# Bit2Board Consulting — full text (English) > Independent, principal-led IT advisory in Baar, Switzerland (Bit2Board Consulting GmbH). Helps companies in regulated industries (pharma and life sciences, commodity trading, energy, manufacturing), public authorities and investors make technology decisions that hold up in front of steering committees, auditors, regulators and buyers: enterprise, integration and identity architecture, technical due diligence, fractional CTO, EU AI Act readiness, AI strategy, HERMES documentation reviews, IT tenders and vendor governance. Bit2Board Consulting GmbH is an independent IT advisory in Baar, Switzerland, led by Faysal Cherradi. It designs enterprise, integration and identity architecture, carries out technical due diligence for software acquisitions, guides EU AI Act compliance, reviews HERMES project documentation and prepares IT tenders, for companies in regulated industries, public authorities and investors. ## Technical due diligence for software acquisitions URL: https://www.bit2boardconsulting.com/services/technical-due-diligence/ A technical due diligence tells a buyer, investor or lender what they are really buying in a software company: architecture, code and security, dependence on key people, licences, operations and the cost of what has to be fixed. For acquisitions of software SMEs in Switzerland and the DACH region. A red-flag scan takes 5 working days and starts at CHF 9,500; a full due diligence takes 10–15 working days from CHF 19,500. ### For - Individual buyers and management buy-in candidates - Search funds, family offices and private equity investors - Banks and lenders financing an acquisition - M&A advisers who need a technical workstream ### You need this if - You are about to sign a letter of intent for a software company, and all you have is the seller's presentation. - The founder is the only one who really understands the code. - The product runs on a framework that is no longer supported, and nobody has priced the rewrite. - You have to tell your bank or investment committee what the technology is worth, and what it will cost. - Customers run old versions with individual modifications. - The seller says the software is cloud-ready. ### What you get - Red-flag report: The five to ten findings that should change the price, the terms or the decision, each with evidence and an estimated cost to fix. - Architecture and code assessment: Structure, technical debt, tests, dependencies and components that are out of support. - Security and data protection review: Vulnerabilities, access, backups, and readiness for the Swiss Data Protection Act and the GDPR. - People and knowledge risk: Key-person dependencies, documentation and what it takes to transfer the knowledge. - Value creation and 100-day plan: What to fix first after closing and what it costs, as input for your business plan. ### How it works 1. Kick-off (Day 1): Scope, data room access, interview plan and the questions your investment decision depends on. 2. Data room and code (Days 2–6): Documents, repository, infrastructure and tooling, with read-only access. 3. Interviews (Days 4–8): Founder, lead developers and operations, in German, English or French. 4. Report (Final days): Findings, quantified risks, suggested contract protections and a management summary for your committee. ### Packages and prices - Red-flag scan — 5 working days — from CHF 9,500: Deal-breaker check before or right after the letter of intent: architecture, code sample, security basics and key-person risk. - Full technical due diligence — 10–15 working days — from CHF 19,500: Complete assessment with code analysis, interviews, quantified risks and recommendations for the purchase agreement. - Post-closing 100-day plan — 2–3 weeks — on request: A prioritised technology plan for the first 100 days after closing, with owners and budget. ### Why Bit2Board - 18 years in software, as developer, architect, team lead of software consulting and adviser: we read code and talk to developers in their language. - Software risk assessment and cost and productivity analysis were core to Faysal Cherradi's work as a senior transformation consultant. - TOGAF 9 certified and an MBA in strategic management: findings expressed as price, terms and plan, not jargon. - We are paid for the assessment, not for the closing of the deal. ### How we use AI - AI-assisted code and dependency analysis covers the whole repository, not a sample. - AI makes the first pass through the data room; every finding in the report is verified by a person. - Code and data-room content are processed only under the terms of the NDA and, if required, without any cloud AI. ### Questions Q: When should the technical due diligence take place? A: A red-flag scan is most useful before or right after the letter of intent, while findings can still change the price. The full due diligence runs during exclusivity, in parallel with the financial and legal workstreams. Q: Do you need access to the source code? A: Read access is best. If the seller refuses, we work with a supervised code review, architecture documentation and interviews, and we state the limits in the report. Q: How does the seller experience it? A: As a professional and respectful process. Interviews are planned with the seller, and we do not contact customers or employees without agreement. Q: Can you assess the IT of a company that is not a software company? A: Yes, where the company's value depends on its IT, for example in e-commerce, logistics or services. The scope is adapted. Q: What happens after the deal? A: Many buyers continue with a 100-day plan or a [fractional CTO](https://www.bit2boardconsulting.com/services/fractional-cto/) during the transition. That is a separate decision after closing. For a checklist of what to ask before signing, read [twelve technical questions](https://www.bit2boardconsulting.com/insights/technical-due-diligence-swiss-software-sme/). Request a proposal: https://www.bit2boardconsulting.com/request-proposal/?service=technical-due-diligence Book a free 30-minute call: https://www.bit2boardconsulting.com/orientation-call/?topic=technical-due-diligence ## Fractional CTO and interim technology leadership URL: https://www.bit2boardconsulting.com/services/fractional-cto/ A fractional CTO gives a company that cannot justify a full-time technology executive the same judgement for about four days a month: technology strategy, architecture decisions, supplier and budget control, hiring and team development. Typical clients are owner-managed SMEs, new owners after an acquisition and software companies whose founder is stepping back. From CHF 6,500 per month, for at least six months. ### For - Owner-managed SMEs without technology leadership - New owners in the first year after an acquisition - Software companies whose founder is stepping back - Boards that need a technology voice ### You need this if - IT costs keep rising and nobody can tell you what you get for them. - You depend on one supplier or one developer, and you know it. - You bought a company, and its technology leadership left with the founder. - A big system decision is coming, such as an ERP, a platform or the cloud, and you want someone on your side of the table. - Your developers need direction, and you need someone who can hire the next ones. ### What you get - Technology strategy and roadmap: Where technology has to support the business in the next two to three years, and in what order. - Architecture and investment decisions: Prepared, documented and defended in front of management and the board. - Supplier and budget control: Contracts, service levels, licences and costs under regular review. - Team leadership: Priorities, hiring, development practices and a succession plan for when the mandate ends. ### How it works 1. Assessment (Month 1): Systems, suppliers, costs, people and risks, with a written baseline. 2. Plan (Months 1–2): Priorities and roadmap agreed with management. 3. Lead (Months 2–12): Regular presence, decisions and steering, about four days a month. 4. Handover (Final months): Hire or develop the permanent leader and hand over cleanly. ### Packages and prices - Fractional CTO retainer — minimum 6 months — from CHF 6,500 per month: About four days a month of technology leadership, with fixed availability and a monthly report to management. - Post-acquisition 100-day programme — 100 days — fixed price on request: Technology integration and stabilisation in the first 100 days after closing. ### Why Bit2Board - Has led a software consulting team and directs the technical side of a multi-supplier e-government programme. - Covers the whole role: strategy (MBA), architecture (TOGAF 9), service management (ITIL 4) and hands-on software engineering. - A background as developer, architect and consultant: credible with developers, suppliers and boards alike. ### How we use AI - We introduce practical, governed AI use in your team: where it helps, how data is protected and who is accountable. - AI supports analysis and documentation; decisions stay with management, prepared by your CTO. ### Questions Q: How many days a month do we get? A: Typically four days spread over the month, plus availability for urgent questions. The volume can be adjusted each quarter. Q: Why a minimum of six months? A: Technology leadership needs time to take effect: the first month is assessment, and results show from the second quarter. Q: Can the fractional CTO represent us towards suppliers and investors? A: Yes, with a defined mandate. This is often where the role pays for itself. Q: Will you write code? A: Occasionally, for prototypes or reviews. The role is leadership; development stays with your team or your suppliers. Request a proposal: https://www.bit2boardconsulting.com/request-proposal/?service=fractional-cto Book a free 30-minute call: https://www.bit2boardconsulting.com/orientation-call/?topic=fractional-cto ## EU AI Act readiness and technical documentation URL: https://www.bit2boardconsulting.com/services/eu-ai-act-compliance/ The EU AI Act also applies to Swiss companies that place AI systems on the EU market or whose AI output is used in the EU. We establish which of