AI Readiness Check
Two to three weeks to know exactly where AI is used in your organisation, what it touches, and which duties already apply.
advisory · agentic ai & knowledge systems · vienna, at
Agentic AI and knowledge systems engineering is the lead. The environments where the work is real — regulated, standards-driven, public-sector — are the anchor. EU compliance is what makes the claim admissible here: dated, sourced, and written to be handed to a supervisor.
AI, compliant and production-readyI make AI in organisations compliant and production-ready. Independent of vendors, EU-native from Vienna.
what an engagement is
An engagement here has three parts: one bounded scope agreed in writing, one artifact named before I start, and a handover so the result runs without me. That is the whole model — there is no second phase you discover later.
Four ways to work together — from a bounded examination to a standing role. Each ends in a written artifact you keep and own.
Two to three weeks to know exactly where AI is used in your organisation, what it touches, and which duties already apply.
A two-week technical second opinion on the agent, the LLM feature or the retrieval system you already run — or on the proposal you are about to sign.
One workflow, four to six weeks, and it is running — with an eval suite, a run-book, and your team trained to own it.
Phased work that ends in a decision you can defend — the roadmap, the target architecture, the governance design, or, for a public body, the FRIA dossier.
The training your staff need — and the record an auditor asks for: who was trained in what, when, with which materials.
Almost every organisation now uses AI somewhere. Very few can show what it changed. The distance between those two sentences is the whole job — and since February 2025 the AI Act makes part of closing it a duty rather than a good intention. The deadlines that carry money are already dated.
of organisations already use AI in at least one function
McKinsey State of AI 2026
report a measurable effect on earnings — unchanged year over year
McKinsey State of AI 2026
of enterprise GenAI pilots show no measurable P&L impact
MIT Project NANDA
of agentic-AI projects get cancelled by end-2027 — cost, unclear value, missing risk controls
Gartner, June 2025
maximum AI-Act penalties for prohibited practices — above GDPR's €20M / 4%
Reg (EU) 2024/1689, Art. 99
deployer duties and the FRIA fall due for Annex III systems — evidence takes 12–18 months
Omnibus Reg (EU) 2026/1744
how i work
“With ease” is not a slogan here — it is four mechanical commitments, each one checkable before you commit to anything.
one workflow (03), one system per review (02), one artifact per phase (04). The scope is written down, and it does not grow quietly.
the number is agreed at the scope call. No day rate without a ceiling, no open meter.
the first week of a sprint ends in a decision memo. Stopping there costs nothing, and you keep the memo.
everything is written to be used without me in the room. Documentation, evals and a run-book are part of the deliverable, not an extra.
I am vendor-independent: no commissions, no licence resale, and I am not paid by anyone whose product I assess.
Not a software shop, not a body shop, not a legal practice, not a vendor channel. Regulatory statements here are dated and sourced; this page describes services, not legal advice.
Eleven topics, each framed as a decision, with the figures and their sources in place.
open →03Three bounded formats and one standing role — what each covers, how long it runs, what you keep.
open →04Published tools you can open and run, and the builds that collapse the time they take.
open →05Five questions to place your organisation honestly, then request information or the 60-minute call.
open →the five formats
Five formats, in the order they are usually bought. Card links open the format page; every card also has an anchor, so a link into it keeps working.
2–3 weeks, fixed scope
Two to three weeks to know exactly where AI is used in your organisation, what it touches, and which duties already apply.
You receive: a scorecard report — the AI inventory including the tools your staff signed up for themselves, a risk class per use, the data-protection triggers, and an action list ranked by exposure: keep, scale, kill.
public administration15 working days, fixed price, written German deliverable, worded so it can go into a direct-award justification.
2–3 weeks, fixed price, one system per review
A two-week technical second opinion on the agent, the LLM feature or the retrieval system you already run — or on the proposal you are about to sign.
You receive: a written decision memo — an architecture decision record, an eval-rig specification, and a remediation list ranked by severity, where every finding names the cheapest test that proves it. Plus a 90-minute walk-through with your team.
public administrationthe technical annex to your procurement decision, in German.
