KI-Quadrat
Platform of five AI assistants for Austrian municipal administrations, covering citizen enquiries, grant discovery, building permits, internal knowledge and legal reference. It can run entirely on the municipality's own server and is ISO 27001 and ISO 42001 certified.
What is KI-Quadrat?
KI-Quadrat is a platform of AI assistants built for Austrian municipal administrations by KI-Quadrat Systemhaus GmbH, a company based in Gablitz, Lower Austria. It bundles five modules that share a single verified knowledge base. The Öffentlicher Assistent is a round-the-clock chatbot for citizens, answering on documents, forms, deadlines, opening hours, fees and responsible offices without requiring citizens to create an account. The Förder-Assistent searches more than five thousand federal, regional and EU funding programmes simultaneously and returns compliance-checked answers with source citations. The Bau-Assistent supports building permit work through document generation, completeness checks and verification against local building codes. The Interner Assistent searches internal documents, minutes and mailboxes department by department, which the vendor positions as a way of preserving knowledge when experienced staff retire. The Rechts-Assistent provides legal reference across laws, regulations and decrees, always with source references and with human review presented as mandatory. The technical design is what distinguishes the offer. It is a retrieval-augmented generation pipeline built on a Qdrant vector database with BGE-M3 embeddings, calling several language models through a LiteLLM gateway with automatic failover: Anthropic Claude on AWS Bedrock, Azure OpenAI and open-source models on Nebius, all in European regions. Before anything leaves the local system, a PII engine replaces personal details with tokens such as [PERSON_1] or [ADRESSE_1]; the answer is reassembled locally, so the model works with full context but never learns who is concerned. Three deployment models are offered: a fully hosted cloud tier in EU data centres, a hybrid tier keeping the vector database on the municipality's server, and a full on-premise tier delivered as a Docker stack of five components — API gateway, vector database, document parser, PII engine, and cache and history. The only outbound path is an encrypted tunnel, with no open ports. Existing sources such as network drives, email archives and the municipal website are ingested automatically, and Active Directory governs who sees what. The platform is certified to ISO/IEC 27001:2022 and ISO/IEC 42001:2023, and is distributed through Kommunalnet, the network used by more than 2,100 Austrian municipalities.
What it does
- Answer citizen questions around the clock on the municipality's website, using only verified municipal sources
- Search thousands of federal, regional and EU funding programmes at once and return compliance-checked results with citations
- Prepare building permit files, generate documents and check them for completeness against local building rules
- Retrieve internal knowledge from documents, minutes and mailboxes, respecting each officer's access rights
- Provide sourced legal reference across laws, regulations and decrees, with human review kept mandatory
- Mask personal data automatically before any content reaches a language model, then restore it locally
- Record every access and administrative change in audit logs available to IT, the DPO and external auditors
When to use KI-Quadrat / When not to
A quick filter to help you decide if KI-Quadrat is the right fit.
When to use KI-Quadrat
- Austrian municipal administrations that must keep citizen data inside their own building for legal or political reasons
- Town halls losing institutional knowledge to a wave of staff retirements, with procedures documented nowhere
- Citizen service desks overwhelmed by repetitive questions about forms, deadlines, opening hours and fees
- Municipal officers hunting for federal, regional and EU funding across thousands of grant programmes
- IT leads and data protection officers who need auditable evidence, named certificates and full log access before approving an AI tool
When not to use KI-Quadrat
- Buyers who need a published price list, since no rate is disclosed anywhere and every path runs through a sales conversation
- Anyone wanting to sign up and test the product alone, as there is no free plan and no self-service trial
- Developers looking for a public API or a mobile app, neither of which the vendor offers
- Organisations outside German-speaking public administration, the product being built around Austrian administrative law
- Small municipalities with no server and no available IT staff, if they want the on-premise option rather than the hosted one
How to use KI-Quadrat
A typical end-to-end flow, from setup to results.