your systems it covers and in which risk class, close the gaps before the deadlines, which for high-risk systems under Annex III is now 2 December 2027, and build the technical documentation with your engineers. A gap assessment takes 3–4 weeks and starts at CHF 12,000. ### For - Swiss and European software companies that build AI into their products - Companies that use AI in hiring, lending, insurance or customer decisions - Product, compliance and legal teams preparing for conformity assessment ### You need this if - An EU customer asks in a tender whether your product complies with the AI Act. - Your software scores, ranks or filters people: applicants, borrowers, policyholders or students. - You are not sure whether you are a provider, a deployer, or both. - Your product is regulated, such as a medical device or a machine, and contains an AI component. - Your lawyers have explained the regulation, but nobody has turned it into engineering work. - You heard the deadlines moved and want to know what still applies, and when. ### What you get - AI system inventory: All AI systems and general-purpose AI models you build or use, with your role for each one. - Risk classification: Prohibited, high-risk under Annex I or III, transparency duties or minimal risk, with the reasoning written down, including any Article 6(3) exception. - Gap assessment and roadmap: What is missing against Articles 9 to 17 and the deployer duties, with effort, owners and deadlines. - Technical documentation: Annex IV documentation, risk management file, data governance and the design of human oversight, built with your engineers. - Conformity support: Quality management system, EU declaration of conformity, registration and post-market monitoring. ### How it works 1. Inventory (Week 1): Workshops with product, engineering and compliance to list systems, roles and markets. 2. Classification (Week 2): The risk class of each system with its legal basis, reviewed with your counsel. 3. Gap assessment (Weeks 2–4): Requirements compared with current practice, with a costed roadmap. 4. Documentation (From month 2): Technical documentation and processes, system by system. ### Packages and prices - Applicability and gap assessment — 3–4 weeks — from CHF 12,000: Up to three AI systems: inventory, roles, risk classification and a costed gap roadmap. - Technical documentation package — 6–10 weeks — from CHF 25,000 per system: Annex IV documentation, risk management file and human-oversight design for one high-risk system. - Conformity support — ongoing — retainer on request: Quality management system, preparation of the conformity assessment, registration and post-market monitoring. ### Why Bit2Board - Architects and engineers write the documentation: we translate legal requirements into system design, logging, data governance and tests. - Data Scientist programme (2023) and deep-learning training: we understand how the models in your product are built. - We work with your lawyers, not instead of them. Legal interpretation stays with counsel. - Swiss perspective: we also follow Switzerland's own AI rules, for which the Federal Council has asked for a consultation draft by the end of 2026. ### How we use AI - We use AI the way the AI Act expects you to: documented, under human oversight, with decisions logged. - AI helps map requirements to your existing documentation and code; the classification is a human decision. ### Questions Q: Does the EU AI Act apply to a Swiss company? A: In many cases, yes. Under Article 2 it applies to providers that place AI systems on the EU market or put them into service there, wherever they are established, and to providers and deployers outside the EU when the output of their AI system is used in the EU. Q: What are the current deadlines? A: The prohibitions and the AI literacy duty have applied since 2 February 2025, and the transparency obligations of Article 50 since 2 August 2026. The Digital Omnibus on AI, Regulation (EU) 2026/1744 in force since 27 July 2026, moved the high-risk obligations to 2 December 2027 for Annex III systems and to 2 August 2028 for AI in products covered by Annex I. See our [overview of the changes](https://www.bit2boardconsulting.com/insights/eu-ai-act-digital-omnibus-swiss-companies/). Q: Which AI systems are high-risk? A: AI systems that are safety components of products covered by the EU legislation listed in Annex I, and systems used in the areas of Annex III: biometrics, critical infrastructure, education, employment, access to essential services such as credit and insurance, law enforcement, migration and the administration of justice. Article 6(3) exempts some Annex III systems that pose no significant risk, but never systems that profile people. Q: Are you lawyers? A: No. We are architects and engineers. We prepare the technical classification and documentation and work with your legal counsel, who signs off the legal interpretation. Q: How high are the fines? A: Up to EUR 35 million or 7% of worldwide annual turnover for prohibited practices, and up to EUR 15 million or 3% for most other obligations, including the high-risk requirements. For SMEs, and since the Omnibus also for small mid-caps, the lower of the two amounts applies. Request a proposal: https://www.bit2boardconsulting.com/request-proposal/?service=eu-ai-act Book a free 30-minute call: https://www.bit2boardconsulting.com/orientation-call/?topic=eu-ai-act ## AI strategy and innovation projects URL: https://www.bit2boardconsulting.com/services/ai-strategy-innovation/ We help organisations find where AI creates measurable value, and design those use cases so that they can be built, operated and audited: opportunity assessment, business case, architecture, data and governance, and a pilot plan with success criteria. For management teams and IT leaders who want results rather than experiments. An opportunity assessment takes 2–3 weeks and starts at CHF 9,500. ### For - Management teams of SMEs - IT leaders in public administrations and regulated companies - Innovation and digitalisation officers ### You need this if - Your staff already use AI tools, and you have no rules for it. - You ran three pilots, and none of them made it into production. - The board wants an AI strategy by next quarter. - Vendors pitch AI features, and you cannot judge which ones are worth paying for. - You want AI agents to take over routine work, but worry about data, errors and accountability. ### What you get - Opportunity map: Use cases rated by value, feasibility, data readiness and risk. - Business case: Costs, benefits and assumptions for the strongest use cases, in a form your finance team accepts. - Architecture and data design: How each use case fits your systems: models, retrieval, integration, security and running costs. - Governance: AI policy, roles, approval and monitoring, aligned with the EU AI Act where it applies. - Pilot plan: Scope, success criteria and the date of the decision to scale up or stop. ### How it works 1. Discover (Week 1): Interviews and process walk-throughs to collect candidate use cases. 2. Assess (Week 2): Value, feasibility, data and risk for each candidate. 3. Decide (Week 3): A prioritised portfolio and business cases, presented to management. 4. Design and pilot (From month 2): Architecture, governance and a pilot with measurable success criteria. ### Packages and prices - Opportunity assessment — 2–3 weeks — from CHF 9,500: Use-case discovery and assessment, with a prioritised portfolio and two business cases. - Architecture and governance — 4–8 weeks — fixed price after the assessment: Target architecture, data design and governance for the selected use cases. - Innovation partnership — from 6 months — on request: Ongoing support from pilot to production, with a portfolio review every quarter. ### Why Bit2Board - Architecture first: AI that cannot be integrated, secured and operated is not a use case. - A Data Scientist programme (2023) and 18 years of software engineering behind the advice. - Compliance built in from the start: AI Act, data protection and records management. ### How we use AI - We use AI in our own work every day, so our recommendations are realistic about what it can and cannot do. - Business cases rest on explicit assumptions you can challenge, not on vendor benchmarks. ### Questions Q: Do you build the AI solution? A: We design and steer it. Your team, or a supplier we help you select, builds it, so that you do not depend on us. Q: Which models and platforms do you recommend? A: Whatever fits your data, risk and budget. We have no partnerships or commissions, and we design so that you can switch models later. Q: Is our data safe if we use generative AI? A: It can be, with the right contracts, settings and architecture. Data residency, exclusion from model training, access control and logging are part of every design we deliver. Q: How do we measure success? A: Each pilot has success criteria agreed before it starts, such as time saved, error rate or cost per case, and a date on which to decide whether to scale up or stop. Request a proposal: https://www.bit2boardconsulting.com/request-proposal/?service=ai-innovation Book a free 30-minute call: https://www.bit2boardconsulting.com/orientation-call/?topic=ai-innovation ## HERMES documentation conformity review URL: https://www.bit2boardconsulting.com/services/hermes-documentation-review/ An independent review of your HERMES project documents, such as the study, the project management plan, concepts and test reports, against HERMES 2022 and the criteria of your reviewers. For project leads in Swiss authorities and for the suppliers who deliver to them. A quick check of one document takes 5 working days and starts at CHF 2,900: you get a findings register with references and a prioritised fix plan. ### For - Project leads and PMOs in federal, cantonal and communal administrations - Quality and risk managers of HERMES projects - Consultancies and integrators that deliver HERMES results to public clients ### You need this if - Your steering committee keeps sending documents back for another round. - A phase release is coming up and you are not sure the documents will pass. - Quality and risk management or the internal audit has announced a review. - You took over a project and cannot tell which results are missing or out of date. - As a supplier, you want your deliverables checked before your client reviews them. - Your documents contradict each other: the study says one thing, the solution architecture another. ### What you get - Findings register: Every finding with its location, the HERMES result or review criterion it relates to, its severity and a concrete correction. - Conformity matrix: The results your scenario and tailoring require per phase, mapped to what exists, what is incomplete and what is missing, including the minimum documents HERMES requires for project governance. - Cross-document check: Contradictions between study, concepts, architecture, plans and tender documents, with the passages side by side. - Prioritised fix plan: What to correct before the next release decision, what can wait, and who should do it. - Debrief: A 60-minute session with the project lead or the authors to walk through the findings. ### How it works 1. Scope (Day 1): We agree the documents, the HERMES scenario and tailoring in use, and the criteria that matter to your reviewers. 