CCapability-led route

Beschaffung eines Vertragsmanagement- und Aktensystems

Max-Delbrück-Centrum für Molekulare Medizin in der Helmholtz-Gemeinschaft

Deadline
04 Sept 2026, 14:00
Value
Contract value not published. Evaluated quantities are 60 mandatory licence-years for 20 full-access SaaS licences, 15 optional licence-years for five additional licences, one fixed-price implementation and five optional customising days.
Region
Berlin, Germany
Reviewed
16 Aug 2026
Portfolio verdict

Capability-led route

No-prime on current evidence. The scope is a strong functional match for Digital David's document, legal-case and cited-RAG competencies, but the procurement requires a production-ready contract/e-file SaaS and formal proof that is absent: two references including one highly comparable deployment, qualifying insurance, an ISMS and internal control system, C5-aligned operation and EU/EEA data-centre proof. A specialist subcontractor role behind a mature product vendor is the credible route.

Recommended actionDo not bid as prime on the current evidence. Pursue only as an AI/document-integration subcontractor or with a named mature contract/e-file SaaS vendor that can supply the product, two qualifying references, insurance, security/control attestations, EU/EEA hosting, accessibility and the 2026-12-31 migration commitment; submit a bidder question correcting the mismatched EVB-IT Cloud contract subject before pricing.

What the opportunity means

Three-year SaaS contract for 20 plus five optional power users, replacing the legal department's winra system, migrating about 6,000 files by 2026-12-31 and providing full contract lifecycle, e-file, records, low-code workflow, e-signature, cited RAG/AI contract analysis, EU/EEA hosting, security, maintenance and German support.

Portfolio thesis

Strong competency adjacency in legal case/document workflows, metadata, audit trails, cited RAG, extraction, integration and migration. Prime fit is weak because the tender is structured for a ready product and formal references, insurance, ISMS/internal-control evidence, C5 compliance, EU/EEA data-centre proof and complete functional conformity are not established in the qualification pack.

Qualification reality

Factify, holz-platform and Uroboros demonstrate adjacent case, document, evidence, audit and migration competencies, but the portfolio evidence does not establish a mature existing contract/e-file SaaS product satisfying the full mandatory feature, records, signature, hosting and certification package.

Portfolio evidence

Products and reusable delivery strengths

Products

Factifyholz-platformUroboros

Competencies

Legal case and document workflowsDocument intelligence and cited RAGAudit trails and governed evidenceData migration and structured extractionSecure SaaS and identity integrationWorkflow and systems integration

Decision gates

Eligibility and delivery gates

  • Company matchUnknown
    two comparable references
    MustRequired

    Two references from the last three years are mandatory. At least one must cover a comparable AI-supported electronic contract-management and file system at a public or comparably large private buyer. The company evidence pack contains no owner-approved formal references; portfolio descriptions cannot substitute them.

  • Company matchPartially met
    average annual turnover of EUR 75,000 net
    MustRequired

    The gate is the average across the last three completed financial years. Verified preliminary BWA turnover is EUR 754,500 for 2024 and EUR 874,992.76 for 2025, but 2023 is missing; the qualification profile therefore records the three-year gate as unknown_due_to_missing_2023.

  • Company matchUnknown
    business liability insurance
    MustRequired

    Mandatory limits are EUR 1 million per claim for personal/property damage with EUR 2 million annual aggregate, and EUR 500,000 per claim for financial loss with EUR 1 million annual aggregate. No policy evidence or limits are in the qualification pack.

  • Company matchUnknown
    ISMS, internal-control and C5 evidence
    MustRequired

    The package requires an established ISMS such as ISAE 3000 SOC 2 Type II, ISO/IEC 27001 or equivalent, a control system such as ISAE 3402 Type II or equivalent, and contract performance against BSI C5 baseline criteria. The qualification profile lists no certifications or attestations.

