AI register
Which AI tools and systems are used by whom and for what, kept up to date. Purchased tools count just as much as in-house ones.
AI responsibility without a full-time hire
External AI officer
I already act as AI officer for several companies. It fits best at the start: AI is already used in the business, someone has to take care of it, but it is still unclear whether a dedicated full-time position pays off. I keep track of all AI tools and make sure there are clear rules for everyday work. If the role is filled internally later, I train the person and hand over properly.
When it fits
An external AI officer makes sense if, at your company:
- AI tools are in use, but nobody is officially responsible
- it is still unclear whether a dedicated AI position pays off
- employees ask what is allowed with AI and what is not
- customers want to know how you use and secure AI
- AI literacy in the team should be built up and shown
- an AI management system to ISO/IEC 42001 is planned
Tasks
What I take on as AI officer
AI policy
Clear rules for everyday work: what is allowed, which data may go into which tool and who approves new tools.
Approval of new tools
A check before introduction, looking at data, data protection, risk and the classification under the EU AI Act.
AI literacy in the team
Training and short formats so your staff use AI safely. Documented, so you can show your measures under Article 4 of the EU AI Act.
Point of contact
For employees with questions, for management and for customers who ask about your use of AI in supplier audits.
Report to management
Regular and brief: status, risks and what needs a decision.
Free templates to get started, such as an AI system register and an AI policy, are on the templates page. If this should grow into an AI management system, the next step is ISO 42001 readiness.
My assessment is made from an auditor's point of view. It is not legal advice. I coordinate closely with your data protection officer and your legal advisers.
What the law and the standard require
Unlike a data protection officer, no law requires an AI officer. Two rules still need someone who takes care of them. Article 4 of the EU AI Act obliges providers and deployers to take measures to support the development of AI literacy of their staff. This wording has applied since 27 July 2026, following the amendment by Regulation (EU) 2026/1744, the so-called Digital Omnibus. And anyone working to ISO/IEC 42001 defines roles and responsibilities for AI and makes them known in the organisation.
An AI officer brings both together in one place. Management remains accountable, I do the ongoing work. Read more: AI literacy under Article 4 and does your company need an AI officer?
How it works
In three steps
01
Initial review
At the start we record where AI is already used in the business and clarify what needs rules first.
02
Ongoing support
In an agreed scope, on site and by video. Policy, approvals, training and the report to management run regularly.
03
Decide and hand over
After a while it is clear what the role needs at your company. Then you decide: continue externally or fill it internally. If you fill it internally, I train the person.
Why external, why me
Predictable
An agreed scope instead of a full-time position, matched to what actually comes up at your company.
With an auditor's eye
As an ISO/IEC 42001 Senior Lead Auditor (PECB) I know what auditors and customers ask for and set up the documents accordingly.
From practice
I run a manufacturing company myself and use AI there every day. I do not write rules that fail in everyday work.
Support and audit stay separate
Where I am AI officer, I do not audit: no internal audit, no assessment for the Audit Ready seal and no supplier audit of the same company. An independent party does that, and certification is only ever issued by an accredited certification body. How I separate my roles is set out in the impartiality statement.
Frequently asked questions
Is an AI officer mandatory?+
No. Unlike a data protection officer, no law requires an AI officer. The EU AI Act does, however, oblige providers and deployers of AI systems to take measures to support the development of AI literacy of their staff (Article 4 as in force since 27 July 2026). And anyone working to ISO/IEC 42001 has to define roles and responsibilities for AI. An AI officer brings both together in one place.
Which companies benefit from an external AI officer?+
Mainly mid-sized companies that already use AI day to day, where a dedicated position would be too big or it is still unclear whether it pays off. At the start, nobody knows exactly how much work the role involves. With an external officer you find out without creating a full-time position straight away.
What does an external AI officer cost?+
That depends on the scope: how many AI tools are in use, how many employees use them and whether an AI management system to ISO/IEC 42001 is part of it. The first call is free. Afterwards you receive a quote with a clear scope and price.
How does this differ from a data protection officer?+
The GDPR requires a data protection officer under certain conditions, and that role covers personal data. The AI officer looks at AI more broadly: which tools are in use, which rules apply, how the team is trained and what follows from the EU AI Act. The two roles overlap on data protection, so I work closely with your data protection officer and do not replace them.
Can we fill the role internally later?+
Yes, that is planned from the start. If it turns out that a dedicated position pays off, I train your successor and hand over the AI register, the policy and all documents. Your team does not start from zero.
Can you also audit us while you are our AI officer?+
No, deliberately not. Whoever fills the role cannot audit their own work independently. The internal audit is then carried out by an independent party, and certification is only ever issued by an accredited certification body. I also do not take on a supplier audit of the same company.
Do you work on site or by video?+
Both. Much of the work runs by video. For the initial review, training and conversations with the team I am happy to come to you. I am based in Darmstadt, Germany, and work on site across Germany by arrangement.