·LEGAL

Terms & Conditions

Version 02.00 · As of: 29 September 2026 · Applicable to all services of GermanAI Defense GmbH for businesses and public-sector clients. Translation provided for reference only. The German version is legally binding.

Part A. General provisions

§ 1 Scope

  1. These General Terms and Conditions (T&C) apply to all offers, services and contracts of GermanAI Defense GmbH, Neue Mainzer Straße 6-10, 60311 Frankfurt am Main, Germany (hereinafter “GAD”).
  2. They apply in particular to the following types of service:
    • Cybersecurity services, in particular penetration tests, vulnerability assessments, red teaming and Security Operations Center (SOC)
    • Governance, risk and compliance (GRC) consulting, in particular information security management systems (ISMS), data protection, NIS 2 and the EU AI Act
    • Development, testing and analysis of AI applications (AI Solutions)
    • Provision and operation of software, in particular Medical Intelligence Recording Assistant, RedMentis and StockMentis
    • Services for data center projects (requirements capture, project management, coordination of certified partners, security services)
    • GAD Academy training courses
  3. The Special Provisions in Part B additionally apply to individual types of service. In the event of conflict, the following order of precedence applies: (1) individual contract or order confirmation, (2) service description, (3) Part B, (4) Part A.
  4. Businesses only. Our offers are directed exclusively at entrepreneurs within the meaning of § 14 BGB (German Civil Code), legal entities under public law and special funds under public law (§ 310 (1) BGB). We do not enter into contracts with consumers. By making a request or order, the customer confirms that it is acting in the course of its commercial or independent professional activity or as a public-sector client.
  5. Deviating or supplementary terms of the customer do not become part of the contract, even if GAD does not expressly object to them or performs services in knowledge of such terms. This does not apply where GAD expressly agrees to their validity in text form.

§ 2 Conclusion of contract

  1. Content on the website, in particular prices, packages and the “Request a quote” function, does not constitute a binding offer. A request via the website is an invitation to GAD to submit an offer.
  2. GAD's offers are non-binding unless they are expressly designated as binding or contain an acceptance period.
  3. A contract is concluded by signing a contract, by GAD's order confirmation in text form (e.g., email) or by commencement of performance.
  4. The scope of services is determined solely by the offer, the service description and the order confirmation. Side agreements and amendments require text form.

§ 3 Performance of services

  1. GAD performs its services with due care and in accordance with the state of the art recognized at the time the contract is concluded.
  2. Unless a specific result (work performance) has been expressly agreed, GAD provides services and owes their professional performance, not a specific economic or technical result.
  3. GAD only owes response times, service hours and availability to the extent they are set out in the individual contract or a service level agreement (SLA).
  4. Complete security of IT systems cannot be achieved according to the state of the art. GAD therefore does not warrant that all vulnerabilities will be found or all attacks detected or prevented, unless this is expressly agreed as a guarantee. Liability for culpable breaches of duty under § 8 remains unaffected.
  5. GAD may use qualified subcontractors. GAD remains responsible to the customer for their services. Where subcontractors process personal data of the customer, the rules of the data processing agreement apply.
  6. Where GAD uses AI-supported tools, this is done in a supporting role and under the professional control of GAD staff.

§ 4 Customer's obligations to cooperate

  1. The customer provides, in good time and free of charge, all information, documents, systems, access and premises that GAD needs to perform the service.
  2. The customer appoints a competent contact person who can make decisions or obtain them at short notice.
  3. The customer backs up its data and systems at reasonable intervals, and in any case before any interventions in systems agreed with GAD begin.
  4. The customer ensures that it is entitled to provide data, software and system access to GAD and that this does not infringe any third-party rights.
  5. If the customer fails to meet its obligations to cooperate, or does so late or incompletely, agreed dates are postponed appropriately. GAD may invoice the resulting additional effort at the agreed rates.

§ 5 Prices and payment

  1. The prices stated in the offer or order confirmation apply. All prices are net plus statutory VAT.
  2. Travel and incidental expenses are charged separately where agreed.
  3. Invoices are payable without deduction within 14 days of receipt. Time-and-materials services are invoiced monthly; recurring services (e.g., SOC, software) are invoiced in advance for the agreed billing period.
  4. In the event of late payment, the statutory provisions apply (§ 288 BGB).
  5. The customer may only set off undisputed or legally established claims. This does not apply to counterclaims arising from the same contractual relationship, in particular due to defects.