  • Company matchUnknown
    GDPR-compliant EU/EEA data-centre proof
    MustRequired

    The bidder must prove that all application operation and data storage stay in EU/EEA data centres and offer an Article 28 AVV. No tender-specific hosting provider, data-centre or subprocessor evidence is in the company pack.

  • Company matchPartially met
    complete functional product conformity
    MustRequired

    The bid must confirm every requirement in specification sections 4-6. Factify, holz-platform and Uroboros evidence document/case workflows, audit trails, AI extraction, cited RAG and migration patterns, but not a ready product covering the complete contract lifecycle, records management, eIDAS signatures, Office/offline/mobile functions and certified SaaS operation.

  • Company matchUnknown
    Microsoft 365-independent product
    MustRequired

    A knockout declaration confirms the solution works without Microsoft 365 and is not based on Microsoft 365 platform services. No proposed mature product is identified in the evidence pack, so this cannot be confirmed.

  • Company matchUnknown
    BITV 2.0 / EN 301 549 conformity
    MustRequired

    The SaaS UI must meet BITV 2.0 and EN 301 549 or provide equivalent evidence. The qualification pack contains no accessibility certification or product test.

  • Company matchUnknown
    available delivery personnel and technical means
    MustRequired

    The bidder must confirm adequate staff and technical means. The current evidence pack contains no admissible headcount, named-team availability or technical-capacity proof; those facts are not inferred.

  • Company matchMet
    legal form and register identity
    MustRequired

    Digital David AG, Amtsgericht Frankfurt am Main, HRB 121238 is confirmed in the supplier profile; an official current extract should be obtained if documentary proof is requested.

  • Company matchMet
    German-language delivery baseline
    DeliveryNot required

    German is the confirmed primary working language. This supports the German-offer and German-support requirements, although staffing the full support SLA remains a separate delivery question.

Interpreted scope

Delivery shape

  • Provide and operate an integrated, browser-based SaaS contract-management and electronic-file system for the MDC legal department with 20 full users and five optional users.
  • Cover the entire contract lifecycle: approved templates/text blocks, clause library, metadata-driven document creation, low-code/no-code review, approval and signing workflows, status tracking and internal/external participation.
  • Support advanced and qualified eIDAS signatures, including a stated integration route for the MDC's current D-Trust Sign-me service.
  • Provide deadline and renewal management, structured versioned storage, field-level permissions, audit-proof archiving and deletion, reports, dashboards, protected team rooms, common document formats, Office integration, offline sync and mobile access.
  • Provide complete version history/time-travel, audit trails, configurable BPM, records plans, retention periods and disposition rules.
  • Provide rights-trimmed semantic/NLP search, entity recognition, institution-specific terminology, cited conversational RAG, consolidated 360-degree views and knowledge-graph-style relationship views.
  • Provide AI contract review against configurable exclusion, knockout, clause and regulatory checklists; explain risks and deviations, cite source passages and generate amendments from the clause library.
  • Operate fully outside a Microsoft 365 platform dependency, within EU/EEA data centres, under GDPR and Berlin data-protection law, with Article 28 AVV, C5-aligned cloud controls, ISMS/internal-control proof, backup/restore, SLA, MFA, OIDC/SAML and granular roles.
  • Expose documented open APIs and integration/import/export formats; use the MDC on-premises SMTP service account with standard authentication and TLS.
  • Migrate approximately 6,000 winra files and all related content by 2026-12-31, coordinate with Wolters Kluwer, provide a test environment, prove complete/audit-proof transfer, configure initial permissions and train users.
  • Provide German support Monday-Friday 08:00-17:00, tickets, maintenance and security updates included in licence prices, and exit assistance with complete data export and deletion.

