ConceptThis system does not exist as a finished product. It is a design we build for your consultancy — shaped to your methodology, your frameworks and your mandates.
Book a callThe loop
Winning and delivering run on the same knowledge base
An engagement runs as a loop: win it, deliver it, and feed the result into the next bid. Every finished project makes the next one cheaper.
Stage 1
Win work
- W1
Find tenders
Daily from Germany's national procurement data service and TED, filtered by CPV codes and keywords, ranked by fit.
- W2
Bid / no-bid
Extract deadlines, eligibility and award criteria, check them against your credentials and references, write a one-page go/no-go memo.
- W3
Bidder questions
Find unclear or contradictory requirements and draft neutrally worded questions.
- W4
Prepare the bid
Compliance matrix, matching references and CVs, concept text from your text library, a formal check. Submission stays manual.
- W5–W6
Learn and direct requests
Record outcomes and the reasons for losses; turn intake call notes into an offer draft.
Stage 2
Deliver
- D1
Kickoff and client portal
Create the engagement from the bid data, generate the document request list and interview plan, open the client space.
- D2
Gap assessment
Read client documents, map them to controls, propose a rating with a reason and source passage, flag contradictions.
- D3–D4
Documents and audit prep
Policies, concepts and BIA from templates and client facts; evidence checked for completeness and age.
- D5
Measure tracking
Every gap becomes a measure with an owner, a due date and an acceptance criterion — with reminders in the portal.
- D6–D9
Service, regulation, reporting, close
ISB/DPO inbox with reporting deadlines, regulatory watch, monthly report, an anonymised reference at project close.
Shared knowledge base
- Controls and mappings
- Certificates and qualifications
- References
- Text library
- Effort data
Project close: actual effort and an anonymised reference flow into the next qualification.
Principles
AI prepares. Your consultants decide.
Every approval has a name
Gap rating, document, bid, client message: nothing leaves the system without a named person, and the system records who decided.
One control, many frameworks
ISO 27001, BSI IT-Grundschutz, NIS-2, DORA, TISAX and BCM in one control library, mapped to each other with a strength per mapping.
Evidence first
Every finding links to the client document and the page it rests on.
Client data stays separated
Each client has its own space with its own key. Retrieval never crosses clients.
Data and models
The model follows the data class, not the task
Public tender documents can go to the strongest model. Your clients' security documents stay with EU-hosted models or on your own server. We set up operations with EU providers under your contract.
| Data class | Examples | Processing |
|---|---|---|
| Public | Tender documents, laws, BSI publications | Approved models in an EU region |
| Internal | Bid drafts, prices, CVs, references | EU region, data processing agreement, no training on your data |
| Client confidential | Policies, network plans, risk analyses, interview notes | EU-hosted open-weight models or your own server |
| Classified | Documents marked VS-NfD or higher | No AI processing — the marking is detected on upload |
A worked example
A district tenders an ISMS
A fictional consultancy, a fictional buyer, synthetic client data — so you can see what the system does at each step and where your consultants decide.
- Consultancy
- Muster Sicherheitsberatung GmbH, 14 consultants, ISO 27001 and ISO 9001 certified
- Buyer
- Landkreis Musterland, a district administration
- Scope
- Framework agreement: ISMS build-up per BSI IT-Grundschutz and external ISB, 3 years
- Value
- EUR 260,000 net, EU-wide open procedure
- Award
- 60% quality of concept, 40% price
Example scenario — not a live project yet. An illustrative depiction of a typical implementation.
- 2 Nov
Found
The notice comes in through CPV 79417000 and the keywords "ISMS" and "Grundschutz" and ranks first on the daily shortlist.
- 3 Nov
Qualified
34 requirements extracted; both required references found (62 and 85 person-days), qualification and insurance valid. The managing director reads the memo and decides: go.
- 9 Nov
Clarified
The scope names ISO 27001 native, the award criteria name IT-Grundschutz. The system drafts a bidder question; the answer re-runs the qualification.
- 16 Nov – 4 Dec
Bid
The compliance matrix covers all 34 requirements; the concept is drafted from the text library. A consultant reviews it, the managing director sets the price and signs.
- Jan
Award and kickoff
The engagement is created from the bid data: a request list of 15 document types, an interview plan for 4 roles, a client space in the portal.
- Delivery
Assessment
12 documents uploaded, one marked VS-NfD — blocked from AI processing, the project lead is notified. 60 controls rated with source passages, 3 contradictions flagged; a consultant confirms every rating.
- Close
Back into the knowledge base
Actual effort against the estimate, and a draft anonymised reference for the next bid.
How we proceed
In phases, with an acceptance gate at the end of each
- Phase 0
Foundations
3 weeksData classes, hosting decision, DPA and NDA templates, control library structure, test data.
- Phase 1
MVP on the example case
3–4 monthsFind, qualify, clarify, bid, kickoff, gap assessment, two document templates. Gate: the demo meets every acceptance criterion.
- Phase 2
Pilot
3 monthsReal tenders and one real client engagement, at first in parallel with your usual process. Gate: your consultants confirm the time saved.
- Phase 3
Expand
3–6 monthsAudit prep, ISB/DPO service desk, regulatory watch, client reporting, more frameworks such as DORA and TISAX. Gate: every module in daily use across your firm.
- Phase 4
Grow it into a client product
as neededThe client portal in your own design, self-service onboarding for your clients, and optional operation on your own server.
Does this fit your consultancy? In an introductory call we work out which parts give your mandates the most leverage and where to start.
Book a call