Statutory inspection, certificate and deadline tracker for SMBs

Almost every German company must prove that devices, buildings, vehicles and people are inspected, certified or trained on time: electrical checks, lifts, drinking water, medical devices, company vehicles, first-aider and nursing qualifications, tax deadlines. In small firms this lives in Excel, in a binder and in one employee's head. This tracker reads the protocols and certificates, derives the next due date from a rule table, books the inspector, nags the right person and files the proof. It is not clever AI; it is a reliable rules calendar with document extraction on top. That is why it works today, and why it appears in more business types than almost any other candidate.

Problem & value

• Today: the operator (Betreiber) is responsible, not the inspector. Protocols arrive as PDFs or paper, due dates are typed into spreadsheets, and the person who knew the system leaves. Typical failures: expired certificates found during an audit, a missed Legionella test, a vehicle without valid inspection, a medical device without safety check, an appointment booked too late.
• AI value: (1) extraction of the date, interval, findings and inspector from unstructured protocols, (2) mapping each object to its legal basis and interval, (3) drafting bookings and reminders, (4) one searchable evidence archive for audits and insurers.
• Who needs it (from the Mittelstand process analysis of 12 business types, 6 of which need it): arztpraxis (hygiene and device logs, ~6 h/month), hausverwaltung (statutory inspections, ~6 h), hotel (maintenance and inspection cycles, ~5 h), shk-handwerk (vehicle checks, UVV, TÜV, ~2 h), pflegedienst (qualifications and certificates, ~3 h), steuerkanzlei (deadline monitoring, ~5 h). The hours per firm are modest; the value is in avoided liability, fines and downtime, and in the fact that one tool serves very different trades.
• Honest sizing: no hard study on time saved exists for this exact tool class. The savings range in the front matter is an estimate for the administrative part (finding, tracking, reminding, filing), not for the inspection itself.

Variants

• Arztpraxis: device inventory (Bestandsverzeichnis) and safety checks (STK) under MPBetreibV, hygiene and sterilisation logs, staff certificates (radiation protection, hygiene).
• Hausverwaltung: drinking-water tests, electrical systems, lifts, fire protection, heating (BImSchV chimney sweep), per property; deadlines are passed to owners and service companies.
• Hotel: fire protection, lifts, pools, kitchen (HACCP) and legionella, often with sensor-based temperature logs as evidence.
• Handwerk (e.g. SHK): vehicle inspection (HU), UVV checks for vehicles and ladders, DGUV V3 for tools and test equipment, gas and refrigerant certificates of staff.
• Pflegedienst: staff qualifications, vaccinations, driving licences, training certificates.
• Steuerkanzlei: statutory and client deadlines (returns, objections, appeals) with a traceable deadline book. Legally a different case (see Risks), same technology.

How it works

1. intake (email, scan, photo, upload, shared mailbox, inspector portal)
2. classify document (protocol? certificate? notice? invoice?) and extract fields
3. identify object (device, room, vehicle, person) against the asset register
4. look up rule (legal basis, interval, inspector qualification) in the rule table
5. compute next due date and flag open findings (defects) from the protocol
6. human check of date, object and rule (confidence below threshold or new object type)
7. calendar entry + reminder chain (owner
8. deputy
9. management) + booking draft
10. evidence filed in the DMS under a fixed name; audit trail of every change
11. monthly overdue report and year plan (bundle inspections per site and provider)

• Extraction: a VLM or document parser reads the protocol and returns JSON against a schema (object, inspection date, result, defects, inspector, next date if stated). Dates are always re-calculated from the rule table and compared with the date printed on the protocol.
• Rule table: a plain, versioned table (object type, legal basis, interval, source). This is the core asset, not the model. The LLM may propose new rules from a document, a human approves them.
• Reminders and bookings: deterministic scheduler; the LLM drafts the mail to the inspector. Sending is released by a human at first, later automatically for routine renewals.
• Evidence: optional links to loggers (temperature, water) or photo uploads from a phone.
• Human-in-the-loop: the owner confirms new objects, rule changes and every "closed" status when a protocol shows defects. The agent never declares a facility compliant.

Data preparation

Which data: a list of everything that needs inspection (devices, buildings, vehicles, people), the last known protocols and certificates, and the rule table with legal basis and intervals.

Where it lives: Excel lists, paper binders, email attachments, the inspector's portal, the vehicle and fleet software, practice or hotel software, shared drives and the DMS; qualifications in HR files.

Typical gaps: no complete asset list; protocols with no object ID; inspection companies that send only an invoice; intervals defined by manufacturer, risk assessment or insurer rather than by law; the same device registered under several names; personal data in qualification files without clear access rights.

Preparation steps: 1. Walk the sites and build one asset register with unique IDs and labels (QR code or sticker). Start with the five object types that cause the most trouble. 2. Collect the last protocol per object, scan it and name it uniformly (see PREP-006). 3. Write the rule table per object type with legal basis and interval; where the interval comes from a risk assessment, record who decided (see PREP-016). 4. Build a test set of 30 to 50 real protocols, including bad scans and foreign-language ones (PREP-018). 5. Restrict access to staff certificates and health-related entries (PREP-023).