2. Review (Days 2–4): Structured reading against HERMES 2022 and your criteria, supported by AI-assisted cross-checks across all documents. 3. Findings (Day 4): Each finding is verified against its source and written so that the author can fix it without a meeting. 4. Debrief (Day 5): Walk-through with the project team and a fix plan ordered by the next decision point. ### Packages and prices - Quick check — 5 working days — from CHF 2,900: One document of up to 60 pages, reviewed against HERMES 2022 and your criteria, with findings register and fix plan. - Pilot — 8 weeks — CHF 18,000 fixed: Up to 10 documents across two projects, conformity matrix, cross-document check and a review checklist your team can reuse. - Annual review agreement — 12 months — on request: An agreed number of reviews per year at a fixed rate per document, with priority turnaround before phase releases. ### Why Bit2Board - Faysal Cherradi leads the architecture and documentation governance of an inter-cantonal e-government platform delivered under HERMES, and has led federal IT projects with budgets up to CHF 6 million. - We review the way your reviewers will: phase releases, minimum documents, consistency and whether the document lets the committee decide. - Findings in German, French or English, matching your documents and your steering committee. - Independent: we never review a solution we are delivering. ### How we use AI - AI reads every document in full and flags gaps and contradictions between documents, which is where most review comments come from. - Every finding is checked against the source passage and the HERMES reference by Faysal Cherradi before you see it. - Confidential project documents are processed with AI only with your agreement; otherwise we review without it. ### Questions Q: Which HERMES version do you review against? A: HERMES 2022, the current edition published by the Swiss Federal Chancellery and recognised by the eCH association as standard eCH-0054. If your organisation uses its own tailoring or templates, we review against those as well. Q: Which documents can you review? A: Any HERMES result in written form: project initiation order, study, project management plan, concepts, solution architecture, test concept, acceptance and release reports, and the project closure report. Most quick checks concern a study, a project management plan or a concept shortly before a phase release. Q: Do you replace our quality and risk management? A: No. We give the project, or the quality and risk management role, an independent second reading. Where that role is filled externally, we coordinate so that findings do not overlap. Q: Can a supplier commission the review? A: Yes. Integrators and consultancies use it as a quality gate before handing results to their client. We do not review the same project for both sides without the written consent of both. Q: Is Bit2Board affiliated with the Federal Chancellery? A: No. HERMES is an open standard of the Swiss federal administration. Bit2Board is an independent advisory and is not affiliated with or endorsed by the Federal Chancellery. Read more in [six reasons HERMES documents fail review](https://www.bit2boardconsulting.com/insights/hermes-documents-audit-ready/). Request a proposal: https://www.bit2boardconsulting.com/request-proposal/?service=hermes-review Book a free 30-minute call: https://www.bit2boardconsulting.com/orientation-call/?topic=hermes-review ## IT procurement and tender preparation (BöB, IVöB) URL: https://www.bit2boardconsulting.com/services/it-procurement-tender/ We prepare IT procurements for Swiss authorities and public enterprises under the revised procurement law, the BöB for the Confederation and the IVöB for cantons and communes: procurement strategy, requirements, suitability and award criteria, evaluation model and tender documents, through to support during the evaluation. A tender readiness review takes 2 weeks and starts at CHF 8,500; full preparation is quoted at a fixed price. ### For - Procurement offices and IT project leads in Swiss authorities - Public enterprises and institutions subject to procurement law - Project owners whose HERMES study leads to a procurement ### You need this if - A procurement is in your project plan, but nobody on the team has written an IT tender before. - Your requirements read like a wish list, and you cannot tell which ones suppliers will price. - You are worried about an appeal from a losing bidder. - The last tender drew two offers, and both were over budget. - You will have to justify the award to the steering committee or the audit office. - A framework contract is ending and you must decide whether to call off, extend or re-tender. ### What you get - Procurement strategy: Procedure, lots, contract type and timeline, with the reasoning a reviewer expects to see. - Requirements catalogue: Mandatory and evaluated requirements, written so that suppliers can answer them and you can score the answers. - Suitability and award criteria: Criteria, weights and a price-quality evaluation model, tested against realistic sample offers before publication. - Tender documents: Specification, response forms, question-and-answer process and draft contract annexes, ready for publication on simap.ch. - Evaluation support: Clarification questions, scoring workshops and an award report that documents every decision. ### How it works 1. Readiness review (2 weeks): We review your study, requirements and plan and tell you what is missing before you can publish. 2. Market and strategy (1–3 weeks): Market analysis, choice of procedure, lots and the evaluation model. 3. Tender documents (3–6 weeks): Requirements, criteria and documents, reviewed with your procurement and legal staff. 4. Evaluation (after the deadline): Support from the opening of offers to the award report. ### Packages and prices - Tender readiness review — 2 weeks — from CHF 8,500: Review of the existing study, requirements and draft documents, with a gap list and a recommended procedure. - Full tender preparation — 6–12 weeks — fixed price after the readiness review: Strategy, requirements, criteria, evaluation model and tender documents, through to publication. - Evaluation support — per tender — on request: Clarifications, scoring workshops and award report, on call during the evaluation period. ### Why Bit2Board - Faysal Cherradi works on procurement specifications and supplier evaluation in a multi-supplier inter-cantonal e-government programme, and has led federal IT projects with budgets up to CHF 6 million. - Architecture and procurement in one person: requirements that suppliers can actually build and price. - Strict independence: we never bid on, and never advise bidders on, a tender we help to prepare. ### How we use AI - AI compares your requirements with the study, the architecture and earlier tenders to find gaps, duplicates and requirements that cannot be scored. - AI helps draft sample offers to stress-test the evaluation model before publication. - Legal questions stay with your procurement office or lawyers; we flag them, we do not answer them. ### Questions Q: Do you give legal advice on procurement law? A: No. We prepare the technical and commercial content of the tender and work alongside your procurement office or lawyers, who remain responsible for legal questions such as the choice of procedure and the risk of appeals. Q: Do you work on tenders of cantons and communes as well as the Confederation? A: Yes. We work with the federal act (BöB) and the intercantonal agreement (IVöB) and adapt to the procurement rules and templates of your organisation. Q: Will you bid on the tender afterwards? A: Never. Bit2Board does not bid on, or advise bidders on, any tender it has helped to prepare. This protects your procedure from pre-involvement problems. Q: Can you help when the tender is already published? A: Yes, with answers to bidders' questions and with the evaluation. Published documents can only be changed within narrow limits, so the earlier you involve us, the more we can improve. Q: How does the procurement fit with HERMES? A: In HERMES, procurement runs as a module alongside the study and concept work. We align the tender with the study and the solution architecture, so that the results support the next release decision. A [HERMES documentation review](https://www.bit2boardconsulting.com/services/hermes-documentation-review/) can check the study before the tender is written. Request a proposal: https://www.bit2boardconsulting.com/request-proposal/?service=it-procurement Book a free 30-minute call: https://www.bit2boardconsulting.com/orientation-call/?topic=it-procurement ## Vendor and contract governance after award URL: https://www.bit2boardconsulting.com/services/vendor-governance/ When a supplier misses milestones, payments no longer match visible progress or acceptance keeps slipping, we restore control. We compare the contract, plan and deliverables with what has really been delivered, set measurable acceptance criteria and evidence-based reporting, and prepare the decisions for your steering committee. A health check takes 2–3 weeks and starts at CHF 9,500; ongoing governance is a monthly retainer. ### For - Project owners and steering committees of outsourced IT projects - Procurement and contract managers in authorities and public enterprises - CIOs of companies that rely on one or two critical IT suppliers ### You need this if - Milestones slip, yet every status report is green. - You pay for effort but cannot measure the output. - Acceptance tests keep being postponed, or end without a clear decision. - Several suppliers blame each other for problems at the interfaces. - Change requests pile up and nobody knows the real scope any more. - You need facts before an escalation or a contract decision. ### What you get - Delivery health check: Contract, scope, plan, deliverables and invoices compared with what has actually been delivered, with root causes. - Measurable acceptance criteria: For each open deliverable: what done means, how it is tested and who accepts it. - Steering report: A one-page status based on evidence rather than self-assessment, with the decisions the committee has to take. - Escalation file: Facts, contract references and options, ready for a formal escalation or a renegotiation. ### How it works 1. Document intake (Week 1): Contract and annexes, plans, status reports, change requests, invoices and acceptance records. 