4–6 weeks, fixed price per artifact, one workflow
One workflow, four to six weeks, and it is running — with an eval suite, a run-book, and your team trained to own it.
You receive: the working system, its eval suite, a run-book, a handover session for your team, and — with your approval — a short public build log with the measured number.
public administrationa bounded unit description at fixed price, with the documentation the supervisory file expects.
phases of 4–8 weeks, fixed price per phase, ends in a plan plus one pilot
Phased work that ends in a decision you can defend — the roadmap, the target architecture, the governance design, or, for a public body, the FRIA dossier.
You receive: one fixed artifact per phase — the roadmap (use cases with effort, value and a twelve-month sequence), the target architecture (a diagram plus a decision record, bounded to interfaces and the local-versus-cloud posture), or the governance design (an AI register, an acceptable-use policy, a risk classification, a named owner, and a lightweight management layer aligned to ISO/IEC 42001 — a voluntary standard, not a legal requirement). Public-sector variant: the FRIA dossier.
standing-role tierFractional AI Lead — fixed monthly days, documented architecture and governance decisions, owns the eval bar, reviews vendor claims, no commissions. Six-month minimum, quarterly review, defined days per cycle, written exit terms.
public administrationthe FRIA dossier (the seven elements of Art. 27, the data-protection bridge, notification preparation) plus the deployer procedures — supervisory-ready documentation, written in German.
role-tiered — all-staff awareness (90 minutes), department practitioners (half a day), leadership briefing. Open cohorts or in-house.
The training your staff need — and the record an auditor asks for: who was trained in what, when, with which materials.
You receive: the evidence package — a role-specific curriculum, participation records, and a policy snippet naming who was trained in what. The teaching is the smaller half; the documented coverage is the deliverable.
public administrationaligned to the administration's own AI guidance, with participation records over certificates-for-CVs.
This page describes services, not legal advice; regulatory statements reflect the law as of late 2026, with sources on request.
who it is for
The formats do not change with the organisation. The language, the size of the artifact and the first purchase do.
Weeks, not quarters: one workflow defined on Monday, running and evaluated before the next board meeting — and your engineers own the code from day one.
first purchase · 02 · Agentic Systems Review, or 03 · Agentic Build Sprint
No AI department needed: I start with what your team already does by hand, one process at a time, and everything you get back is in plain language and stays yours.
first purchase · 01 · AI Readiness Check
It fits the process you already have: fixed-price phases, decision records your architects can file, governance artifacts your auditors accept — and nothing that requires you to adopt my stack.
first purchase · 02 · Agentic Systems Review, or 04 · Strategy & Governance
No jargon and no new tools to learn: I begin with the work your team already does, in your language, and the result is a document you can hand to a board or a supervisor.
first purchase · 05 · AI Literacy Programme (Art. 4), or 01 · AI Readiness Check
Same five formats, procurement-shaped: fixed, describable units, written German deliverables, dated duties, and an on-premise option that is a first-class answer rather than a footnote. I work with the supervisory authority, not against it.
the public-administration block →Any organisation using AI now has a position to show — to the board, to an audit, to a supervisory body. I turn scattered AI usage into an inventory, a risk classification and a working governance structure, then build the first real use case on top of it.
A documented inventory of AI in your organisation — including the shadow AI your staff already use — with a risk class per use.
AI literacy is mandatory since February 2025 (Art. 4) and GDPR has applied to AI processing all along; deployer duties and the fundamental-rights impact assessment (Art. 26/27) fall due on 2 December 2027. Each step is dated and documented, not advisory in the abstract.
Fixed prices, written deliverables, no licence resale, no vendor commissions — and documented comparison offers from €50,000 upward on request, where the three-offer rule of the 2026 procurement amendment applies.
Knowledge systems that run on infrastructure you control: local and open-weight models, retrieval over your own corpus, eval suites that prove quality to auditors rather than to a demo audience.
Strategy ends in an architecture decision and a first production-style use case with its own eval suite — not another deck.
the formats themselves are the same for everyone — go to the catalogue
public administration
Fixed, describable units with a written German deliverable; duties with their dates; and an on-premise option that is a first-class answer, not a footnote.
