CrisisIQ
CrisisIQ is a German SaaS platform that generates AI crisis simulations for solo or team training, then produces the compliance documentation operators covered by the KRITIS-Dachgesetz and NIS-2 need to evidence their exercises.
What is CrisisIQ?
CrisisIQ is a German SaaS platform for crisis-management preparation and training, published by CrisisIQ GmbH in Berlin. Its pitch is AI-driven crisis preparedness, and its central selling argument is regulatory: the platform is presented as a way for organisations covered by the German KRITIS-Dachgesetz and by NIS-2 to run crisis exercises and to evidence them.
The product rests on four claimed pillars — AI agents the vendor says were trained on real crisis cases, immersive simulation, compliance support and predictive analytics. The documented modules are solo training, group simulations (Gruppensimulationen: briefing, execution, debriefing, reporting), a Szenario-Builder, reports and certificates, and an administration area for companies, users and roles. The Szenario-Builder generates the scenario outline, then its events, decision points and assessment questions, before validation and export; internal documentation gives the design envelope, with up to 150 events per scenario, 500 to 2,000 characters per event, a “Tag X, HH:MM Uhr” time format and “Trainingsprofis” as the intended authors. The engine itself calls third-party AI APIs, described in that same documentation as “currently Anthropic Claude”, with Sonnet as the main model.
Across modules, learners get a contextual AI mentor chat, text-to-speech narration, video clips, an integrated document viewer for emergency plans and org charts, a smart timeline, a scenario feedback system and an installable offline PWA. The crisis types put forward are cyberattack and ransomware, supply-chain disruption, data breach and loss of key personnel. A public Krisenrechner on the product page estimates the expected cost of a crisis from company size, sector and revenue; CrisisIQ attributes its methodology to a “BCM-Krisenanalyse 2024” drawing on GDV, WSI, DIHK and BMWK data.
The founding team is three people: Fabian Lüth (Founder, Security Expert and CEO, a former police officer and trainer), Marc Bohm (Founder, Technical Lead) and Lars Bosse (Founder, Marketing and Sales, CSO).
Delivery is a web application plus a PWA installable on iOS and Android; there is no native app in either store. The marketing site is published in German, English and Swedish, while the platform interface itself is available in German and English only.
What it does
- Generate tailor-made crisis scenarios from a company profile: sector, size, roles and sites
- Run simulations solo or as a group, with branching decision trees and multiple outcomes
- Produce KRITIS compliance documentation and audit reports automatically from logged training sessions
- Measure performance: decision quality, reaction time and progress over time
- Issue named certificates that participants can share on LinkedIn
- Keep emergency plans, org charts and manuals in a document viewer available during a simulation
- Estimate the cost of an unprepared crisis with the public Krisenrechner calculator on the product page
When to use CrisisIQ / When not to
A quick filter to help you decide if CrisisIQ is the right fit.
When to use CrisisIQ
- Operators of German critical infrastructure who must run and evidence regular crisis exercises under the KRITIS-Dachgesetz and NIS-2
- Risk management, business continuity and corporate security teams rehearsing ransomware, supply-chain disruption, data breach or loss of key personnel
- Compliance officers who need logged training records and audit-ready reports rather than informal exercise notes
- Learning and development teams in organisations of roughly 10 to 1,000+ employees who want staff to train on their own schedule, without booking a facilitator
- Schools and education authorities, addressed by the dedicated “5000 Lehrkräfte” campaign at 980 EUR excluding VAT per year for up to 50 teachers
When not to use CrisisIQ
- Teams that want to try before they buy: CrisisIQ offers no free plan and no free trial account, and entry is 18 EUR per user per month
- Buyers who expect to subscribe and pay online — the only route in is a 30-minute consultation call, followed by a 12-month commitment on every tier
- Developers hoping to wire crisis data into their own stack: API integration is sold as an add-on, but no product API documentation is published
- Organisations needing the platform interface in a language other than German or English, since each extra language is a paid add-on with a 2,500 EUR setup fee
- Buyers who require a signed data processing agreement before onboarding: no DPA is offered, mentioned or refused anywhere on the site
How to use CrisisIQ
A typical end-to-end flow, from setup to results.