Tools: Excel or Airtable-style table, scanner app, Paperless-ngx or the existing DMS, a calendar.

Rough share of effort: about 40 percent of the project. Building the register and rule table is the real work; the AI part is small. See GUIDE-003.

Implementation paths

Which path for whom

• SMB, Path A: inspection and maintenance management tools with reminders and document storage exist at SMB prices; add a document-AI feature or a general AI assistant for protocol intake.
• Enterprise, Path B: many sites and a CAFM/ERP landscape; cloud APIs plus own workflow engine integrate with the asset master data and approval chain.
• Developer, Path C: open-source OCR/VLM plus an open workflow engine on HW2; full control over the rule table and data, suitable for building a vertical product.

Path A, Buy (recommended for most SMBs)

• Dedicated test-deadline management: e.g. Wartungsplaner (Hoppe) as a German product that manages statutory inspection dates and keeps proof ready; CAFM and facility tools for property managers; practice and care software with built-in device and qualification modules; fleet and vehicle-check portals for UVV and HU; tax-office software with deadline books.
• Built into office software: Microsoft 365 (Planner, Power Automate, Copilot) or Google Workspace (Calendar, Gemini) can run the reminder chain; DMS products (DocuWare, d.velop, Nextcloud) can extract fields from protocols.
• Check: EU hosting, AVV, export of all data and rules, audit trail, role-based access for staff certificates, and whether the vendor really extracts protocols or only stores them.
• Choose A when: fewer than ~500 objects, standard intervals, no existing CAFM.

Path B, Build on cloud APIs

• Extraction: a multimodal model with structured outputs (Claude, Gemini, GPT, Mistral) or Azure Document Intelligence / Document AI in EU regions; protocols are mostly short and well structured, so cost per document is low.
• Orchestration: n8n, Power Automate or a small custom service writing to the asset register, calendar API and DMS; agent framework only for the booking dialogue with inspectors.
• Choose B when: you need links to your own ERP/CAFM, several sites or a multilingual intake.

Path C, Self-host (open source)

• Stack: Paperless-ngx or Docling for intake, an open VLM (Qwen-VL family) served via vLLM or Ollama, n8n for workflow, a plain database for the rule table, CalDAV for calendars.
• Hardware: HW2 is enough; HW1 can work for text-only protocols with a small LLM.
• Choose C when: staff and health-related data must not leave the company or for a product build.

Path D, Custom training

Rarely sensible. Rule logic must stay explicit and auditable, so training adds little. Only for a vendor with thousands of protocols of the same type who wants a small specialised extractor.

State of the art (2026)

• Extraction from protocols is solved well enough: VLMs read standard inspection reports and certificates reliably; handwriting, stamps and combined multi-device protocols still cause misses.
• Rules are the bottleneck: intervals depend on law, manufacturer, insurer and the operator's own risk assessment (for example BetrSichV and TRBS: the operator determines the interval, DGUV V3 intervals are guide values). No model can decide this for you. LLMs help to propose rules from documents; a qualified person approves them.
• Agentic booking (mail to inspector, propose slots) works for routine renewals; phone-only providers and portals remain manual.
• Sensor evidence (temperature, water flow) is technically easy but needs sensor management; see PRED-046 and the monitoring ideas in PRED-006 for the data side.
• Maturity: early-adopter. Individual building blocks are mainstream; a finished product that covers extraction, rule table, booking and evidence for all Mittelstand trades is rare. Most vendors cover one trade (property, fleet, medical, care).
• Limits: the agent can miss an object nobody registered, misread a date, or apply a wrong interval. A tracker that looks complete but is not is more dangerous than a known-incomplete spreadsheet.

Shared resources & combinations

• Same stack (ocr-docparse + vlm + llm-general): DOC-003 forms, DOC-008 mailroom classification and DOC-016 rule checks of documents run on the same extraction server; AGENT-034 can use DOC-008 to route inspection mail automatically.
• Same engine: AGENT-002 workflow platform for reminders and approvals; AGENT-012 for appointment slots with inspectors; AGENT-001 for the shared mailbox.
• Governance neighbour: AGENT-018 does the same job for IT and ISO controls; use one evidence archive and one reminder service for both, so audits (ISO 27001, insurer, BG) pull from one place.
• Knowledge side: KNOW-009 answers "which interval applies?" with sources and can feed the rule table.
• Sensor side: PRED-006 and PRED-046 provide condition data that can trigger an extra inspection.
• Biggest combined effect: the tracker is the cheapest "one-shot" bundle. One asset register with IDs, one rule table, one intake mailbox and one reminder chain serve all six business types above and also the IT controls in AGENT-018. After the register exists, adding a new object type costs minutes. For a firm that wants a single starting package: AGENT-034 + DOC-008 (intake) + AGENT-012 (booking) on AGENT-002 (engine).