Bid package

Required submissions

  • Completed and priced schedule for mandatory and optional licence-years, fixed implementation and optional customising days
  • Detailed delivery concept covering every listed implementation, hosting, backup, security, architecture, integration, update, customer-access, risk and service subcriterion
  • Completed suitability questionnaire or permitted equivalent EEE/prequalification evidence
  • Two qualifying references from the last three years, including one comparable AI-supported contract/e-file deployment at a public or comparably large private buyer
  • Turnover for the last three completed financial years showing an average of at least EUR 75,000 net
  • Copy of qualifying business-liability insurance
  • ISMS proof such as ISAE 3000 SOC 2 Type II, ISO/IEC 27001 or equivalent, plus internal-control proof such as ISAE 3402 Type II or equivalent
  • Evidence that the data-centre location and all processing/storage are GDPR-compliant and in the EU/EEA
  • Confirmation of Microsoft 365-independent operation and complete conformity with specification sections 4-6
  • Signed offer letter and tariff-compliance undertaking
  • Subcontractor, consortium, exclusion and reliance declarations where applicable
  • Hosting, security, backup/restore, SLA, accessibility, integration, migration, training and support documentation required by the specification

Commercial reading

Contract and pricing terms

  • Mandatory evaluated quantity is 60 licence-years; optional evaluated quantity is 15 licence-years with no purchase obligation, plus one implementation price and five optional customising days paid only as used.
  • Licence prices include ongoing maintenance, development and security updates; critical security updates must be installed immediately without breaking customer customisation.
  • Prices are fixed for 12 months; after the first year either party may request one annual, non-retroactive adjustment using the Destatis producer-price index for IT services.
  • MDC payment terms are 14 days with 2% discount or 30 days net at the buyer's option after complete performance/acceptance and a compliant electronic invoice.
  • Delay penalty is 0.5% of the total contract price per completed week, capped at 5%, without excluding proof of higher loss.
  • The EVB-IT Cloud terms require C5 baseline compliance, documented ISO-aligned security and audit rights; light-negligence liability is generally tied to order value with stated annual-fee floors/caps.
  • At contract end the contractor must support transition and keep production running until successful handover if it cannot be completed by expiry, export all data in an accepted format, and has no lien over customer data.
  • After return, customer material and copies must be returned or securely destroyed, with written confirmation within six weeks.
  • The supplied EVB-IT Cloud contract contains a subject-matter mismatch ('risk management and data protection' SaaS), which should be formally corrected before contract acceptance or price reliance.

Evidence trail

Sources and bidder information

Authoritative Vergabekooperation Berlin message catalogue checked on 2026-08-16 at approximately 22:45 CEST and explicitly showed 'Keine Nachrichten vorhanden'. No public bidder Q&A catalogue entries existed. The bidding conditions recommend questions no later than six calendar days before the bid deadline, but state no exact portal cutoff timestamp.

Authoritative MDC publication notice ↗Official buyer, scope, quantities, term, deadline, hard eligibility gates and award criteria.Authoritative Vergabekooperation package and Q&A area ↗Official version 2 package and authoritative message area showing no public Q&A.IT-Ausschreibung discovery page ↗Aggregator used only to discover the authoritative MDC procedure.

Package reviewed 16 Aug 2026, 22:45

Research files

Documents used for this evaluation

PDFFragebogen zur Eignungsprüfung ↓Official suitability questionnaire used for financial, insurance, reference, ISMS, hosting and exclusion gates.PDFLeistungsverzeichnis und Leistungsbeschreibung ↓Official functional, AI, security, migration, support, price and award specification.PDFAllgemeine Bewerbungsbedingungen ↓Official communication, question timing, consortium, subcontracting and offer rules.PDFZusätzliche Vertragsbedingungen MDC ↓Official delay, acceptance, payment, liability, confidentiality and governing-law terms.PDFAuftragsverarbeitungsvereinbarung ↓Official Article 28 data-processing agreement used to assess privacy and subprocessor obligations.DOCXEVB-IT Cloud contract ↓Official contract template used for precedence, performance, payment, exit and the subject-matter inconsistency.DOCXEVB-IT Cloud AGB ↓Official cloud terms used for C5, security, audit, availability, exit, subcontracting, payment and liability obligations.PDFAufforderung zur Angebotsabgabe ↓Official invitation used for contact, dates, quantities, term, submissions and hard eligibility gates.