2. Interviews (Weeks 1–2): Project owner, supplier and users, each separately. 3. Health check (Weeks 2–3): The gap between contract, plan and reality, its causes and the options. 4. Steering (ongoing): Acceptance criteria, reporting and support in steering meetings, if you continue with a retainer. ### Packages and prices - Health check — 2–3 weeks — from CHF 9,500: Analysis of one contract or supplier relationship, with findings, risks and recommended actions. - Governance retainer — from 3 months — from CHF 3,500 per month: Acceptance criteria, evidence-based reporting and steering support, typically two days a month. ### Why Bit2Board - As technical project lead of an inter-cantonal e-government programme, Faysal Cherradi coordinates several suppliers at once, and he has worked on supplier management and productivity analysis as a transformation consultant. - Architecture background: we can judge whether a deliverable is technically complete, not only whether it was delivered. - Neutral: no commercial ties to integrators or software vendors. ### How we use AI - AI reconciles contracts, change requests, plans and reports and highlights where they diverge. - Conclusions about a supplier's performance are drawn by people, with the evidence attached. - Supplier documents are treated as confidential under your contract with that supplier. ### Questions Q: Can you act as the independent quality assurance of our project? A: Yes, as long as we have no relationship with the suppliers concerned. We disclose any earlier contact before we start. Q: Do you take over the project management? A: Usually not. We strengthen your control of the supplier. If you need an interim technical project lead, we can discuss it as a separate mandate. Q: Do you also work for suppliers? A: Not on the same project. On other projects, integrators engage us to review their deliverables before they hand them over to the client. Q: What do you need to start? A: The contract with its annexes, the latest plan and status reports, open change requests and acceptance records. Read access to the project repository helps. Request a proposal: https://www.bit2boardconsulting.com/request-proposal/?service=vendor-governance Book a free 30-minute call: https://www.bit2boardconsulting.com/orientation-call/?topic=vendor-governance ## International digital-government advisory URL: https://www.bit2boardconsulting.com/services/international-digital-government/ For ministries, digital agencies and donor-funded programmes in the Middle East, North Africa and francophone Africa that need e-government platforms, interoperability or identity planned and procured well. We bring Swiss practice in architecture, procurement and project governance and work in French, Arabic and English. Engagements are scoped on request, from a two-week review of a programme or proposal to an architecture framework with a capability programme. ### For - Ministries and national digital agencies - International organisations and donor-funded programmes - Consultancies delivering digital-government programmes that need an experienced architect ### You need this if - Your ministry is planning a citizen portal or a shared service platform and needs a target architecture. - A donor-funded programme needs terms of reference or a tender for a digital platform. - Several agencies have to exchange data, but every system speaks its own language. - You need an independent review of a supplier's proposal or of a programme design. - Your team works in French or Arabic, and the expertise you find works in English only. ### What you get - Programme or proposal review: An independent assessment of a design, a tender or an offer, with risks and recommendations. - Target architecture: Capabilities, platforms, interoperability and identity, modelled with TOGAF and ArchiMate. - Procurement documents: Terms of reference and requirements that local and international suppliers can answer. - Capability programme: Training and coaching so that your team can own the architecture after we leave. ### How it works 1. Context (1–2 weeks): Stakeholders, existing systems, legal framework and funding conditions. 2. Assessment (2–4 weeks): Where you are, where you need to be, and the options to get there. 3. Design (4–12 weeks): Target architecture, roadmap and procurement documents. 4. Handover (ongoing): Coaching and quality assurance during implementation, remote and on site. ### Packages and prices - Programme or proposal review — 2–3 weeks — on request: Independent review of one programme design, tender or offer, with written recommendations. - Architecture framework and capability programme — 3–9 months — on request: Target architecture, governance and a training programme for the internal team. ### Why Bit2Board - Native Arabic speaker who works in French, German and English; born in Morocco and at home in Swiss public administration. - First-hand experience of a multi-canton e-government platform: portal, identity and access, several suppliers, shared governance. - TOGAF 9 certified, with ArchiMate in daily use. ### How we use AI - AI helps translate and align documents across French, Arabic and English; Faysal Cherradi checks every translation that feeds a decision. - Data stays under the client's rules: where local law requires it, we work without cloud AI. ### Questions Q: Which countries do you work in? A: Mainly Morocco and other countries in North Africa and the Middle East, and francophone Africa. The work is remote, with missions on site where they add value. Q: Can you work under a donor's procurement rules? A: Yes. We are used to formal public procurement in Switzerland and adapt to the rules of the funding organisation. Q: Do you work in Arabic? A: Yes. Faysal Cherradi is a native Arabic speaker. Workshops and documents can be in Arabic, French or English. Q: Do you work with local partners? A: Yes, where it helps the client. Local partners are named in the proposal. Request a proposal: https://www.bit2boardconsulting.com/request-proposal/?service=international Book a free 30-minute call: https://www.bit2boardconsulting.com/orientation-call/?topic=international ## Enterprise architecture URL: https://www.bit2boardconsulting.com/services/enterprise-architecture/ Enterprise architecture makes your IT landscape understandable and decidable: which capabilities you need, which systems support them, where the risks and redundancies lie, and in what order to change. We assess the maturity of your architecture practice, build the blueprint and roadmap with TOGAF and ArchiMate, and train and coach your architects. A maturity assessment takes 3–4 weeks and starts at CHF 14,000. ### For - CIOs and heads of architecture - Public administrations building or renewing an architecture function - Utilities, insurers and health organisations with grown landscapes ### You need this if - Nobody can say how many applications you run, or which ones you could switch off. - Every project draws its own architecture diagram, in its own notation. - The architecture board approves projects, but has no target picture to approve them against. - A merger, a new law or a cloud strategy forces you to rethink the landscape. - You hired architects, but the role has no method, tools or mandate yet. ### What you get - Maturity assessment: Where your architecture practice stands, measured against a recognised maturity model, with the next three steps. - Capability map and landscape: Business capabilities, applications, data and interfaces in one ArchiMate model. - Target architecture and roadmap: Principles, target picture and a sequenced plan with dependencies and costs. - Architecture governance: Architecture board, review process, templates and architecture decision records that fit your organisation. - Training and coaching: ArchiMate and TOGAF training for your team and coaching of architects on live projects. ### How it works 1. Stakeholder questions (Weeks 1–2): We collect the questions that management, projects and operations need architecture to answer. 2. Assessment (Weeks 2–4): Maturity, landscape and pain points, with a report and recommendations. 