Frequently asked questions.

We do not publish list prices; prices are available on request, because they depend on the scope. Every step has a defined result and a fixed scope, and you decide again after each step. That already applies to both entry engagements, the BISA baseline assessment (Business Infrastructure & Security Assessment) and the BEIA enterprise assessment (Business Enterprise Infrastructure Assessment). You keep full control of the investment. In the initial call, we tell you openly which entry point fits and what level of investment is realistic for your plans.

The BISA (Business Infrastructure & Security Assessment) is the baseline assessment in two steps: first a current-state review and immediate actions, then the target state and roadmap. The BEIA (Business Enterprise Infrastructure Assessment) is the enterprise assessment in a single pass, culminating in a decision paper. The BISA fits when you want to get things in order first. The BEIA fits when a major decision is ahead. Results are expected after about four weeks in each case, for the BISA per step. Between the two BISA steps, your team implements the immediate actions.

With the on-site start. Step 1 of the BISA baseline assessment ends with the documented current state: risks, critical gaps, priorities, and immediate actions your team can take right away. The BEIA enterprise assessment ends with the Enterprise Assessment Book, culminating in the decision paper we present to your management team. We work from your real data and documents, not from a demo data set.

No. SIMO is designed precisely for companies that do not have a twenty-person data science team. We work with the team you already have and enable it to make decisions based on data.

Yes. Data protection is part of the architecture for us, not an add-on. We sell neither software nor operations. We assess independently whether an initiative should run on your own premises, in a European cloud such as Hetzner, OVH, IONOS, or T-Systems, or in a hybrid setup. For sovereignty-critical data, we do not recommend US hyperscalers. Legal basis (Art. 6 GDPR), automated decisions (Art. 22 GDPR), data processing agreements (Art. 28 GDPR), and data protection impact assessments (Art. 35 GDPR) are part of our standard approach.

As of October 2026 · not legal advice

We start from your decision, not from a system, and we earn our fees from advice, not from licenses or operations. An IT consultancy asks which system you need. We first ask which decision you need to be able to make and derive from that what technology it takes. Because we earn nothing on the technology, we can also tell you which technology you don’t need. We oversee delivery and stand behind the result, but we don’t sell you a platform. And we talk to the executive team about business impact, not to IT about interfaces.

We are model-agnostic: Claude, GPT, Mistral, Llama, and models run on premises. You choose, with no vendor lock-in. Which model fits depends on your requirements for data protection, performance, and cost.

There is no long-term lock-in: every step has a defined result and a fixed scope, and you decide again after each step. No three-year contracts, no hidden costs. If we do not deliver the agreed impact, you do not commission the next step.

Yes. Andreas O. Schwan, our Managing Partner for data architecture and technology, brings more than 20 years of experience at tier-one banks in Germany and abroad. We don’t disclose client names, for data protection and confidentiality reasons. The data problems are the same in a midsize company and in a corporate group; only the scale differs.

Yes. Data and contracts stay in the EU, and entirely on your own infrastructure if you want them there. We earn nothing from licenses, hardware, or operations, so we have no reason to move you into a US cloud whose provider is subject to the CLOUD Act. And the results of BISA, BEIA, and every later engagement belong to you, not to us. Your data and its results stay in your hands.

Since December 6, 2025, Section 38 BSIG has required the management bodies of essential and important entities to implement the cybersecurity risk-management measures required by law, to oversee their implementation, and to take part in regular training. The BSIG is the German BSI Act, which implements the EU NIS2 Directive; an estimated 29,500 entities in Germany are affected. Culpable breaches of these duties can give rise to liability claims under the applicable company law. SIMO helps companies analyze their organizational and technical starting position and prepare a sound basis for decisions and the evidence required.

As of October 2026 · not legal advice

Most likely, yes. The EU AI Act requires you to classify an AI system by its risk before it goes live, and the classification decides which obligations apply. We determine the classification for your specific initiative and build the evidence trail so the answer holds up when a regulator, internal audit, or the external auditor asks where a decision came from. What this means for your industry is set out in full on our EU AI Act page.

As of October 2026 · not legal advice

Yes, in an orderly and auditable way. Before anything is switched off, we define the scope, build a transition architecture, and reconcile at every handover so that nothing business-critical is lost. At the end there is an opening-balance statement and an auditable archive, so the retirement holds up even when internal audit or the external auditor asks. The most common trigger is a legacy platform whose dependencies nobody can account for anymore.

With the Decision Readiness Check: twelve questions, about 3 minutes. You see your Decision Readiness Score on a scale of 0 to 100 right away, along with the entry point that fits your initiative. Scoring is rule-based and runs in your browser; no AI is involved. Your answers leave your device only when you explicitly send the result.

45 minutes by video, free of charge and without obligation, with one of the two Managing Partners. We listen, we ask questions, and we give you an honest assessment of whether SIMO is the right fit for your decision. No pitch deck, no sales pressure. If it fits, we discuss the on-site start with the BISA baseline assessment or the BEIA enterprise assessment. If it doesn’t, we’ll say so.