feat(pitch-deck): add Risks & Mitigation slide (vorletzte Folie)

New slide with 6 risks and concrete mitigations:
1. AI Commoditization — Layer 2-6 moat, not Layer 1
2. US Platform Expansion — EU-only infrastructure, CLOUD Act barrier
3. Team/Key-Person Risk — Documentation, ESOP, early legal hire
4. Slow Customer Acquisition — Consulting revenue bridge, channel strategy
5. Regulatory Changes — Enlarges market, RAG indexes in days
6. Liquidity Risk — Organic growth, Pre-Seed BW option

Key quote: "We don't compete with AI. We compete with teams that
use AI better than we do."

Presenter script added for the risks slide.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

pitch-deck/components/PitchDeck.tsx

@@ -51,6 +51,7 @@ import SDKDemoSlide from './slides/SDKDemoSlide'
 import StrategySlide from './slides/StrategySlide'
 import FinanzplanSlide from './slides/FinanzplanSlide'
 import GlossarySlide from './slides/GlossarySlide'
+import RiskSlide from './slides/RiskSlide'
 
 interface PitchDeckProps {
   lang: Language
@@ -216,6 +217,8 @@ export default function PitchDeck({ lang, onToggleLanguage, investor, onLogout,
         return <FinanzplanSlide lang={lang} investorId={investor?.id || null} preferredScenarioId={preferredScenarioId} />
       case 'annex-glossary':
         return <GlossarySlide lang={lang} />
+      case 'risks':
+        return <RiskSlide lang={lang} />
       case 'legal-disclaimer':
         return <DisclaimerSlide lang={lang} />
       default:

pitch-deck/components/slides/RiskSlide.tsx

@@ -0,0 +1,176 @@
+'use client'
+
+import { Language } from '@/lib/types'
+import GradientText from '../ui/GradientText'
+import FadeInView from '../ui/FadeInView'
+import GlassCard from '../ui/GlassCard'
+import { AlertTriangle, Shield, Clock, Cpu, Globe, Users, TrendingUp } from 'lucide-react'
+
+interface RiskSlideProps {
+  lang: Language
+}
+
+export default function RiskSlide({ lang }: RiskSlideProps) {
+  const de = lang === 'de'
+
+  const risks = [
+    {
+      icon: Cpu,
+      color: 'text-red-400',
+      border: 'border-red-500/20',
+      risk_de: 'KI-Commoditisierung',
+      risk_en: 'AI Commoditization',
+      desc_de: 'LLMs senken Eintrittsbarrieren — Control-Generierung, DSFA-Erstellung und Policy-Templates werden zur Commodity.',
+      desc_en: 'LLMs lower entry barriers — control generation, DPIA creation and policy templates become commodities.',
+      mitigation_de: 'Wir konkurrieren nicht auf Layer 1 (KI-Wissen), sondern auf Layer 2-6: Integration, Auditierbarkeit, Workflows, EU-Hosting. KI ist unser Multiplikator, nicht unser Produkt.',
+      mitigation_en: 'We don\'t compete on Layer 1 (AI knowledge) but on Layers 2-6: integration, auditability, workflows, EU hosting. AI is our multiplier, not our product.',
+      timeline_de: 'Mittel (3-5 J.)',
+      timeline_en: 'Medium (3-5 yrs)',
+      severity: 'high',
+    },
+    {
+      icon: Globe,
+      color: 'text-amber-400',
+      border: 'border-amber-500/20',
+      risk_de: 'US-Plattform-Expansion',
+      risk_en: 'US Platform Expansion',
+      desc_de: 'Microsoft Purview, Vanta oder Drata expandieren nach Europa mit lokalisiertem Compliance-Angebot.',
+      desc_en: 'Microsoft Purview, Vanta or Drata expand to Europe with localized compliance offerings.',
+      mitigation_de: 'Struktureller Vorteil: 100% EU-Infrastruktur, kein US-SaaS im Stack, Betriebsrat-Faehigkeit. US-Anbieter koennen den CLOUD Act nicht umgehen — das ist fuer deutsche Mittelstaendler ein Ausschlusskriterium.',
+      mitigation_en: 'Structural advantage: 100% EU infrastructure, no US SaaS in the stack, works council compliance. US providers cannot circumvent the CLOUD Act — that is a deal-breaker for German mid-market.',
+      timeline_de: 'Mittel (2-4 J.)',
+      timeline_en: 'Medium (2-4 yrs)',
+      severity: 'medium',
+    },
+    {
+      icon: Users,
+      color: 'text-amber-400',
+      border: 'border-amber-500/20',
+      risk_de: 'Team-Risiko / Key-Person',
+      risk_en: 'Team Risk / Key Person',
+      desc_de: 'Abhaengigkeit von zwei Gruendern in der Fruehphase. Wissensverlust bei Ausfall.',
+      desc_en: 'Dependency on two founders in the early phase. Knowledge loss in case of absence.',
+      mitigation_de: 'Dokumentation aller Prozesse in MkDocs. KI-gestuetzte Codebasis (500k+ Zeilen mit Tests). ESOP-Pool fuer Schluesselmitarbeiter ab Hire 1. Redundanz durch fruehe Einstellung eines Rechtsanwalts/Datenschutz.',
+      mitigation_en: 'Documentation of all processes in MkDocs. AI-assisted codebase (500k+ lines with tests). ESOP pool for key employees from hire 1. Redundancy through early hiring of a lawyer/data protection expert.',
+      timeline_de: 'Hoch (Jahr 1-2)',
+      timeline_en: 'High (Year 1-2)',
+      severity: 'medium',
+    },
+    {
+      icon: TrendingUp,
+      color: 'text-blue-400',
+      border: 'border-blue-500/20',
+      risk_de: 'Langsame Kundenakquise',
+      risk_en: 'Slow Customer Acquisition',
+      desc_de: 'B2B-Verkaufszyklen im Mittelstand dauern 3-9 Monate. Compliance-Budgets werden jaehrlich geplant.',
+      desc_en: 'B2B sales cycles in the mid-market take 3-9 months. Compliance budgets are planned annually.',
+      mitigation_de: 'Beratungsumsaetze ab Gruendung (5-30k/Mon) ueberbruecken die Anlaufphase. Channel-Strategie ueber Bechtle/CANCOM skaliert schneller als Direktvertrieb. Land-and-Expand: Einstieg mit einem Modul, Upsell auf Full Compliance.',
+      mitigation_en: 'Consulting revenue from founding (5-30k/month) bridges the ramp-up. Channel strategy via Bechtle/CANCOM scales faster than direct sales. Land-and-expand: entry with one module, upsell to full compliance.',
+      timeline_de: 'Hoch (Jahr 1-3)',
+      timeline_en: 'High (Year 1-3)',
+      severity: 'medium',
+    },
+    {
+      icon: Shield,
+      color: 'text-emerald-400',
+      border: 'border-emerald-500/20',
+      risk_de: 'Regulatorische Aenderungen',
+      risk_en: 'Regulatory Changes',
+      desc_de: 'Neue EU-Gesetze oder Aenderungen bestehender Regularien erfordern schnelle Anpassung der Plattform.',
+      desc_en: 'New EU laws or changes to existing regulations require rapid platform adaptation.',
+      mitigation_de: 'Jede regulatorische Aenderung vergroessert unseren Markt. RAG-Pipeline kann neue Regularien innerhalb von Tagen indexieren. Ueber 380 Regularien bereits in der Wissensbasis — Vorsprung von Jahren.',
+      mitigation_en: 'Every regulatory change enlarges our market. RAG pipeline can index new regulations within days. Over 380 regulations already in the knowledge base — years of head start.',
+      timeline_de: 'Laufend',
+      timeline_en: 'Ongoing',
+      severity: 'low',
+    },
+    {
+      icon: Clock,
+      color: 'text-emerald-400',
+      border: 'border-emerald-500/20',
+      risk_de: 'Liquiditaetsrisiko',
+      risk_en: 'Liquidity Risk',
+      desc_de: 'Mit 200k Wandeldarlehen ist die Runway begrenzt. Ende 2027 nahe Null.',
+      desc_en: 'With a 200k convertible loan, the runway is limited. Near zero by end of 2027.',
+      mitigation_de: 'Organisches Wachstum durch Beratungsumsaetze. Break-Even in 2029. Option auf Pre-Seed BW (L-Bank) verdoppelt die Gesamtfinanzierung auf 400k. Lean-Team mit 9 Personen bis 2030.',
+      mitigation_en: 'Organic growth through consulting revenue. Break-even in 2029. Option for Pre-Seed BW (L-Bank) doubles total funding to 400k. Lean team with 9 people until 2030.',
+      timeline_de: 'Hoch (Jahr 1-2)',
+      timeline_en: 'High (Year 1-2)',
+      severity: 'low',
+    },
+  ]
+
+  return (
+    <div className="max-w-6xl mx-auto">
+      <FadeInView className="text-center mb-5">
+        <h2 className="text-3xl md:text-4xl font-bold mb-2">
+          <GradientText>{de ? 'Risiken & Mitigation' : 'Risks & Mitigation'}</GradientText>
+        </h2>
+        <p className="text-sm text-white/50 max-w-3xl mx-auto">
+          {de
+            ? 'Transparente Darstellung der wesentlichen Risiken und unserer konkreten Gegenmaßnahmen.'
+            : 'Transparent presentation of key risks and our concrete countermeasures.'}
+        </p>
+      </FadeInView>
+
+      <div className="space-y-3">
+        {risks.map((r, idx) => {
+          const Icon = r.icon
+          const severityColor = r.severity === 'high' ? 'bg-red-500/20 text-red-300 border-red-500/30'
+            : r.severity === 'medium' ? 'bg-amber-500/20 text-amber-300 border-amber-500/30'
+            : 'bg-emerald-500/20 text-emerald-300 border-emerald-500/30'
+
+          return (
+            <FadeInView key={idx} delay={0.05 + idx * 0.05}>
+              <GlassCard hover={false} className={`p-4 border-l-2 ${r.border}`}>
+                <div className="grid md:grid-cols-12 gap-3">
+                  {/* Risk */}
+                  <div className="md:col-span-5">
+                    <div className="flex items-center gap-2 mb-1.5">
+                      <Icon className={`w-4 h-4 ${r.color}`} />
+                      <h3 className={`text-sm font-bold ${r.color}`}>{de ? r.risk_de : r.risk_en}</h3>
+                      <span className={`text-[9px] px-1.5 py-0.5 rounded-full border ${severityColor}`}>
+                        {de ? r.timeline_de : r.timeline_en}
+                      </span>
+                    </div>
+                    <p className="text-xs text-white/40 leading-relaxed">
+                      {de ? r.desc_de : r.desc_en}
+                    </p>
+                  </div>
+
+                  {/* Arrow */}
+                  <div className="hidden md:flex items-center justify-center">
+                    <div className="w-6 h-[1px] bg-white/10" />
+                    <AlertTriangle className="w-3 h-3 text-white/20 mx-1" />
+                    <div className="w-6 h-[1px] bg-white/10" />
+                  </div>
+
+                  {/* Mitigation */}
+                  <div className="md:col-span-6">
+                    <p className="text-[10px] text-emerald-400/60 uppercase tracking-wider mb-1 font-semibold">
+                      {de ? 'Mitigation' : 'Mitigation'}
+                    </p>
+                    <p className="text-xs text-white/60 leading-relaxed">
+                      {de ? r.mitigation_de : r.mitigation_en}
+                    </p>
+                  </div>
+                </div>
+              </GlassCard>
+            </FadeInView>
+          )
+        })}
+      </div>
+
+      {/* Key Insight */}
+      <FadeInView delay={0.4} className="mt-4">
+        <div className="bg-gradient-to-r from-indigo-500/10 to-purple-500/10 border border-indigo-500/20 rounded-xl px-5 py-3 text-center">
+          <p className="text-sm text-white/70 italic">
+            {de
+              ? '„Wir konkurrieren nicht mit KI. Wir konkurrieren mit Teams, die KI besser einsetzen als wir. Deshalb bauen wir nicht das beste LLM — sondern die vertrauenswuerdigste Compliance-Infrastruktur."'
+              : '"We don\'t compete with AI. We compete with teams that use AI better than we do. That is why we don\'t build the best LLM — but the most trustworthy compliance infrastructure."'}
+          </p>
+        </div>
+      </FadeInView>
+    </div>
+  )
+}