3. Blueprint (1–3 months): Target architecture, principles and roadmap, built with your team. 4. Enablement (ongoing): Training, coaching and governance so that the practice continues without us. ### Packages and prices - Maturity assessment — 3–4 weeks — from CHF 14,000: Stakeholder questions, maturity assessment and landscape overview, with a recommended roadmap. - ArchiMate training — 1–3 days — on request: Hands-on ArchiMate workshops for architects and analysts, using your own landscape as material. - Blueprint and roadmap — 1–3 months — fixed price after the assessment: Target architecture, principles, capability map and a sequenced roadmap. - Architect coaching — ongoing — on request: Regular coaching of your architects on live projects and decisions. ### Why Bit2Board - TOGAF 9 certified (2021), with ArchiMate, Sparx Enterprise Architect, architecture decision records, ATAM and CBAM in daily use. - Has run the full sequence for a Swiss energy utility: maturity assessment, ArchiMate training, stakeholder questions, blueprint and coaching of architects. - Lead architect of an e-government platform shared by nine cantons: architecture work under shared and political governance is familiar ground. ### How we use AI - AI helps extract a first landscape model from existing documents, inventories and diagrams, which your experts then correct. - Models stay in your tools and in open formats such as the ArchiMate exchange format, not in ours. ### Questions Q: Do we need TOGAF to do enterprise architecture? A: No. TOGAF is a useful reference, but we use only what your organisation needs. Most clients start with a capability map, a landscape model and a decision process. Q: Which tools do you work with? A: Archi, Sparx Enterprise Architect and other tools that support ArchiMate. We can work in your existing tool or help you choose one. Q: How long until we see results? A: The assessment delivers a usable landscape overview and roadmap within four weeks. A sustainable architecture practice takes six to twelve months to establish. Q: Can you train our team in ArchiMate? A: Yes. The training uses your own landscape as exercise material, so the result is a first version of your model, not just a certificate. Request a proposal: https://www.bit2boardconsulting.com/request-proposal/?service=enterprise-architecture Book a free 30-minute call: https://www.bit2boardconsulting.com/orientation-call/?topic=enterprise-architecture ## Integration architecture: APIs, events and data flows URL: https://www.bit2boardconsulting.com/services/integration-architecture/ Integration architecture decides how your systems exchange data: which interfaces become APIs, which become events, what runs over an integration platform, and who owns each interface. We take stock of your point-to-point landscape, design the target integration architecture and set the interface standards and governance that keep it clean. For CIOs and architecture teams with many interfaces. An integration assessment takes 2–3 weeks and starts at CHF 9,500. ### For - CIOs and heads of architecture with grown application landscapes - Teams replacing ageing middleware or an enterprise service bus - Organisations connecting cloud services, partners or several public bodies ### You need this if - Nobody has a complete list of your interfaces, or knows who owns each one. - Every new system means another point-to-point connection, and every change breaks something. - Your middleware or service bus is out of support, and replacing it feels like open-heart surgery. - Data arrives late, twice or not at all, and each team blames the other. - You are moving to cloud services and must choose between APIs, events and file transfers. - Several organisations have to share data, and each one uses its own formats. ### What you get - Interface inventory: All interfaces with source, target, protocol, data, frequency and owner, in one model. - Target integration architecture: Which integrations become APIs, which become events, what runs on an integration platform, and how security and monitoring work across all of them. - Platform decision: Options for API management, message brokers and integration platforms, compared on cost, skills and lock-in. - Interface standards and governance: Design guidelines, versioning, documentation and ownership rules, with a lightweight review process. - Migration roadmap: The order in which point-to-point connections and legacy middleware are replaced, without a big-bang cut-over. ### How it works 1. Inventory (Week 1): Interfaces, data flows, platforms and owners, collected from documentation, configuration and interviews. 2. Assessment (Weeks 2–3): Risks, bottlenecks and duplicate flows, with a recommended target direction. 3. Target design (4–8 weeks): Integration architecture, platform decision, standards and migration roadmap. 4. Governance (ongoing): Design reviews and coaching, so that new interfaces follow the standards. ### Packages and prices - Integration assessment — 2–3 weeks — from CHF 9,500: Interface inventory, pain points and risks, with a recommended target direction. - Target integration architecture — 4–8 weeks — fixed price after the assessment: Architecture, platform decision, interface standards and migration roadmap. - Integration governance — ongoing — on request: Interface design reviews, an integration board and coaching for your teams. ### Why Bit2Board - Designs the integration of an inter-cantonal e-government platform across API gateway, integration layer, message broker and back-end services. - Hands-on with event-driven architecture, microservices and domain-driven design, and at home on the data side: data models, interface contracts and data quality. - Enterprise architecture methods: interfaces modelled in ArchiMate, decisions recorded as architecture decision records. ### How we use AI - AI helps build the first interface inventory from configuration, code and documentation, which your team then confirms. - AI drafts interface documentation and test cases; the interface owners review and approve them. ### Questions Q: APIs or events? A: Both have their place. APIs suit requests that need an immediate answer; events suit changes that several systems need to learn about. Most landscapes need both, plus a few well-managed file transfers. Q: Do we need an integration platform? A: Not always. A handful of well-designed APIs can be enough. A platform pays off when you manage many interfaces, partners or transformations. The assessment answers this for your situation. Q: Can you help us replace our old service bus? A: Yes. We plan the migration interface by interface, so that old and new run side by side until the last consumer has moved. Q: Do you build the integrations? A: We design, review and steer. Your team or a supplier builds them; we help you select and govern that supplier. Request a proposal: https://www.bit2boardconsulting.com/request-proposal/?service=integration-architecture Book a free 30-minute call: https://www.bit2boardconsulting.com/orientation-call/?topic=integration-architecture ## Identity and access architecture (IAM, OIDC, e-ID) URL: https://www.bit2boardconsulting.com/services/identity-access-architecture/ Identity and access architecture decides who can log in, what they may see and do, and how you prove it to an auditor. We assess your current identity and access management, design the target architecture with Keycloak, Microsoft Entra ID, OpenID Connect and the Swiss state e-ID, and plan the migration, including identities for AI agents. For authorities, portals and regulated companies. An assessment takes 3 weeks and starts at CHF 12,000. ### For - Operators of citizen and customer portals - Authorities preparing for the Swiss state e-ID - Regulated companies with complex role models - Teams introducing AI agents that act on behalf of users ### You need this if - Every application has its own login and its own role model. - You will have to accept the Swiss state e-ID and do not know where it fits in your architecture. - Your identity mapping was built years ago, and nobody wants to touch it. - Auditors ask who had access to what, and the answer takes weeks. - AI agents are about to act on behalf of users, and nobody has defined what they may do. - You are moving from a home-grown identity provider to Keycloak or Entra ID. ### What you get - IAM assessment: Identity sources, protocols, roles, flows and risks, documented as they are today. - Target architecture: Identity providers, federation, token and claims design, authorisation model and levels of assurance. - Migration plan: Steps, coexistence of old and new, and fallback options, without locking users out. - Agent identity concept: How AI agents authenticate, act for users with delegated rights and leave an audit trail. ### How it works 1. Inventory (Week 1): Applications, identity stores, protocols and role models. 2. Assessment (Weeks 2–3): Gaps against security, usability and audit requirements. 3. Target design (4–8 weeks): Architecture, token and claims design and the authorisation model. 4. Migration (per plan): Step-by-step migration, with quality assurance of the implementation. ### Packages and prices - IAM assessment — 3 weeks — from CHF 12,000: Analysis of the current state and its risks, with a recommended target direction. - Target architecture and migration plan — 4–8 weeks — fixed price after the assessment: Detailed target architecture, token and authorisation design, and a migration roadmap. - Agent identity concept — 2–4 weeks — on request: Authentication, delegation and audit design for AI agents that act on behalf of users. ### Why Bit2Board - Designs the access management of an inter-cantonal e-government platform: Keycloak and OpenID Connect, with tokens validated at every hop from the API gateway to the back-end services. - Knows the legacy side too: identity mapping between cantonal systems and external service providers. - Writes architecture that public-sector security experts review, and writes it for that audience. ### How we use AI - AI agents are a new kind of user: we design their identities, rights and audit trails like those of any privileged account. - AI helps analyse role models and access data at scale; access decisions stay with the business owners. ### Questions Q: Keycloak or Microsoft Entra ID? A: It depends on who your users are, where data must reside, licence costs and your team's skills. Many organisations use both: Entra ID for employees and Keycloak for citizens or customers. The assessment compares the options for your case. Q: How do we prepare for the Swiss e-ID? A: By deciding where the e-ID is verified, which level of assurance each service needs, and how a verified identity maps to accounts and roles in your systems. The state e-ID is a