Keeps two supervisory regimes apart: two authorities, two registrations, two reporting logics.
Developed in Germany · Hosted in the EU or on-premises
Delivered together with
Sovereign hosting in Germany, single-tenant from the first user.
Legal, tax and compliance expertise for legally sound deployment.
Advisory and implementation for the public sector, starting with the AI readiness assessment.
The incident is logged as a ticket in IT service management and passed from there to the information security officer. She looks up which regime the affected system falls under, and looks for the matching registration number and the right reporting channel. At the next incident the same search starts from scratch, and again for the annual evidence.
The nurse call system in Building C is tied to one regime, one registration and one reporting channel; the second round of evidence gathering is no longer needed, and with it goes 50% of the evidence effort.
The 50% reduction in evidence effort is this agent's headline figure. Fourteen incidents a year, the search time per incident and the three days for the annual evidence describe the typical course of events in a hospital under both regimes; they are not measured values.
The agent reads the details of the affected system from the ticket and assigns it to the applicable supervisory regime. Where the assignment is not clear-cut, it records it as open.
Assignment for incident INC-2026-0781, system nurse call Building C, one regime openThe agent checks whether a registration is on file for this regime and when it was last confirmed. It names the competent authority and the reporting channel with a reference.
Registration overview with 2 entries, one unchanged for 14 monthsThe agent fills in the draft for the applicable reporting channel with the details from the ticket and flags every mandatory field that is still empty. The information security officer signs and sends.
meldung_INC-2026-0781_entwurf.pdf, 9 mandatory fields completed, 2 openIt presents the draft with an evidenced reporting channel. Signing and sending rest with the information security officer.
It shows which details for the classification are available and which are missing. IT management is responsible for the classification together with information security.
Anything discussed on shift but never recorded appears on neither of the two deadline clocks. The incident only becomes visible once it is logged.
Connected systems
Operations
A pilot typically runs on your own data within 4 to 6 weeks. The agent connects to your existing systems rather than running as a separate, parallel environment.
EU cloud, private cloud or on-premises. Processing is GDPR-compliant and models are never trained on your data. Details in the Trust Center.
It is based on experience from comparable projects and process benchmarks, not a commitment. We work out the realistic effect for your organisation during the assessment before the pilot.