- Book the free 30-minute consultation through the #consultation form present on every page — there is no self-service sign-up, and CrisisIQ announces a reply within 24 hours
- Ask for the personal demo, which is what the vendor offers in place of a trial account, then agree a tier and a 12-month contract
- Go through the analysis phase, announced at one to two weeks, in which existing emergency plans, processes and roles are reviewed
- Let the vendor adapt scenarios to the organisation, announced at two to three weeks; Enterprise adds an on-site survey and building modelling
- Deploy, announced at one to two weeks: four to eight weeks in total, with the first modules available after about two
- Create the company account: registration is mandatory, users join by invitation or organisation code and confirm their email address
- Assign roles and permissions to users in the administration area
- Have staff start solo training or join a group simulation from the dashboard, working through decisions and assessment questions
- Review performance reports, share the automatically generated certificates and schedule the next scenarios
- Install the PWA on iOS or Android for mobile and offline use; licences are billed monthly per active user and can be added at any time, with reductions taking effect at the end of the contract term
Pros & Cons
Pros
- Public and complete pricing: three priced tiers plus itemised add-on prices, which is rare in this market
- Precise regulatory positioning on the KRITIS-Dachgesetz and NIS-2, with compliance documentation generated from the training sessions themselves
- Detailed public user documentation — 51 pages on docs.crisisiq.de — including a technical architecture section that names the AI provider behind the scenario engine
- Self-directed training removes the cost of organising a facilitated exercise, and the number of scenarios and review cycles per year is stated tier by tier
- Data hosting announced exclusively in Germany, with the two website subprocessors named in the privacy policy
- A free public crisis-cost calculator whose methodology and external sources are stated rather than hidden
- Offline-capable PWA installable from both iOS and Android without going through an app store, with the installation steps documented for each
Cons
- No free plan and no free trial: CrisisIQ states plainly that it does not offer free trial accounts, and the only no-cost step is a personal demo
- A 12-month commitment on all three tiers with automatic renewal unless cancelled, and no online subscription — every purchase goes through a sales conversation
- “API integration” is sold as an add-on on Professional and Enterprise, yet no product API documentation is published; the only “API reference” in the documentation is an unmodified Mintlify starter template describing a demo “Plant Store” API on sandbox.mintlify.com
- No data processing agreement is offered or even mentioned, although the target market is regulated sectors
- The publisher is a very young company and not one customer is named; testimonials, case-study figures and claimed certifications differ completely between the German, English and Swedish versions of the same site
- Legal housekeeping is incomplete: the terms of service are still stamped “Last updated: [Date]”, and the privacy policy covers the website only, not the training platform
- Platform interface limited to German and English, with each additional language costing 2,500 EUR to set up; and there is no social media presence, no native mobile app and no dedicated contact page
Pricing & Plans
There is no free plan and no free trial. CrisisIQ states that it does not offer free trial accounts; the only no-cost steps are a 30-minute consultation and a personal demo. Paid access starts at 18.00 EUR per user per month on the Starter tier, on a 12-month commitment. Professional is 25 EUR per user per month and Enterprise 39 EUR per user per month, on the same 12-month term. The vendor states there are no setup fees on the three standard tiers and that scenarios, support, updates and certificates are included, only explicitly listed add-ons costing extra; it frames that entry price against its own claim of a crisis costing “10,000+ EUR per hour”. Add-ons are priced individually: an additional scenario at 2.50 EUR per licence per month; review cycles on Professional at 1,800 EUR per year plus 1.00 EUR per user per month; an extra interface language at a one-off 2,500 EUR setup plus 0.50 EUR per active user per month in that language; and API integration on Professional and Enterprise, for which no amount is published. Classroom training on site is 4,950 EUR per training day for up to 20 participants. Billing follows the number of active user licences per month, with no minimum seat count; volume discounts are described as negotiable, with no published scale, and no promotional code or time-limited discount appears on the main pricing grid. A separate school package, part of the “5000 Lehrkräfte” campaign, is 980 EUR excluding VAT per year for up to 50 teachers.
- 8 proven scenarios
- generic roles (staff
- management
- communications)
- self-directed training
- interactive decision trees
- certificates
- performance reports
- 12 sector-specific scenarios
- individualised roles and decision paths
- company-specific customisation
- everything in Starter
- dedicated support
- regular content updates
- multi-user training dashboard
- compliance reporting
- 12 hyper-realistic scenarios
- mapping of real roles and sites
- on-site survey and building modelling
- everything in Professional
- premium 24/7 support
- three review cycles per year
- optional API integration
- continuous development
Data, GDPR & hosting
A consolidated view of how CrisisIQ handles your data.