- Request the free 30-minute demonstration offered on the site, run with real data and without commitment
- Let the vendor review your existing infrastructure, an assessment presented as free and non-binding
- Choose a deployment model: hosted cloud, hybrid, or full on-premise on your own server
- For on-premise, provide a server — around 32 GB RAM and 500 GB SSD, Linux or Windows Server, is given as the comfortable target
- Have the KI² stack installed as a single unit, with its gateway, vector database, parser, PII engine and cache
- Connect your existing sources: municipal website, PDFs, internal files, network drives and email archives
- Map access rights onto Active Directory so each officer only reaches the files they are entitled to
- Start with the assistant that solves your most pressing bottleneck, then add modules as needed
- Publish the citizen assistant on the municipal website through the embeddable widget
- Use the audit logs for internal control, data protection reviews and external audits
Pros & Cons
Pros
- Dual ISO 27001 and ISO 42001 certification, evidenced by downloadable certificates naming the company, with numbers and validity dates
- Genuine on-premise option in which municipal data need never leave the building
- Austrian vendor with no US parent, which it presents as putting the platform outside the reach of the US CLOUD Act
- Explicit commitment that customer data is not used to train language models, extended contractually to its model providers
- Personal data masked before it reaches any model, rather than merely being covered by a policy
- Distribution through Kommunalnet, the network of more than 2,100 Austrian municipalities
- Customers are free to commission their own or third-party security audits
Cons
- No price is published anywhere and there is no pricing page, so budgeting requires a sales conversation
- No free plan and no self-service trial; the only free items are a demonstration and an infrastructure assessment
- Neither a commercial API nor a mobile application is offered
- The legal notice prints a company register number that belongs to a different company
- The references page states that no references have been published, while the homepage displays two named testimonials
- The accessibility statement is online with three placeholder blocks left unfilled
- Strongly tailored to Austrian administrative practice, with other markets still described as in preparation
Pricing & Plans
No price is published. The site has no pricing page, and none appears in its sitemap or navigation. The terms and conditions state only that the services are used under a licence model billed monthly or annually, and that prices may be adjusted with 60 days' notice. Liability is capped at the fees paid during the last contract year. There is no free plan and no trial of the product itself; what is offered free of charge is a 30-minute demonstration and a preliminary infrastructure assessment, both described as non-binding. Prospective customers must therefore contact the vendor, or go through the Kommunalnet channel, to obtain a quotation.
- Cloud (SaaS) — the vendor hosts everything in EU data centres
- presented as the option for small municipalities
- no public price
- Hybrid — application layer in the vendor's cloud
- vector database on the municipality's server so document content stays local
- no public price
- On-Premise — complete Docker stack on the municipality's own server
- nothing leaving the building
- no public price
- six product building blocks
- starting with the assistant that addresses the most pressing bottleneck
- no public price
Data, GDPR & hosting
A consolidated view of how KI-Quadrat handles your data.
GDPR overview
GDPR compliance is claimed explicitly and repeatedly, alongside the Austrian Data Protection Act. The privacy notice lists the legal bases used, enumerates data subject rights under Articles 15 to 21, and points to the Austrian data protection authority for complaints. It was last updated on 12 August 2026. A named contact handles privacy questions: Georg Rossek, reachable at gr@ki2.at. The security page states that a data processing agreement is part of the arrangement, and the terms carry processor and subprocessor clauses. No Article 27 representative is designated, which is consistent with the vendor being established in Austria. Citizen sign-in through ID Austria is documented separately, with the sector-specific personal identifier stored encrypted and not passed on.
Who owns the data?
The municipality keeps its material. In the on-premise model documents, indexes, chat history and audit logs stay on the town hall server, and the vendor states that data never leaves the building. In the hosted models the terms restrict storage to certified data centres inside the EU or EEA. Personal details are replaced by tokens on the local system before anything reaches a language model, and restored locally afterwards, so the model never receives real names. Access and administrative changes are logged, and those logs are made available to the municipality's IT, to its data protection officer and to outside auditors. KI-Quadrat Systemhaus GmbH is named as controller, with Georg Rossek as contact.
Reuse rights
Processing is confined to the use cases agreed in the contract. The vendor states plainly that municipal data is never used to train language models, neither by KI-Quadrat nor by the model providers it calls, which it says is secured by contractual opt-out agreements. There is no disclosure to third parties beyond contracted processors, and subprocessors handling substantial personal data require the customer's prior written consent. The legal bases cited are Article 6(1)(b), (f) and (a) GDPR. The vendor also states that no unlawful decision is taken by automated means alone, and that human review remains mandatory for the legal assistant.
