Determines which security obligations apply even below the KRITIS threshold.
Developed in Germany · Hosted in the EU or on-premises
Delivered together with
Sovereign hosting in Germany, single-tenant from the first user.
Legal, tax and compliance expertise for legally sound deployment.
Advisory and implementation for the public sector, starting with the AI readiness assessment.
First, the organisation works out whether it is in scope and in which category. Then the same check is repeated for every service provider with system access, because requirements pass along the supply chain. Each answer is researched separately, recorded in a note and hunted down again for the next contract.
Nine service providers go through the same framework and stay documented, which cuts the 40 hours of review a year by 50%.
The 50% is this agent's headline figure. Nine service providers and four hours per check describe a typical organisation below the threshold; this was not measured.
The agent checks sector, size and services provided against the classification criteria. It names each missing detail the classification needs.
Classification sheet, 7 of 8 criteria evidenced, headcount openThe agent takes the service providers with system access from the supplier register and checks them against the same framework. Where a contract lacks a security annex, it flags the contract.
9 service providers checked, security annex missing from 2 contractsThe agent lists the obligations that follow from the classification, each with a reference. Information security makes the determination itself.
pflichtenliste_haus_2026.pdf, 14 obligations, one reference per obligationIt gathers criteria and references and shows what is still missing. Information security makes the determination together with IT management.
It shows where in the contract a security annex is missing. IT management and information security decide whether to renegotiate.
Access that was set up once for a project and never recorded does not appear in its view. It only becomes visible once it is entered.
Connected systems
Operations
A pilot typically runs on your own data within 4 to 6 weeks. The agent connects to your existing systems rather than running as a separate, parallel environment.
EU cloud, private cloud or on-premises. Processing is GDPR-compliant and models are never trained on your data. Details in the Trust Center.
It is based on experience from comparable projects and process benchmarks, not a commitment. We work out the realistic effect for your organisation during the assessment before the pilot.