Effort, cost & KPIs

• Path A: one to a few weeks plus register build-up (days to weeks of own staff time); subscription per object, site or user.
• Path B: 1 to 3 months incl. integration; API cost small (protocols are short).
• Path C: 1 to 3 months, one server, low operations effort.
• Cost drivers: register build-up, rule maintenance after law changes, number of sites.
• KPIs: share of objects with valid inspection (compliance rate), overdue items per month, days from protocol receipt to filed evidence, number of audit findings, minutes per inspection round spent on administration, late bookings avoided.

People & change

Involve early: management (liability owner), the head of facility or practice management as process owner, IT for mailbox and DMS, the DPO for staff certificates. Suppliers (inspectors, service firms) should know where to send protocols (GUIDE-005, GUIDE-010).

Works council: depends. A register of staff qualifications and deadlines per person can be suited to monitor employees (§87(1) no. 6 BetrVG), even if the aim is compliance; keep person-related fields minimal and agree on purpose and access in a short works agreement (GUIDE-004).

AI literacy: short training for the owners of the register on what the agent does, how to read the confidence flag and why they sign off (AI Act Art. 4; GUIDE-006).

Communication and pilot: present it as protection of the person who signs as operator, not as surveillance. Pilot with one site and three object types (for example electrical, vehicles, drinking water), run the old list in parallel for one inspection cycle (GUIDE-008, GUIDE-009).

Humans in control: no status "compliant" without a human who read the protocol, especially when defects are noted.

Risks, regulation & compliance

• EU AI Act: minimal risk; no Annex III use. AI literacy duty (Art. 4) applies (since the 2026 Digital Omnibus on AI it is a duty to take measures supporting AI literacy, no longer to ensure a sufficient level).
• GDPR: staff qualifications, health-related entries (vaccinations in care) and driving licences are personal data; Art. 6 and, for health data, Art. 9 with national rules (§26 BDSG); AVV with vendor; keep retention short and access narrow.
• Operator responsibility: the legal duty to inspect and document stays with the operator. The tool supports it but does not transfer liability. Examples: BetrSichV (§14: for equipment under Annex 2 sections 2 to 4 and Annex 3 the next due date runs from the previous due date; recurring checks must be recorded and kept until the next check), DGUV Vorschrift 3 (intervals are guide values: 4 years fixed installations, 6 months portable equipment, extendable on a documented basis), TrinkwV (§31: legionella test duty for larger hot-water systems with showers, outside one- and two-family houses; at least every three years for commercial supply such as renting, yearly for public supply; the health office may extend in defined cases), MPBetreibV (inventory of active medical devices, safety checks and device book). Check the current text and the rules of your state.
• Tax advisors: missed deadlines are the advisor's own fault if the office organisation is poor; case law (e.g. BFH 18.03.2014, VIII R 33/12) expects office procedures that make missed deadlines practically impossible (e.g. delete a deadline only after confirmed dispatch), so the agent does not replace a controlled deadline procedure (reinstatement under §110 AO is denied for organisational faults).
• Risks and mitigations: wrong interval (rule table with legal source and review date); missing objects (periodic walk-through); misread date (recalculate and compare); alert fatigue (escalation only for real overdue items); vendor lock-in (export rules and register regularly).

Getting started

1. Pick one site and three object types with the highest liability; list all objects with IDs.
2. Write the rule table with legal basis and interval; have the responsible person or the BG/insurer advisor review it.
3. Collect the last protocols and test an extraction on 30 of them, including bad scans.
4. Set up the reminder chain (owner, deputy, management) and a shared inspection mailbox.
5. Run it in parallel with the old list for one cycle, then expand to further object types.

Sources

1. Betriebssicherheitsverordnung, § 14 Prüfung von Arbeitsmitteln (deadlines, recording of results) — https://lxgesetze.de/betrsichv/14
2. Medizinprodukte-Betreiberverordnung 2025 (§ 12 STK, § 13 Medizinproduktebuch, § 14 Bestandsverzeichnis) — https://www.gesetze-im-internet.de/mpbetreibv_2025/index.html
3. FORUM Verlag — Prüffristen nach DGUV V3 (guide values for fixed and portable equipment) — https://forum-verlag.com/fachwissen/elektrosicherheit-und-elektrotechnik/prueffristen-nach-dguv-v3/
4. Trinkwasserverordnung 2023, § 31 (legionella testing duty and intervals) — https://www.gesetze-im-internet.de/trinkwv_2023/__31.html
5. produktion.de — Wartungsplaner (Hoppe), test-deadline management software — https://www.produktion.de/instandhaltung/wartungsplaner-bietet-seit-zwei-jahrzehnten-sicheres-prueffristenmanagement/1753831
6. Rechtslupe — Fristversäumnis und Kanzleiorganisation (deadline control in tax offices) — https://www.rechtslupe.de/steuerrecht/fristversaeumnis-und-die-kanzleiorganisation-382589
7. Regulation (EU) 2024/1689 (AI Act) — https://eur-lex.europa.eu/eli/reg/2024/1689/oj