verifiable credential held in the swiyu wallet, so verification works differently from a classic federated login. Q: What is agent identity? A: An AI agent acting for a user needs its own identity, limited rights delegated by that user and a record of what it did. Without that, an agent either borrows the user's credentials or cannot work at all. Q: Can you review an implementation by our supplier? A: Yes. We review configuration, token design and code for security and for conformity with the target architecture. Request a proposal: https://www.bit2boardconsulting.com/request-proposal/?service=iam-architecture Book a free 30-minute call: https://www.bit2boardconsulting.com/orientation-call/?topic=iam-architecture ## Solution and software architecture review URL: https://www.bit2boardconsulting.com/services/architecture-review/ An independent review of a solution or software architecture before you commit budget: platform and cloud choices, micro-frontends and microservices, integration, security and operability. We assess the quality attributes that matter to you with recognised methods such as ATAM, CBAM and architecture decision records, and give a clear recommendation. Decision support takes 1 week from CHF 4,800; a full review takes 2 weeks from CHF 9,000. ### For - Project owners and steering committees before a release decision - CIOs choosing a platform or cloud provider - Product and engineering teams that want a second opinion - Authorities assessing a supplier's solution architecture ### You need this if - A supplier's architecture concept is on the table, and the steering committee has to approve it. - Your team is split between two platforms, and the debate has gone on for months. - Performance, availability or security problems keep coming back. - You are about to move into the cloud, or out of it. - The solution architecture milestone of your HERMES project is close. ### What you get - Quality attribute analysis: Performance, availability, security, maintainability and cost, measured against your scenarios. - Risks and trade-offs: Sensitivity points, risks and non-risks, each with its evidence. - Decision record: The decision, the options considered and the consequences, as an architecture decision record. - Recommendation: Approve, approve with conditions, or rework, and what to change. ### How it works 1. Scenarios (Days 1–2): We agree the business goals and the quality scenarios the architecture has to meet. 2. Analysis (Days 2–6): Documents, code samples and interviews with the architects. 3. Workshop (Day 7): Evaluation workshop with stakeholders, following ATAM. 4. Report (Days 8–10): Findings, decision record and recommendation. ### Packages and prices - Decision support — 1 week — from CHF 4,800: One architecture decision analysed, with options, trade-offs and a recommendation. - Architecture review — 2 weeks — from CHF 9,000: Full review of a solution architecture, with evaluation workshop and report. ### Why Bit2Board - Writes and defends architecture specifications for micro-frontends, design systems and identity in a multi-supplier programme, so we know what a reviewable architecture looks like. - Methods rather than opinions: ATAM, CBAM and architecture decision records. - A developer's background in Java EE, C#, Python and Spring Boot: we read code, not only diagrams. ### How we use AI - AI cross-checks architecture documents against each other and against the code, to find inconsistencies quickly. - Risks and trade-offs are rated by people in the workshop, where stakeholders can challenge them. ### Questions Q: How is this different from a security audit? A: A security audit tests for vulnerabilities. An architecture review asks whether the design meets all the qualities you need, security among them, and whether its trade-offs are acceptable. Q: Can you review a supplier's architecture for us? A: Yes, and we stay independent of the supplier. We also check whether the architecture meets the requirements of your tender or contract. Q: What is ATAM? A: The Architecture Tradeoff Analysis Method, developed at the Software Engineering Institute of Carnegie Mellon University. It evaluates an architecture against quality-attribute scenarios agreed with the stakeholders. Q: Do we need the full method? A: Not always. For a single decision, one week of decision support is enough. The full review suits major releases and milestone decisions. Request a proposal: https://www.bit2boardconsulting.com/request-proposal/?service=architecture-review Book a free 30-minute call: https://www.bit2boardconsulting.com/orientation-call/?topic=architecture-review ## IT service management for the AI era (ITIL 4) URL: https://www.bit2boardconsulting.com/services/it-service-management-ai/ AI agents now classify tickets, answer users and propose changes. That changes how IT services must be designed, measured and governed. Using ITIL 4, we assess your readiness and redesign the service model: which work agents may do, under which controls, how people stay accountable and how value is measured. A readiness check takes 2 weeks and starts at CHF 8,500; a service model redesign starts at CHF 40,000. ### For - Heads of IT service management and the service desk - CIOs of public administrations and regulated companies - IT service providers redesigning their offering ### You need this if - Your ITSM tool vendor is switching on AI features, and you have not decided how to use them. - A chatbot answers users, but nobody owns the quality of its answers. - You want agents to resolve routine tickets, but fear errors in production. - Your service level agreements still measure response times that agents make meaningless. - Auditors ask who approved a change that an agent proposed. ### What you get - Readiness check: Practices, data, knowledge base and tools assessed for AI support, with quick wins and risks. - Service model for human and AI work: Which practices and tasks agents perform, under which controls, with human accountability. - Controls and audit trail: Approvals, logging and escalation for agent actions, aligned with your change and security policies. - Value metrics: Measures of outcomes and user experience to replace activity counts. ### How it works 1. Baseline (Week 1): Ticket data, practices, knowledge and tools. 2. Readiness (Week 2): Use cases, risks and quick wins. 3. Redesign (6–12 weeks): Service model, controls and metrics, designed with your service owners. 4. Introduction (per plan): Pilot, measure, then scale. ### Packages and prices - Readiness check — 2 weeks — from CHF 8,500: Assessment of practices, data and tools, with a prioritised list of AI use cases in service management. - Service model redesign — 6–12 weeks — from CHF 40,000: Redesign of the service model, controls, roles and metrics for combined human and AI work. ### Why Bit2Board - ITIL 4 Strategist (Direct, Plan and Improve) and ITIL 4 Specialist (Drive Stakeholder Value), both earned in 2022. - An architect's view: we connect service design with identity, logging and integration, which is where the risks of agents really sit. - Practical experience with AI in our own delivery work. ### How we use AI - We analyse your ticket history with AI to find the work that agents can safely take over. - Every agent capability we recommend comes with a human owner and a way to switch it off. ### Questions Q: Do we need ITIL to use AI in IT services? A: No, but the ITIL 4 view of value streams helps decide where agents add value and where they add risk. Q: Which ITSM tools do you work with? A: The approach does not depend on the tool. We work with the platform you have, for example ServiceNow, Jira Service Management or TOPdesk. Q: What about data protection? A: Tickets often contain personal data. We define what agents may read, where data is processed and how long logs are kept, in line with the Swiss Data Protection Act and the GDPR. Q: How do we know the agents are doing a good job? A: Through quality sampling, user feedback and outcome metrics agreed before go-live, plus clear rules for when an agent must hand over to a person. Request a proposal: https://www.bit2boardconsulting.com/request-proposal/?service=ai-service-management Book a free 30-minute call: https://www.bit2boardconsulting.com/orientation-call/?topic=ai-service-management ## Industries URL: https://www.bit2boardconsulting.com/industries/ Technology problems look different in a trading house, a pharma company or a canton. These are the industries in which Faysal Cherradi has worked, the situations we meet there, and the services that fit. ### Public administration and social insurance Federal offices, cantons, communes and social insurance institutions run long projects under HERMES and procurement law, with several suppliers and many stakeholders. - A study or concept has to pass the next phase release. - An IT tender must be prepared under BöB or IVöB. - Several cantons or offices share a platform and its governance. - Citizens and businesses should log in with the state e-ID. Services that fit: HERMES documentation conformity review; IT procurement and tender preparation (BöB, IVöB); Vendor and contract governance after award; Identity and access architecture (IAM, OIDC, e-ID) Experience: lead architect of an inter-cantonal e-government platform; Swiss federal IT projects with budgets up to CHF 6 million; supervision of a modernisation programme of more than CHF 12 million in invalidity insurance. ### Energy and utilities Utilities run grown landscapes in which grid, metering, customer and billing systems meet operational technology, under regulation and steady cost pressure. - Nobody can explain the application landscape from end to end. - The architecture function needs a method, a model and a mandate. - Interfaces between metering, billing and customer systems keep breaking. Services that fit: Enterprise architecture; Integration architecture: APIs, events and data flows; Solution and software architecture review Experience: enterprise architecture for a Swiss energy utility: maturity assessment, ArchiMate training, EA blueprint and coaching of architects. ### Pharma and life sciences In pharma and life sciences, computerised