§ 6 Acceptance and defects for work performances

  1. Where a work performance has been agreed (e.g., the development of an AI application), the customer accepts the result if it essentially corresponds to the service description. Insignificant defects do not entitle the customer to refuse acceptance. Upon completion, GAD provides the result and requests the customer to accept it within a period of 14 days. The result is deemed accepted if the customer does not refuse acceptance within this period by stating at least one defect (§ 640 (2) BGB). When setting the period, GAD informs the customer of this consequence in text form.
  2. In the event of defects, GAD first provides subsequent performance at its choice by remedying the defect or producing a new result. If subsequent performance fails, the customer may reduce the price or withdraw in accordance with the statutory provisions or claim damages subject to § 8.
  3. Claims for defects become time-barred twelve months after acceptance. This does not apply to claims based on intent or gross negligence, fraudulent concealment of a defect, the scope of a guarantee given, damage resulting from injury to life, body or health, claims under the Product Liability Act, or where the law mandatorily provides for longer periods. In these cases the statutory periods apply.

§ 7 Rights to work results

  1. Upon full payment, the customer receives a non-exclusive, perpetual, non-transferable right to use the work results created for it (e.g., reports, concepts, documentation) for its own internal purposes. Disclosure to supervisory authorities, auditors, insurers and affiliated companies of the customer is permitted.
  2. Pre-existing tools, software, methods, templates and GAD's general know-how remain the property of GAD. GAD may continue to use this knowledge without disclosing confidential information of the customer.
  3. Further rights, in particular to individually developed software and AI models, are governed by the individual contract. Part B § 4 applies to GAD software.

§ 8 Liability

  1. GAD is liable without limitation
    • for intent and gross negligence,
    • for damage resulting from injury to life, body or health,
    • under the German Product Liability Act (ProdHaftG),
    • for fraudulent concealment of a defect and
    • to the extent of an expressly assumed guarantee.
  2. In the case of simple negligence, GAD is only liable for breach of a material contractual obligation. A material obligation is one whose fulfilment makes the proper performance of the contract possible in the first place and on whose observance the customer may regularly rely (cardinal obligation). In this case, liability is limited to the damage typical for the contract and foreseeable at the time the contract was concluded.
  3. Otherwise, liability for simple negligence is excluded.
  4. In cases of simple negligence (para. 2), GAD is liable for loss of data only in the amount of the effort that would have been required to restore it had the customer backed up its data properly and regularly (§ 4 (3)). This does not apply where data backup is GAD's responsibility under the individual contract. Para. 1 remains unaffected.
  5. The parties may agree a maximum liability amount for cases under para. 2 in the individual contract. Para. 1 remains unaffected.
  6. The above provisions also apply in favour of GAD's corporate bodies, employees and vicarious agents.
  7. These provisions do not change the burden of proof to the detriment of the customer.

§ 9 Force majeure

  1. Neither party is liable for non-performance or delayed performance to the extent it is due to events beyond its control that were not foreseeable when the contract was concluded (e.g., natural disasters, pandemics, official orders, large-scale failures of power or communication networks). The affected party informs the other without undue delay.
  2. If such an event lasts longer than 60 days, either party may terminate the affected contract in text form.

§ 10 Data protection

  1. Both parties comply with the applicable data protection regulations, in particular the GDPR.
  2. Where GAD processes personal data on behalf of the customer, the parties conclude a data processing agreement under Art. 28 GDPR before processing begins.

§ 11 Confidentiality

  1. The parties treat all information of the other party that is not publicly known, in particular information about vulnerabilities, system architectures, access credentials and trade secrets, as confidential and use it only to perform the contract.
  2. This does not apply to information that is publicly known without breach of contract, was already lawfully known to the receiving party or must be disclosed due to a legal or official obligation. In the latter case, the disclosing party informs the other party to the extent legally permitted.
  3. The confidentiality obligation continues for five years after the end of the contract, and without time limit for trade secrets and information about vulnerabilities.
  4. GAD may only name the customer as a reference with the customer's prior consent in text form.