Direct award up to €140,000 for federal bodies and €216,000 for other contracting authorities; the three-offer principle applies from €50,000, and a documented comparison is supplied on request.
AI literacy since 2 February 2025 · transparency duties since 2 August 2026 · high-risk obligations (Annex III, including the fundamental-rights impact assessment) 2 December 2027 · Annex I 2 August 2028.
Documentation here is built to be handed over. I work with the supervisory authority, not against it.
proof
Nothing here is an adjective. Each line names an artifact you can open, count or date.
published tools, several running in the browser; this site is itself the work.
articles where each figure traces to a primary source.
reviewed tutorials and full courses, the raw material of the literacy offer.
the atlas below, with sourced provisions and their dates.
no commissions, no licence resale; I am not paid by anyone whose product I assess.
twenty years of structuring large, semi-structured data under standards-driven governance, then learning to build the systems that query it.
Published, open tools — not concepts. Everything here is installable or runs at kmail.at right now.
terminal AI coding agent
citeable EU-AI-Act terminal assistant — 180 recitals, 113 articles, grounded local RAG
author, version, validate ISO 19650 BIM execution plans
image→ASCII art, fully in the browser
Mermaid code → live graph render
the full llama.cpp toolbox as a desktop GUI, MLX on Apple silicon
browser-side hardware detection, 104 open-weight models scored
full registry: /tools · live tool: /omar · writing: /library
Two kinds of time saving exist, and mixing them is how AI projects end in disappointment. Assistance speeds a task you still perform — measured honestly, a quarter to a half of the invested time. Delegation hands a whole bounded task to a tool and collapses it — hours of an afternoon to minutes. That second regime is where “up to 90%” belongs, and the honest way to claim it is to build the tool and measure it. That is what these engagements do.
time on realistic consulting tasks with AI — and +40% graded quality
Dell'Acqua et al. 2023 · 758 consultants, RCT
invested time on professional writing tasks, quality up, not down
Noy & Zhang · Science 381 (2023) · n = 453
completion time on a real coding task with an AI pair programmer
Peng et al. 2023 · 95 developers, RCT
manual transcription cost per hour of audio, collapsed to machine minutes
industry transcription-time guidance (Rev)
The catalogue is deliberately exhaustive — every line below is a build pattern, not a software SKU: the artifact differs per organisation, the loop (Fig. J) does not. Bounded, versioned, owned, measured — each one ships with the number that says what it actually saved.
contracts, briefs, SOPs, policies, technical documentation — drafted from your templates and your corpus, reviewed by a human, version-controlled
slide decks generated from a written outline or a data pull — brand tokens applied, speaker notes included, regenerate on every source change
transcript → decisions, action items with owners, the formal minutes your governance requires — produced before everyone leaves the room
weekly ops reports, management summaries, monitoring narratives — assembled from live metrics, delivered on schedule, no compile-by-hand
structured extraction from sites and portals — price lists, tenders, registries — deduplicated, differential against the last run, delivered as data
multi-step processes across systems wired as n8n-class pipelines — trigger, transform, notify — with retries and an audit trail
ingest → clean → validate → load jobs that rerun forever; schema drift caught at the gate, not in the meeting after
the repetitive glue between humans and systems: routing, reminders, follow-ups, filing — quietly eating the 15-minute tasks
executive and team dashboards computed from your own operational data — refreshed automatically, one definition per metric, no numbers fought over
first drafts of recurring correspondence — status updates, invoices cover notes, tender replies — in your tone, from your facts
the harness that grades every other build: golden sets, regression runs, LLM-as-judge with a reviewable scorecard
PDFs, scans and forms → machine-readable structured data (Docling-class) — feeding the reports, dashboards and knowledge bases above
retrieval over your own corpus with citations to the source artifact — the answer names its evidence, or it does not ship
reviewed code generation for the boring half of the backlog: migrations, boilerplate, glue, tests — PRs, not vibes
rosters, resource plans, capacity scenarios — generated as draft decisions, decided by humans, recalculated in seconds when reality moves
log and alert triage reduced to what changed and who should care — noise collapsed before it reaches a phone
invoice extraction, matching, booking-prep and the forms around it — the paperwork layer of ERP, tamed
market, tender and competitor monitoring compiled from public sources into a written brief on a schedule — sources cited in place
The honest arithmetic: assistance buys a quarter to a half; delegation of a bounded task buys far more, and some tasks collapse almost entirely. Nobody honest promises 90% on every task — the engagement's first deliverable is the measured list of yours where it holds.