systems that hold GxP data must stay validated, and their records must remain complete, unchanged and readable for years, including after a system is retired. - A validated system must be connected to new platforms without breaking data integrity. - An AI feature in a product or process has to be classified and documented under the EU AI Act. - Data integrity findings point to fragile interfaces and manual workarounds. Services that fit: EU AI Act readiness and technical documentation; Integration architecture: APIs, events and data flows; Solution and software architecture review Experience: work on validated systems in life sciences, including user acceptance testing and reporting with the client's teams. ### Commodity trading Trading houses run specialised trading and risk systems, buy and sell business units, and must keep trade and accounting records for auditors and tax authorities long after a system has changed hands. - After a carve-out, you must leave the seller's trading system before the transitional service agreement ends. - A trading or risk platform decision needs an independent second opinion. - Interfaces between trading, logistics and finance systems are fragile. Services that fit: Integration architecture: APIs, events and data flows; Technical due diligence for software acquisitions; Solution and software architecture review Experience: a carve-out project for a commodity-trading system used in two countries, completed before the transitional service agreement ended. ### Manufacturing and industry Manufacturers modernise ERP and production systems in waves, and every wave leaves old systems, interfaces and data behind. - A new ERP and older production systems have to work together during the transition. - Production, ERP and logistics systems are connected point to point. - An acquisition or a sale needs a plan to integrate or separate the IT. Services that fit: Integration architecture: APIs, events and data flows; Enterprise architecture; Fractional CTO and interim technology leadership Experience: two hands-on ERP introduction projects for manufacturers of rail vehicles and industrial equipment. ### Software companies and their buyers Owner-managed software companies change hands as founders retire. Buyers, investors and lenders need to know what the code, the team and the customer contracts are really worth, and who will lead the technology afterwards. - You are about to buy a software company and only have the seller's presentation. - The founder is the only one who understands the code. - After the acquisition, nobody leads the technology. Services that fit: Technical due diligence for software acquisitions; Fractional CTO and interim technology leadership; Solution and software architecture review Experience: 18 years in software, from developer and architect to team lead of software consulting; software risk assessment and cost and productivity analysis as a transformation consultant. ## EU AI Act after the Digital Omnibus: what Swiss companies must do, and by when URL: https://www.bit2boardconsulting.com/insights/eu-ai-act-digital-omnibus-swiss-companies/ Published: 2026-10-11 The Digital Omnibus on AI, Regulation (EU) 2026/1744, has been in force since 27 July 2026. It moves the high-risk obligations to 2 December 2027 for Annex III systems and to 2 August 2028 for AI in regulated products, but leaves the prohibitions, the transparency duties and the reach beyond the EU in place. Swiss companies that sell AI into the EU should use the extra time to classify, document and test, not to wait. ## What changed, and what did not The Omnibus is a targeted amendment of the AI Act, Regulation (EU) 2024/1689. Most of the regulation stays as it was. These are the dates that matter now: | Obligation | Before the Omnibus | After the Omnibus | |---|---|---| | Prohibited practices (Article 5) | since 2 February 2025 | unchanged; two new prohibitions, on non-consensual intimate imagery and child sexual abuse material, from 2 December 2026 | | AI literacy (Article 4) | duty to ensure sufficient AI literacy, since 2 February 2025 | softened to a duty to take measures that support AI literacy | | Transparency (Article 50) | from 2 August 2026 | unchanged; for generative systems already on the market before 2 August 2026, machine-readable marking of output from 2 December 2026 | | High-risk systems, Annex III | from 2 August 2026 | from 2 December 2027 | | High-risk AI in regulated products, Annex I | from 2 August 2027 | from 2 August 2028 | | Fines for smaller companies (Article 99) | lower of the two amounts for SMEs | lower amount also for small mid-cap companies | The postponement buys time for the high-risk requirements, nothing else. Transparency duties already apply: if your system talks to people, generates synthetic content or recognises emotions, the disclosure rules of Article 50 are in force today. ## Why Swiss companies are affected Switzerland is not in the EU, but the AI Act reaches across the border. Under Article 2 it applies to: - providers that place AI systems on the EU market or put them into service in the EU, wherever they are established; - providers and deployers established outside the EU, where the output of the AI system is used in the EU. A Swiss software company that sells to EU customers, or whose scoring results are used by an EU client, is therefore within scope. Switzerland itself has no AI-specific law yet. On 12 February 2025 the Federal Council decided to ratify the Council of Europe's AI convention and to regulate AI mainly through targeted changes in existing sectoral law. The Federal Department of Justice and Police is to present a consultation draft by the end of 2026. For companies selling into the EU, the AI Act will remain the stricter benchmark. ## Is your system high-risk? There are two routes into the high-risk category: 1. **Annex I:** the AI system is a safety component of a product, or is itself a product, covered by EU product legislation such as the rules on machinery, medical devices or toys. 2. **Annex III:** the system is used in one of the listed areas: biometrics; critical infrastructure; education and vocational training; employment and the management of workers; access to essential private and public services, such as credit scoring, risk pricing in life and health insurance, or eligibility for public benefits; law enforcement; migration, asylum and border control; and the administration of justice and democratic processes. Article 6(3) exempts Annex III systems that do not pose a significant risk, for example when they only perform a narrow procedural task or improve the result of a human activity already completed. The exemption never applies when the system profiles natural persons, and the provider has to document the assessment before placing the system on the market. Your role matters as much as the system. **Providers**, who develop a system and place it on the market under their name, carry most of the obligations. **Deployers**, who use a system in their own activity, have their own duties under Article 26, and some public bodies and service providers must carry out a fundamental-rights impact assessment under Article 27. ## What high-risk providers need in place - a risk management system across the whole life cycle (Article 9); - data governance for training, validation and test data (Article 10); - technical documentation following Annex IV (Article 11); - automatic logging of events (Article 12); - instructions and transparency for deployers (Article 13); - human oversight designed into the system (Article 14); - accuracy, robustness and cybersecurity (Article 15); - a quality management system (Article 17); - conformity assessment, EU declaration of conformity, CE marking and registration (Articles 43, 47, 48 and 49); - post-market monitoring (Article 72). None of this is a document you write at the end. Logging, oversight and data governance are design decisions, which is why a late start costs more than the documentation itself. ## A 14-month plan to December 2027 1. **By the end of 2026: inventory and classification.** List every AI system and general-purpose model you build or use, your role for each, and its risk class. Check the Article 50 transparency duties now, because they already apply. 2. **First quarter of 2027: gap assessment.** Compare each high-risk system with Articles 9 to 17, estimate the effort and appoint owners. 3. **Second and third quarters of 2027: build.** Risk management, data governance, logging, human oversight and the quality management system, followed by the Annex IV documentation. 4. **Fourth quarter of 2027: prove it.** Run a dry run of the conformity assessment, prepare the declaration of conformity and registration, and set up post-market monitoring. Companies with AI in regulated products have until August 2028, but their conformity assessment usually runs through a notified body under sectoral law. That timetable tends to be longer than it looks. ## What it costs to get it wrong Fines reach EUR 35 million or 7% of worldwide annual turnover for prohibited practices, and EUR 15 million or 3% for most other obligations, including the high-risk requirements. For SMEs and, since the Omnibus, small mid-caps, the lower of the two amounts applies. In practice, the commercial risk comes sooner: EU customers are already asking about AI Act conformity in tenders. If you are not sure whether the AI Act applies to you, an [applicability and gap assessment](https://www.bit2boardconsulting.com/services/eu-ai-act-compliance/) answers that in three to four weeks. Sources: - Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (AI Act), EUR-Lex: https://eur-lex.europa.eu/eli/reg/2024/1689/oj - EU Digital Omnibus on AI enters into force, The National Law Review: https://natlawreview.com/article/eu-digital-omnibus-ai-enters-force - Digital Omnibus on AI: what changed, euaiact.com: https://www.euaiact.com/digital-omnibus-ai - Federal Council decision on the regulation of AI, 12 February 2025, admin.ch: https://www.admin.ch/de/nsb?id=104110 - Künstliche Intelligenz, Federal Office of Justice: https://www.bj.admin.ch/de/kuenstliche-intelligenz ## Six reasons HERMES documents fail review, and how to make them audit-ready URL: https://www.bit2boardconsulting.com/insights/hermes-documents-audit-ready/ Published: 2026-10-11 Most HERMES documents do not fail review because a chapter is missing. They fail because they cannot carry the decision they were written for: the study compares no real options, the concept contradicts the architecture, or the plan has no measurable acceptance. Here are six patterns that come up again and again, what HERMES 2022 actually requires, and practices that get documents through phase releases and audits. ## What HERMES 2022 expects HERMES is the project management method of the Swiss federal administration. The Federal Chancellery publishes it as an open standard, recognised by the eCH association as eCH-0054, and many cantons, communes, educational institutions and companies use it as well. Three features of the method decide how your documents are judged: - **Results are at the centre.