§ 12 Term and termination

  1. The contract term results from the respective contract.
  2. Unless otherwise agreed, contracts for recurring services concluded for an indefinite period may be terminated by either party with 30 days' notice to the end of a month.
  3. The right to extraordinary termination for good cause remains unaffected.
  4. Notices of termination require text form.

§ 13 Final provisions

  1. The law of the Federal Republic of Germany applies, excluding the UN Convention on Contracts for the International Sale of Goods (CISG).
  2. If the customer is a merchant, a legal entity under public law or a special fund under public law, the exclusive place of jurisdiction is Frankfurt am Main. GAD may also sue the customer at its general place of jurisdiction.
  3. Should individual provisions be or become invalid, the remainder of the contract remains valid. The invalid provision is replaced by the statutory provisions (§ 306 (2) BGB).

Part B. Special provisions for individual types of service

§ 1 Penetration tests and other security tests

This section applies to penetration tests, vulnerability assessments, red teaming, social engineering tests and test runs with RedMentis (hereinafter “security tests”).

  1. Written authorization. Security tests deliberately access systems. Without authorization, such acts may be criminal offences under German law (§§ 202a to 202c, 303a, 303b StGB). GAD therefore only starts a security test once the customer has given its approval in writing or text form. The approval sets out at least: the target systems (IP addresses, domains, applications, locations), the permitted test types, the test window and an emergency contact at the customer who is reachable during the test.
  2. Customer's authority. The customer warrants that it is entitled to dispose of the target systems. Where target systems belong wholly or partly to third parties or are operated by third parties (e.g., hosting or cloud providers, data centers, affiliated companies, IT service providers), the customer obtains their consent before the test begins, where required, and provides evidence of it to GAD on request. GAD only performs social engineering tests if the customer confirms that employment and data protection requirements (e.g., involvement of the works council) are met.
  3. Indemnity. If the warranty under no. 2 proves incorrect and the customer is responsible for this, the customer indemnifies GAD against third-party claims and the costs of an appropriate legal defence.
  4. Scope. GAD tests only the approved systems within the agreed test window. Changes to the scope require a new approval in text form. If GAD discovers during the test that a system may not be part of the approved scope, GAD suspends testing of that system and consults the customer.
  5. Test types. Depending on the agreement, GAD tests without prior knowledge (black box), with partial information (grey box) or with full insight (white box). GAD uses manual and automated methods.
  6. Risks and precautions. Despite careful execution, security tests may lead to performance degradation, service interruptions, system failures or data changes. GAD agrees risky test steps with the customer in advance and carries them out in a test environment or within an agreed time window. Before the test begins, the customer backs up the affected data and systems (Part A § 4 (3)) and informs GAD about particularly critical or sensitive systems. Impairments that occur as a typical consequence of the approved test activities despite compliance with the agreed precautions do not constitute a breach of duty by GAD. Otherwise, Part A § 8 applies.
  7. Report. On completion, the customer receives a report with the vulnerabilities identified, a risk assessment and recommendations. The report reflects the status at the time of testing.
  8. Handling of findings. GAD reports vulnerabilities found exclusively to the customer. If a vulnerability affects a third-party product, GAD only informs the manufacturer or a competent authority (e.g., the BSI) after consulting the customer. Statutory reporting obligations remain unaffected. GAD deletes access credentials and test data after completion of the engagement unless a retention obligation applies.

§ 2 Security Operations Center (SOC)

  1. GAD monitors the data sources and systems agreed in the individual contract. Detection is limited to the data that the customer connects and provides.
  2. Service hours, response times and escalation paths are set out in the individual contract or SLA.
  3. GAD only takes measures in the customer's systems (e.g., isolating an endpoint, locking an account) to the extent agreed in advance or after approval by the customer.

§ 3 AI development, AI testing and AI analyses

  1. Results of AI systems are based on probabilities and may be incomplete or incorrect. The customer reviews results before any use that affects individuals or business operations. Decisions with legal or similarly significant effects must not be based solely on automated results.
  2. The customer warrants that it is entitled to use the data it provides for training, testing or analysis. If the data contains personal data, Part A § 10 applies.
  3. The parties set out their roles under the AI Regulation (EU) 2024/1689, in particular who is the provider and who is the deployer of an AI system, and the resulting obligations in the individual contract. In the absence of such a provision, the customer is the deployer of the system used by it.
  4. Where the development of an AI application has been agreed as a work performance, Part A § 6 applies.