Client-identifying case studies are published only with written approval; the pattern cases above describe the engagement shape without client data.
the record
This is the background, not the pitch: what the law requires, when, and what is still moving. Every figure carries the source underneath it. Dates are re-verified before publication — the high-risk deadline has moved once already.
Advisory work lives or dies on specificity. This band is written like the assessments I deliver: every topic framed as a decision, every figure sourced in place, every engagement end stated before the first call. Where the rest of kmail.at is the editorial voice, this band is the evidence voice — deliberately sharper, because the people who read it are procurement, Audit, IT-Leitung and Datenschutz — the readers who check.
Regulation (EU) 2024/1689 applies to you if you place AI on the market or deploy it in the EU — regardless of where the provider sits. The duties are staged, and each stage has a date.
I classify your uses (Annex III screening), map deployer duties (Art. 26) and the FRIA (Art. 27) where they are due, and produce the evidence file: inventory, risk classes, literacy records. Where a named tool helps understand the law, it already exists — built by me, open source.
Article 4 puts an AI-literacy duty on providers and deployers: the staff who operate AI systems, and the people affected by them, must reach a sufficient level of understanding. It has applied since 2 February 2025 — and it is the one obligation that reaches every AI use, not only the high-risk ones.
I run the programme role by role — what a manager, a developer and a caseworker each actually need — and produce the artefact an audit asks for: who was trained in what, when, with which materials. The teaching is the smaller half; the documented coverage is the deliverable.
Every AI use that touches personal data runs in parallel through the GDPR: lawful basis, purpose limitation, DPIA where high risk, processor contracts, transfer rules. Non-compliance costs up to €20M or 4% of turnover.
I translate GDPR principles into deployer checklists that survive contact with reality: what to document per use case, when a DPIA is triggered, how AI-Act and GDPR duties overlap and where they differ — so one file answers both regimes.
Sovereignty is not one thing: model weights, inference compute, embeddings of your corpus, and the raw documents each live somewhere — and each location carries a different exposure.
I build the location map first, then the posture: what stays in-house, what leaves to a processor, what is masked before it leaves. The slider model below shows the decision logic I put in your governance file.
everything leaves: raw text, embeddings, context
fits: non-sensitive general work
Fig. F — the sovereignty ladder: five postures between cloud frontier and air gap; the engagement ends with your organisation placed on it.
Open-weight models (llama.cpp ecosystem, quantised, MLX on Apple silicon) now cover most assistant, retrieval and extraction workloads without sending a byte anywhere.
I size the workload to your hardware, pick the model class, and hand over a running stack you operate — with the eval suite that proves it answers well enough for your use, before anyone signs off.
The corpus you already own — files, wikis, archives, PDFs — becomes a queryable knowledge base: chunked, embedded, indexed for retrieval with citations back to the source.
Retrieval-first: I build the curation pipeline (what enters, how it is chunked, where it is indexed) and the citation layer. Every answer names its source, or the system does not ship.
Embeddings are how your content becomes machine-matched meaning: model choice, dimension, language coverage, update strategy and index re-builds silently bound retrieval quality.
Model selection against your language mix (German legal/administrative text behaves differently than English marketing pages), re-indexing policy, and the retrieval metrics that tell you the layer is healthy.
Most organisational knowledge is stuck in document form: PDFs, scans, forms. Modern document AI parses layout, tables, formulas and reading order into structured, model-ready text.
I run the real pipeline — Docling-class parsing into structured output, quality checks per batch, then the parsed corpus flows into the knowledge base. Sensitive documents are parsed on local hardware only.
this topic runs as stage 01–02 of the knowledge pipeline — see Fig. C under topic 05.
