Finalist
GenAI Berlin Award 2026
IT Risk Ranger
An AI agent that turns UnternehmerTUM's risk registry into a weekly steering view: NIS-2-aligned, human-approved, and built end-to-end with AI.
Public Sector, Education & Social Good
About the project
UnternehmerTUM runs a large, multi-entity technology landscape with a lean IT team. With NIS-2, the bar for risk management, management accountability, and reporting rises. Our IT and legal risks lived in scattered notes, tickets, and heads. Visibility depended on someone looking.
Over five months, we built one shared IT & Legal Risk Registry: a single source of truth with exactly one accountable owner per risk, clear review cycles, and a written policy. On top, we built the IT Risk Ranger, an AI agent that runs every Friday. It combines identity and device health data with the registry, our NIS-2 programme backlog, and our overview of SaaS and AI tools, and sends one management view. The agent is read-only: it flags and recommends, and people decide. Orange Cyberdefense, our project partner for NIS-2 CISO-as-a-Service, brought domain knowledge and sparring. IT and Legal now run the registry together.
Risk management at UnternehmerTUM no longer depends on someone remembering to look. Every risk has a named owner, NIS-2 gaps appear next to operational risks, and reviews have a rhythm. We built in AI ethics from day one: transparent sources, human accountability, rule-based prioritization instead of scoring people, and privacy by design, using the IEEE CertifAIEd criteria as our lens. Other organizations can reuse the pattern: registry, policy, read-only agent, and human decision. We created the solution and this application with AI.
Key details
Track
Public Sector, Education & Social Good
Organisation
Status
Finalist
In the team's words
We want an independent view on a question many organizations share: how can a small IT team make AI useful for governance without giving up control? In five months, we moved from scattered risk notes to one registry and a weekly AI review, aligned with NIS-2. Success means three things to us. We get honest feedback from practitioners who have shipped GenAI. We show that human-approved, read-only agents can carry real governance work. And we meet other organizations facing NIS-2 who want to reuse the pattern. We will share the registry structure and the guardrails openly. We created this application with AI, and we say so on purpose.
Europe’s go-to conference for GenAI leaders and enthusiasts
Attend GenAI Berlin to stay at the forefront of Generative AI, connect with the minds shaping the technology’s future, and explore its real-world impact across industries.