Data retention & training
Hosting summary
Hosting depends on the model chosen. On-premise, everything stays on the municipality's own server inside the town hall. In the EU cloud tier, data sits in certified data centres in Germany and Austria, operated by Hetzner and Exoscale. The hybrid tier keeps critical data local while application logic runs in the EU cloud. The terms restrict storage to certified data centres within the European Union or the European Economic Area, and the vendor states that no model places data on US servers. Where a provider outside the EEA is involved, the terms require an adequacy decision or equivalent safeguards. The language models called by the platform are addressed in European regions: Anthropic Claude via AWS Bedrock, Azure OpenAI, and open-source models on Nebius. The vendor stresses that it is an Austrian company with no US ownership and considers the US CLOUD Act inapplicable to its processing.
Things to keep in mind
Risks and trade-offs to weigh before adopting KI-Quadrat.
- The legal notice prints company register number FN 235060b, which the Austrian commercial register attributes to a different company, Robolawyer Business Solutions GmbH in Vienna; the publisher's actual number is FN 330180i, and the domain itself is registered to that other company
- The legal entity dates from 2009 under the name K-JELLY market consulting GmbH and only became KI-Quadrat Systemhaus GmbH in August 2024, so the company's age says little about the maturity of the AI products
- The references page states that no references have been published, while the homepage presents two named customer testimonials — verify any reference before relying on it
- The accessibility statement is published with three unfilled placeholder blocks, and the ISO certificates cover infrastructure hosted on AWS and Microsoft Azure, which deserves reconciling with the emphasis on avoiding US providers
- NIS-2 is described as prepared, not achieved, and the security page dates first ISO 27001 certification to 2025 while the certificate itself reads February 2026
- Sourced answers still require human judgement: the vendor itself keeps human review mandatory for the legal assistant, and staff leaning on an assistant for administrative decisions risk deferring to it rather than checking it
- Preserving retiring officers' knowledge in a searchable system is only as good as what was captured; treating the assistant as the memory of the administration can quietly retire the habit of documenting decisions
Setup & Integrations
Technical difficulty
It varies by model. The hosted cloud tier is presented as a fast rollout with little local burden. The on-premise tier is more demanding: a complete Docker stack is installed on the municipality's server, with roughly 32 GB of RAM and a 500 GB SSD on Linux or Windows Server given as a comfortable target. The vendor mitigates this by carrying out installation itself, offering a free prior infrastructure assessment, and noting that existing hardware is often sufficient — it cites a deployment running on Windows Server 2012 R2. One project is described as delivered in six weeks.
Deployment
Integrations
Supported languages
Behind KI-Quadrat
Resources
All the official URLs gathered for verification and reference.
Frequently asked questions
Where is our data stored?
Is municipal data used to train the AI?
Which language model providers are used?
How is data encrypted?
Is there a public price list?
Is there a free trial or a free plan?
What does the on-premise option require?
Is there an API or a mobile app?
Does the platform comply with NIS-2?
Can we audit the vendor independently?
Should you pick KI-Quadrat?
KI-Quadrat is a deliberately narrow product, and that is its strength. Rather than adapting a general assistant to public administration, it addresses five recognisable municipal bottlenecks and puts the whole stack where a town hall can point at it. The engineering follows the same logic: personal data is tokenised before any model call, the only outbound path is an encrypted tunnel, and the on-premise option is a real one rather than a marketing label. The compliance evidence is unusually solid for a company this size — both ISO certificates are published as PDFs naming the company at its registered address, with certificate numbers and validity dates, which is more than most vendors offer. The reservations are about publication rather than engineering. No price exists anywhere on the site, so no municipality can size the investment without entering a sales conversation, and there is no trial through which to form an independent view. Several pages are visibly unfinished: the references page declares that nothing has been published while the homepage carries two named testimonials, the accessibility statement is online with placeholder blocks, and the legal notice prints a company register number belonging to a different company owned by the same director. None of these is fatal, but together they suggest a young commercial operation, which the timeline supports — the legal entity dates from 2009 under an earlier name, took the KI-Quadrat name only in August 2024, and announced its first customers between late 2025 and mid-2026. For an Austrian municipality with real data sovereignty constraints and someone able to run a server, this is a serious candidate worth a demonstration. Anyone needing published pricing, a trial, an API or a product proven at scale should wait, and should ask the vendor to reconcile its registration details before signing.
- Choosing a selection results in a full page refresh.
- Opens in a new window.