AI-assisted analysis turns the organisation’s own operational data into trend lines, segment statistics and anomaly flags — with the statistics kept honest (samples, uncertainty, what is not in the data).
Pipelines for recurring analysis: cleaning → feature building → model-assisted interpretation → a written result. The deliverable is the dashboard or report you rerun, not a one-off slide deck.
When strong models are cloud-only, the disciplined route is masking: names, identifiers and sensitive fields are removed or pseudonymised before a prompt leaves, and re-linked in-house on return.
I design the masking pipeline and its rules per data class — what is safely maskable, what must stay local — and wire it so the anonymisation step cannot be skipped under deadline pressure.
The production answer in most DACH organisations is not "cloud or local" — it is a routing layer: private data to local inference, general work to cloud models, with fallbacks and an audit trail of which request went where.
I design the routing policy (classification per data type), the fallback behaviour when either side degrades, and the observability that shows cost, latency and data-exposure per route. The flow below is the decision core.
All regulatory dates as of October 2026: Art. 4 literacy in force since 2 Feb 2025, Art. 50 transparency applied since 2 Aug 2026, Art. 26/27 (Annex III) due 2 Dec 2027 per Omnibus Regulation (EU) 2026/1744. Figures carry their sources in place; the underlying research files with primary links are kept and can be shared on request. This page describes advisory services, not legal advice.
Agentic systems designed around tools-in-a-loop, context engineering and memory — the difference between a demo and a system that runs unsupervised.
Eval suites and LLM-as-judge patterns that turn "it seems good" into a measurable, reviewable quality statement — my own tools grade themselves.
Retrieval over your own corpus: RAG, knowledge graphs and organizational memory — sovereign by design, on infrastructure you control.
Obligation mapping with dates and sources: risk classes, deployer duties (Art. 26), the FRIA (Art. 27), AI literacy (Art. 4) — reconciled with GDPR practice.
Written, procurement-compatible formats with fixed prices and documented deliverables — the form an administration and a company can both put through their own procurement.
Published, open-source tools — from a terminal EU-AI-Act assistant to a local-LLM toolbox — whenever a bounded artifact beats a slideware answer.
Behind it: a career spent at the seam of digital systems and the built world, 27 verified source-based articles, hands-on agent architecture and a published toolchain. The point is not the list — it's that every claim on this page traces to something you can open and read.
This page describes services, not legal advice.
where to start
Three steps, in the order they are useful. Only the third one asks for anything.
Five questions, two minutes, no email address. At the end you know which of your uses are already in a regulated class, and which duty attaches to each.
Five questions, two minutes, an honest reading of your organisation's AI position. Answering "we cannot say" more than once is itself a finding.
01Where does AI already touch your organisation?
Tools staff use on their own count too — shadow AI is the rule, not the exception.
02Can you state which of your AI uses fall under the EU AI Act — and at what risk class?
Prohibited, high-risk (Annex III), general-purpose, or out of scope.
03Have your staff received documented AI literacy training? (Art. 4 — in force since 2 February 2025.)
The Act sets no fixed curriculum, but the obligation and its documentation are live now.
04When an AI system errs or leaks data, what happens?
GDPR applies to AI processing of personal data; deployer duties under Art. 26 apply from 2 December 2027.
05Who owns AI governance in your organisation?
One named owner beats a committee without one.
Companies bring inventory questions; public bodies bring their duties. You leave with an assessment and a concrete next step — whether or not it is one of mine.
A 60-minute call is the right first move: say what you have and what you are required to meet, and you leave with an assessment of where you stand plus a concrete next step — whether or not it is one of mine.
Tell me what you have and what you need. Eight fields — organisation, your role, the format you are asking about, where you stand today — and the reply is written scope: what the engagement covers, who does what, how long it runs and what you hold at the end.
Answers are written by me, usually within a week — faster when a project is running. There is no autoresponder, no mailing list and no CRM behind this form, and the scope call is where an engagement is shaped: the page carries formats and artifacts, not figures.