GDPR overview
GDPR compliance is claimed explicitly and repeatedly; the homepage states CrisisIQ is fully GDPR compliant. The privacy policy, dated January 2025, lists the usual rights: access (Art. 15), rectification (16), erasure (17), restriction (18), portability (20), objection (21) and withdrawal of consent. Section 11 cites encryption in transit and at rest, regular security assessments and access controls. Two gaps are documented. No data processing agreement is offered or even mentioned, which is unusual for a vendor selling into regulated sectors. And the supervisory authority named is the Landesbeauftragte für den Datenschutz Niedersachsen in Hannover, although the registered office is in Berlin. No minimum age is stated, and the policy covers the website only, not the training platform. As a German publisher, no Art. 27 EU representative is required.
Who owns the data?
The controller named in the privacy policy is the publisher itself — given as “crisisIQ GmbH i.G.” in the German version and “crisisIQ GmbH” in the English one — at Friedrichstraße 155, 10117 Berlin, VAT ID DE461326545. That policy covers processing on the website only, not the training platform. The terms of service never address ownership of customer content: article 5 grants a non-exclusive, non-transferable right, limited to the contract term, to access and use the platform, and says nothing about who owns the emergency plans, scenarios and results loaded into it. No data protection officer is named. The privacy contact is lars.bosse@crisisiq.de in German and fabian.lueth@crisisiq.de in English.
Reuse rights
On the website, CrisisIQ collects server logs (IP address, timestamp, URL, data volume, browser, operating system, referrer), contact form entries (name, email, company, phone, message, timestamp) and newsletter sign-ups (email and name), on the legal bases of Art. 6(1)(a), (b) and (f) GDPR. Analytics run on Plausible, described as cookie-free and free of personal data; forms are handled by Formspree Inc. in the United States under the EU-US Data Privacy Framework. Transfers outside the EU are said to rely only on an adequacy decision (Art. 45), appropriate safeguards (Art. 46) or explicit consent (Art. 49). The homepage FAQ states that CrisisIQ does not use customer data for other purposes and does not share it with third parties. What no page addresses is model training: the site never says whether customer content feeds AI training, while the vendor's own internal documentation states that the Scenario Creator backend calls third-party AI APIs, “currently Anthropic Claude”, with Sonnet as its main model. Customers receive a right to use the platform for the contract term, not a documented right to reuse generated scenarios, reports or certificates beyond it.
Data retention & training
Hosting summary
CrisisIQ states repeatedly that all data is hosted exclusively in German data centres: the homepage FAQ says so, and the pricing page reads “All data is hosted exclusively in Germany”. End-to-end encryption is claimed in the FAQ, and the privacy policy describes encryption in transit and at rest. No data centre, hosting provider or region is ever named. The observable technical picture is more mixed: the website and the application are served by Render (*.onrender.com) behind Cloudflare, the apex resolves to an anycast address, the name servers are Strato's, and mail runs through Microsoft 365. The privacy policy names two subprocessors, both for the website only — Formspree Inc. in the United States, under the EU-US Data Privacy Framework, and Plausible Insights OÜ, Västriku tn 2, 50403 Tartu, Estonia. Internal documentation adds that scenario generation calls third-party AI APIs, “currently Anthropic Claude”. No subprocessor of the training platform itself, hosting or model provider, is published. The German-hosting statement is therefore the vendor's claim, not a verified fact about every component.
Things to keep in mind
Risks and trade-offs to weigh before adopting CrisisIQ.
- The vendor's showcase figures contradict each other: CrisisIQ's meta description claims a 70 percent reduction in crisis costs, its product page headline claims 50 percent, and the crisis calculator's own methodology gives 55 percent — that last one attributed to an external “BCM-Krisenanalyse 2024” rather than to CrisisIQ's own results. None of the vendor's own percentages is sourced.
- A “100% Success Rate” is stated by CrisisIQ on its homepage and company page. It is the publisher's own claim, with no denominator, no period and no way to verify it from outside.
