Landkreis Rotenburg (Wümme)
Strong scope fit but not currently prime-ready. The corrected authoritative package makes every mandatory criterion exclusionary and requires, among other things, two public-sector KI/SaaS platform references of at least 100 users each, a documented privacy organisation, platform-scope C5 or an already contracted accredited audit plan, four model manufacturers, full EWR/Switzerland processing with ZDR, 500-concurrent-user operation, 99.5% availability, and a 20-test-case PoC submitted with the offer. Digital David's portfolio evidences the engineering competencies, but the company evidence pack does not prove those hard product and qualification gates. Only a partner-led route with a mature platform is defensible.
Single-supplier, 48-month EVB-IT framework for a centrally governed generative-AI SaaS platform: initially 500 Landkreis users, scalable to 2,500 users across separately isolated municipal tenants, with multi-model orchestration, cited RAG, document processing, multilingual translation/transcription, Office generation, strict EWR/Switzerland processing, ZDR, C5, 99.5% availability and a submitted self-assessment PoC.
The functional scope is unusually close to Digital David's demonstrated AI, RAG, document, multilingual, governance and integration competencies. Qualification and product-readiness gaps dominate: no approved evidence of two qualifying public-sector platform references, no complete incumbent product matching all 55 mandatory criteria, and no evidence for the DPO, C5/audit-plan, SLA, data-residency, ZDR and sustainability gates.
Digital David has demonstrated core competencies in cited RAG, document intelligence, multilingual and voice AI, secure cloud delivery, regulated workflows and public-administration AI architecture. The evidence pack does not establish an existing tender-ready multi-model SaaS platform satisfying the full mandatory stack, two qualifying 100-user public-sector references, a documented DPO/privacy organisation, or a platform-scope C5 attestation or contracted audit plan.
Portfolio evidence
Decision gates
Company evidence verifies turnover for 2024 and 2025 and a preliminary 2026 year-to-date BWA, while the notice sets no numeric turnover floor. The 2023 year, final audited statements, balance-sheet/liquidity evidence and insurance-based risk cover are missing, so the flexible economic-capacity gate cannot be treated as conclusively met.
Two KI- or SaaS-platform projects for public buyers in the last five years are mandatory, each with at least 100 users and similar generation, research and rights functionality. The portfolio shows relevant public-administration architecture and platform work, but the qualification pack contains no approved formal references, scale proof or disclosure permission.
A named operational data-protection officer with contact data and a documented GDPR privacy organisation is mandatory. The company evidence pack contains no such source evidence.
Digital David has demonstrated engineering across RAG, document intelligence, voice/multilingual AI, governed workflows, multi-tenant cloud and public-administration AI architecture. Evidence does not establish one existing offered product meeting every exclusionary mandatory criterion, including 500 concurrent users, two-second TTFT, all required formats/languages, four model manufacturers, Office/ODF generation, 2FA app plus SMS and the full administration surface.
The offered platform, all external models and every backup/log/monitoring/support/OCR path must remain in the EWR or Switzerland, with signed processor terms, a complete subprocessor list, no training and ZDR for every external-model input/output. No platform-specific provider contracts, data-flow evidence or ZDR configuration is in the evidence pack.
A valid C5 attestation covering the application layer, or a demonstrably contracted audit plan with an accredited auditor completing within one year, is required at bid time. Company certifications are unknown; ISO 27001 or a non-binding future promise would not satisfy D10.
The portfolio evidences regulated AI, human-review and governance competency. It does not prove tender-specific AI Act classification, conformity information for every model/platform component, Article 9 processing controls or the required supporting documentation.
The offer must prove 99.5% availability, 500 concurrent users, no more than two-second TTFT under normal load, prescribed maintenance notice, 8x5 ticket and telephone support, incident response targets and 24/72-hour/7-day reporting. No product-specific performance tests, SLA history or support capacity evidence is provided.
German is Digital David's confirmed primary working language, satisfying the offer-language capability. The evidence pack does not contain complete German technical, administrator, end-user and training documentation for an offered platform.
Target Research OS/BionResearchMarket, Kuebiko and document-workflow products evidence knowledge, cited RAG, controlled processing and document capabilities. They are not evidence that one tendered product meets every W1/W2/F6/F13, tenant-isolation and version-prioritisation requirement.
The bid must disclose model training and inference carbon/energy data, prove at least 50% renewable energy or qualifying certification at each data centre, and state PUE per site. The company evidence pack contains no such platform/provider evidence.
The bid requires the standard suitability declaration or EEE, NTVergG section 4 declaration and Russia-sanctions declaration. No signed procedure-specific declarations were reviewed; missing evidence is not treated as a negative fact.