§ 4 Software (Medical Intelligence Recording Assistant, RedMentis, StockMentis)

  1. GAD provides software either as an online service (software as a service) or for installation at the customer's premises. The form of provision, functionality, number of users and term are governed by the individual contract.
  2. For the term of the contract, the customer receives a non-exclusive, non-transferable and non-sublicensable right to use the software to the agreed extent for its own purposes. Modification, decompilation or disclosure is only permitted where mandatorily allowed by law (§§ 69d, 69e UrhG).
  3. GAD only owes availability and maintenance windows to the extent agreed in the individual contract. GAD announces planned maintenance in good time.
  4. Software outputs are suggestions and indications. Professional review and decisions remain with the customer. Part B § 1 additionally applies to test runs with RedMentis.
  5. The customer is responsible for the content it enters into the software and keeps its access credentials secret.
  6. After the end of the contract, GAD provides the customer with its stored data in a common format upon request made within 30 days, and then deletes it unless a retention obligation applies.

§ 5 Data center projects

  1. GAD does not build or operate data centers itself. GAD captures the customer's requirements, manages the project, selects and coordinates certified partners and provides security services, in each case to the extent of the individual contract.
  2. Planning, construction, supply of equipment and operation are provided by the partners on the basis of their own contracts with the customer, unless otherwise agreed in the individual contract. The respective partner is responsible for these services.
  3. GAD is liable under Part A § 8 for its own obligations, in particular the careful selection of partners and the agreed project management.
  4. Performance figures (e.g., energy efficiency, capacity) are planning values unless expressly agreed as a warranted characteristic.

§ 6 GAD Academy training courses

  1. Registration. Registration is made via the request function on the website, by email or in writing. The contract is concluded upon GAD's confirmation in text form. Training courses take place as live online training, in-house workshops or executive briefings.
  2. Fees. Fees are due upon invoicing, but no later than before the start of the course, unless otherwise agreed. They include the course materials and the certificate of attendance, plus agreed travel expenses for in-house workshops.
  3. Cancellation by the customer. The customer may cancel in text form. The date of receipt by GAD is decisive. The following cancellation fees apply, based on the agreed fee:
    • up to 30 days before the start of the course: free of charge
    • 29 to 15 days before the start of the course: 50%
    • from 14 days before the start of the course or in case of non-attendance: 100%
    Non-refundable travel costs already incurred are borne by the customer. The customer is expressly permitted to prove that GAD has suffered no damage or damage significantly lower than the respective flat rate, in particular because GAD has saved expenses or reallocated the place. Instead of cancelling, the customer may name a substitute participant (no. 5).
  4. Rebooking. Up to 15 days before the start of the course, the customer may rebook once free of charge to another date, where available. Later rebookings are treated as cancellations under no. 3.
  5. Substitute participants. The customer may name another person from its organization at no additional cost up to the start of the course.
  6. Cancellation or change by GAD. GAD may cancel or postpone a course for good cause, in particular due to illness of the trainer, force majeure or, for courses with participants from several organizations, if the minimum number of participants stated in the offer is not reached. GAD informs the customer without undue delay and offers an alternative date. If the customer does not accept the alternative date, GAD refunds fees already paid in full. Further claims, in particular for reimbursement of the customer's travel and cancellation costs, only exist under Part A § 8.
  7. Certificate of attendance. Participants receive a GAD certificate of attendance, on request with a note of the result of an optional knowledge test. The certificate of attendance is not an official, state-recognized or accredited certification and not a personnel certification. It confirms attendance and, where applicable, the test result.
  8. Materials and recordings. Participants may use the course materials for the customer's internal purposes. Disclosure to third parties or publication is not permitted. Live online training may only be recorded by prior agreement.
  9. Technology. For live online training, the customer ensures suitable technical equipment and internet connection for the participants. For in-house workshops, the customer provides a suitable room and the agreed equipment.

Version 02.00 · public · As of 29 September 2026. This version replaces version 01.01 of 1 March 2026, including Annex 1 (Penetration Testing Services), whose content has been incorporated into Part B § 1. For contracts already concluded, the version agreed at the time of conclusion applies.