** HERMES describes a project through its results. A set of *minimum required documents* serves project governance and cannot be removed by tailoring. - **Decisions structure the project.** Releases such as the project initiation release, the execution release and the phase releases are decisions taken on the basis of documents, mostly by the project's client, the *Auftraggeber*. In the agile approach, an optional release decision per release can be added. - **Tailoring is allowed, but must be deliberate.** HERMES 2022 offers standard scenarios such as IT development and IT adaptation, and allows modules, results and tasks to be removed or added, apart from the minimum required documents. The tailoring itself has to be recorded. The classic approach runs through the phases initiation, concept, realisation, deployment and closure; the agile approach through initiation, implementation and closure. ## Six patterns that send documents back **1. The study has only one option.** A study that describes the preferred solution in detail gives the steering body nothing to decide. Reviewers expect real alternatives, including doing nothing, compared on the same criteria. **2. Requirements cannot be tested.** "User-friendly", "performant" and "secure" cannot be accepted or rejected. Each requirement needs a criterion that a test can check, or it will come back at acceptance as a dispute. **3. Documents contradict each other.** The study assumes one architecture, the concept another, and the tender a third. Each document reads well on its own, which is why the contradiction is often found only in an audit. **4. The plan has no acceptance.** Milestones without acceptance criteria and responsibilities turn every acceptance into a negotiation. HERMES provides for acceptance and, where useful, a preliminary acceptance; the criteria belong in the plan, not in the last week. **5. Risks are listed, not managed.** A risk register without owners, measures and dates is an inventory, not risk management. HERMES expects quality and risk to be reported to the steering body, and reviewers check whether measures have actually been taken. **6. Tailoring is not documented.** A missing result is acceptable if the tailoring decision is recorded and justified. Without that record, the same gap looks like an omission. ## Practices that make documents audit-ready - **Write for the decision.** Open each document with the decision it supports, the options and the recommendation, on one page. - **Trace requirements.** Give requirements identifiers and follow them from the study to the tender, the concept and the tests. - **Keep one source of truth.** Terms, figures and assumptions belong in one place that every document refers to. - **Record tailoring in the project management plan,** with a short reason for each change. - **Review across documents,** not only within them. Most findings sit between documents. - **Involve the business representative.** In HERMES, the user representative carries the business responsibility for the solution; their sign-off of content carries weight with reviewers. One more change is worth knowing: from 1 January 2027, SAQ takes over HERMES certification from TÜV SÜD. If a phase release is coming up, a [HERMES quick check](https://www.bit2boardconsulting.com/services/hermes-documentation-review/) reviews one document against HERMES 2022 and your reviewers' criteria in five working days. Sources: - HERMES project management method, Federal Chancellery: https://www.bk.admin.ch/bk/en/home/digitale-transformation-ikt-lenkung/hermes_projektmanagementmethode.html - HERMES Projektmanagement, edition 2022, reference manual (PDF): https://hermes.admin.ch/_Resources/Persistent/a/e/5/1/ae510c5ad674c569b4cfb07eadbec9a7eaa17f6d/HERMES_PjM2022_DE.pdf ## Buying a Swiss software company: twelve technical questions to answer before you sign URL: https://www.bit2boardconsulting.com/insights/technical-due-diligence-swiss-software-sme/ Published: 2026-10-11 About 100,000 Swiss companies were looking for a successor in 2024, and software firms are among the hardest to judge from the outside. These twelve questions cover what a seller's presentation leaves out: who really understands the code, what is out of support, which licences and contracts bind you, and what it costs to fix. Each answer should end up in the price, the purchase agreement or the 100-day plan. Small software companies change hands for the same reason as other SMEs: the founder wants to retire or move on. According to figures published on the SME portal of the Swiss Confederation, about 101,000 companies were looking for a successor in 2024. For a buyer, a software company has a particular trap: most of its value sits in code, in a few people's heads and in customer contracts, none of which appear in the financial statements. These are the twelve questions we would want answered before you sign. ## Product and code **1. Who can change the code tomorrow?** Count the people who could fix a critical bug in production without the founder. If the answer is one, the key-person risk belongs in the price and in a transition agreement with the seller. **2. What is out of support?** List frameworks, runtimes, databases and operating systems with their support dates. A product built on AngularJS, for example, has been on a framework without official support since January 2022. Out-of-support components mean security exposure today and a rewrite tomorrow, and the rewrite has a price. **3. How much is built for individual customers?** Customer-specific branches, modifications and versions multiply maintenance cost. Ask how many versions are in production, and how far the oldest is behind. **4. Can the product be built and released without its author?** A documented, automated build and deployment pipeline is the difference between owning software and owning a dependency on one person's laptop. ## Security and compliance **5. When was the last security test, and what happened to its findings?** A penetration test report with open critical findings is a liability. No report at all is a question you have to answer yourself. **6. Is personal data handled lawfully?** The revised Swiss Data Protection Act has applied since 1 September 2023, and EU customers bring the GDPR. Check where data is stored, who processes it on whose behalf, and whether the processing agreements exist. **7. Which open-source licences are in the product?** Copyleft licences can oblige the owner to publish source code or restrict how the product is distributed. A dependency scan answers the question in hours; ignoring it can cost a deal. **8. Which regulatory changes will hit your customers?** Software follows its customers' obligations. If the product issues invoices for German customers, for example, it must handle structured e-invoices: in Germany, all businesses have had to be able to receive them since 1 January 2025, and issuing becomes mandatory from 2027 for larger companies and from 2028 for all. If the product uses AI, the EU AI Act may apply as well. ## Operations and customers **9. Where does it run, and who could run it without the founder?** Hosting, backups, restore tests, monitoring and on-call duty. Ask when a restore was last tested, not whether backups exist. **10. What do the customer contracts promise?** Service levels, liability, source-code escrow and change-of-control clauses. A change-of-control clause can let key customers walk away when you take over. **11. What is the revenue made of?** Licences, maintenance, hosting and custom development behave very differently. Recurring maintenance revenue from a shrinking base of old installations is worth less than it looks. ## Team and plan **12. What will the next three years of development cost?** Compare the roadmap with the team that is supposed to deliver it. If the plan needs people who do not exist yet, the cost of hiring them belongs in your business plan. ## Turning answers into price, terms and plan Findings are only useful if they change something in the deal: - **Price:** deduct the estimated cost of known fixes, such as a framework migration or security remediation. - **Purchase agreement:** ask for specific warranties and indemnities, for example on open-source compliance and on known security incidents, and consider a source-code escrow. - **Transition:** tie part of the price to the seller's knowledge transfer, with defined deliverables rather than a number of days. - **100-day plan:** put the remaining findings into the first plan after closing, with owners and budget. A [red-flag scan](https://www.bit2boardconsulting.com/services/technical-due-diligence/) answers the most important of these questions in five working days, before you commit to exclusivity. Sources: - KMU in Zahlen: Nachfolgeregelungen, SME portal of the Swiss Confederation (SECO): https://www.kmu.admin.ch/de/kmu-in-zahlen-nachfolgeregelungen - AngularJS version support status: https://docs.angularjs.org/misc/version-support-status - Data protection: legal basis, Federal Office of Justice: https://www.bj.admin.ch/bj/en/home/staat/datenschutz/rechtsgrundlagen.html - Germany's e-invoicing mandate 2025–2028, ADVISORI: https://www.advisori.de/en/blog/e-invoicing-mandate-germany