The bidder must execute every supplied test case one-shot, without prompt optimisation or manual editing, using the exact offered platform/model configuration and provide screenshots, timestamps, model metadata and structured results. The buyer may demand a live test tenant and repeat tests; no completed compliant PoC exists in the evidence pack.
Award and production start depend on a DPIA establishing lawful processing with the Landkreis DPO. This requires buyer/vendor cooperation and platform-specific evidence; it is not yet demonstrated.
Official clarifications · selected by AI relevance
The original form was wrong. E2 controls: at least two comparable references, each with at least 100 users. Two completed reference fields are sufficient; the corrected form replaces the earlier version.
This is a hard exclusion gate. The qualification pack contains no approved formal public-sector references proving operation of comparable KI/SaaS platforms for at least 100 users, so status remains unknown and a reference-bearing partner is the central bid dependency.
A German cloud can be valid, but location alone is insufficient. The offer must also establish GDPR compliance and an Article 28 processing agreement, no training with buyer data, ZDR, BSI C5 and EU AI Act compliance.
Generic secure-cloud capability is not enough. A platform-specific evidence chain and supplier/model-provider contracts are required and are absent from the company evidence pack.
The binding region is the EWR or Switzerland. The rule applies to the platform and external models and, because no narrower exception is stated, to every processing activity including backups, logs, monitoring, support access and OCR.
Every subcontractor and operational data path must be mapped and contractually confined to the permitted region. No tender-specific architecture or provider evidence currently proves this.
No. D7 requires all inputs and outputs sent to external model providers to be processed only transiently and not stored. This applies equally to chat, uploads, OCR content and RAG context. Pseudonymisation may be an additional TOM but is not an alternative to ZDR.
The offered model endpoints must provide genuine ZDR for every channel. The portfolio shows relevant engineering but does not prove compliant provider configurations or contracts.
Each municipality signs its own EVB-IT Cloud contract and must operate as a separate tenant with strict logical and technical data isolation. A user belongs to exactly one organisation; multi-tenant membership with different roles is not envisaged.
This materially fixes tenancy and identity architecture. Digital David has multi-tenant and role-based delivery evidence, but no existing product is evidenced as satisfying this exact isolated-contract model at the required scale.
Yes; model agnosticism is expressly required. The platform must orchestrate models from at least four manufacturers, which may be served through one or two EWR-compliant inference services. ZDR may be evidenced through technical API configuration, contractual no-training/no-retention terms and documented data flows; PoC proof uses screenshots and optional logs/share links, with architecture and contracts for specific controls.
Digital David's architecture competency is relevant, but the tender requires an operational multi-model product and a complete evidence package rather than a build plan.
At bid time, either a valid platform-scope C5 attestation or a demonstrably agreed audit plan with an accredited auditor, scheduled to complete within one year after contract start, is required. A cloud-infrastructure attestation is insufficient unless the bidder's application layer is explicitly in scope; ISO 27001 is not an alternative.
The evidence pack has no certification or contracted audit plan. A mere future promise would cause exclusion, so this must be solved by a qualified platform partner or an already executed auditor engagement before submission.
No. The price sheet defines a per-user flat fee and permits no unilateral quotas or usage contingents. The buyer gives no expected monthly use per user.
This creates a major unbounded inference-cost risk over fixed 48-month prices. Pricing needs conservative usage modelling and contractual control of model-provider cost, which is hard for a new platform build.
The package was corrected. PoC is 25% of the total score. Within the current Anlage P, text generation, long-document summarisation and legal-text handling are 20% each; translation/transcription, RAG, usability/administration and privacy/security are 10% each.
The PoC is decision-critical and must be run as a one-shot self-assessment with the offered production configuration. Digital David has matching competencies, but a mature platform and substantial bid-production effort are required before 4 September.
Manufacturer-sourced results are acceptable if the bidder identifies model, manufacturer, benchmark and version, result, date, test-method summary and a directly verifiable official source. Own reruns are not required. For each of the two selected models, at least one result per benchmark category is required.
This reduces evaluation effort but still requires two eligible models from different manufacturers and a rigorous, source-verifiable model documentation pack.
Interpreted scope
Bid package
Commercial reading
Evidence trail
Authoritative Deutsche eVergabe public bidder-Q&A catalogue available and checked 2026-08-16T20:36:33Z. Six public messages were present, latest sent 12 August 2026 15:55 CEST; their corrections are incorporated in the Korrektur 3 package.
Package reviewed 16 Aug 2026, 22:36
Research files