pitch-deck/lib/presenter/presenter-script.ts

@@ -630,6 +630,29 @@ export const PRESENTER_SCRIPT: SlideScript[] = [
     ],
   },
 
+  // — risks (45s)
+  {
+    slideId: 'risks',
+    duration: 45,
+    paragraphs: [
+      {
+        text_de: 'Jetzt zu den Risiken — denn Transparenz ist uns wichtig. Wir haben sechs wesentliche Risiken identifiziert und für jedes eine konkrete Mitigation erarbeitet.',
+        text_en: 'Now to the risks — because transparency is important to us. We have identified six key risks and developed a concrete mitigation for each.',
+        pause_after: 2000,
+      },
+      {
+        text_de: 'Das größte Risiko ist die Commoditisierung durch KI. Unsere Antwort: Wir konkurrieren nicht auf der Ebene des KI-Wissens, sondern auf der Ebene der vertrauenswürdigen Infrastruktur. KI ist unser Multiplikator, nicht unser Produkt.',
+        text_en: 'The biggest risk is commoditization through AI. Our answer: we don\'t compete at the AI knowledge level, but at the trustworthy infrastructure level. AI is our multiplier, not our product.',
+        pause_after: 2500,
+      },
+      {
+        text_de: 'Der entscheidende Satz für Investoren: Wir konkurrieren nicht mit KI. Wir konkurrieren mit Teams, die KI besser einsetzen als wir. Deshalb bauen wir nicht das beste Sprachmodell — sondern die vertrauenswürdigste Compliance-Infrastruktur Europas.',
+        text_en: 'The key statement for investors: We don\'t compete with AI. We compete with teams that use AI better than we do. That\'s why we don\'t build the best language model — but the most trustworthy compliance infrastructure in Europe.',
+        pause_after: 2000,
+      },
+    ],
+  },
+
   // — legal-disclaimer (20s)
   {
     slideId: 'legal-disclaimer',

pitch-deck/lib/slide-order.ts

@@ -30,6 +30,7 @@ export const SLIDE_ORDER: SlideId[] = [
   'annex-strategy',
   'annex-finanzplan',
   'annex-glossary',
+  'risks',
   'legal-disclaimer',
 ]
 

pitch-deck/lib/types.ts

@@ -251,4 +251,5 @@ export type SlideId =
   | 'annex-strategy'
   | 'annex-finanzplan'
   | 'annex-glossary'
+  | 'risks'
   | 'legal-disclaimer'