benchmarks, not a commitment. We work out the realistic effect for your organisation during the assessment before the pilot.