- Testimonials and case-study results are entirely different from one language of the site to the next: the German and English pages carry Dr. Sarah Mueller, Michael Weber and Lisa Hoffmann plus an “Automotive-Konzern” case study, while the Swedish page carries Anna Svensson, Magnus Lindström and Eva Johansson plus a different manufacturer with different percentages, and even the average crisis cost changes from 2.4 million EUR to 4.2 million EUR. No customer company is identifiable in any language, so treat this content as illustrative.
- Claimed certifications also vary by language. ISO 27001 is claimed on six pages without a certificate number or certifying body, and the Swedish version claims in addition an ISO 22301 certification, recognition by the European Commission and membership of the International Crisis Management Association — none of which appears in the German or English versions.
- The vendor's claim that all data is hosted exclusively in Germany is not corroborated by any observable technical fact: the site and application are served by Render, an American provider, behind Cloudflare, forms go through Formspree Inc. in the United States, and scenario generation calls Anthropic's API. The claim may well concern platform data only, but the site never says so.
- Legal pages have not been kept current: the terms of service are still stamped “Last updated: [Date]”, the supervisory authority named in the privacy policy is the Landesbeauftragte für den Datenschutz Niedersachsen while the registered office is in Berlin, the privacy contact differs between the German and English versions of the same policy, and the D-U-N-S number is absent from the German Impressum, given as 316130930 in the English imprint and as 316897376 on the campaign landing page.
- Simulated crises can breed false confidence: a branching decision tree scored by an AI mentor is not a live incident, and a scenario is capped at 150 events by design. Add that CrisisIQ never states whether customer content feeds model training and documents no opt-out mechanism, and organisations should think twice before uploading real emergency plans, org charts and site maps without asking first.
Setup & Integrations
Technical difficulty
Low for end users, moderate for the organisation. Nothing is installed: the product is a web application with an installable PWA, and the only requirement is a browser; mobile installation is documented step by step for iOS and Android. The effort sits on the buyer's side. CrisisIQ announces a guided rollout of four to eight weeks, and the Professional and Enterprise tiers expect emergency plans, processes and role maps, with an on-site survey on Enterprise. Administration means creating the organisation, inviting users and assigning roles. LMS, HR and reporting integrations are add-ons, with no public technical documentation.
Deployment
Integrations
Supported languages
Behind CrisisIQ
Resources
All the official URLs gathered for verification and reference.
Frequently asked questions
Is there a free trial or a free plan?
How much does CrisisIQ cost?
How long does a rollout take?
Does CrisisIQ satisfy the KRITIS-Dachgesetz?
Where is the data hosted?
Is there an API?
Is there a mobile app?
Which languages are supported?
Can I change tier, and what happens after the twelve months?
Can scenarios be adapted to my organisation?
Should you pick CrisisIQ?
CrisisIQ is coherent and unusually well documented on its core promise: generating crisis scenarios, running them solo or as a team, and turning the exercise into evidence an auditor or authority can read. The regulatory framing on the KRITIS-Dachgesetz and NIS-2 is precise, the 51-page public documentation goes as far as describing the scenario engine's architecture, and the pricing page is fully public down to the add-ons — a level of transparency that is rare in this segment.
The reservations concern the publisher more than the product. The company is very young and not one customer is named; testimonials, case-study percentages and claimed certifications differ completely between the German, English and Swedish versions of the same website, which makes all of them illustrative rather than evidential. The cost-reduction figure the vendor advertises varies too: 70 percent in the meta description, 50 percent on the product page, and 55 percent in the calculator methodology, that last one credited to an external “BCM-Krisenanalyse 2024” rather than to CrisisIQ's own results. An ISO 27001 certification is claimed on six pages without a certificate number or certifying body.
There is also no way to try before buying: no free plan, no trial account, and a 12-month commitment on every tier, reached only through a sales conversation. Four questions deserve a direct answer before signing: whether a data processing agreement is available, since none is mentioned; who the platform's subprocessors are, since the published privacy policy covers the website only; what “API integration” actually consists of, since no product API documentation exists; and who issued the ISO 27001 certificate.
For a German organisation that must prove crisis training and can live without a trial, CrisisIQ is worth a demo. Treat its showcase figures as vendor claims.
- Choosing a selection results in a full page refresh.
- Opens in a new window.