The AI Auditor helps companies worldwide with ISO/IEC 42001 (AI management systems), ISO/IEC 27001 (information security) and EU AI Act readiness: gap analysis and build, or an internal audit where I have not built the system. Independent supplier and second-party audits are available on top, in Germany and worldwide. Official certification itself is always issued by an accredited certification body.
I make your AI auditable and your information security solid, from the first baseline to certification readiness.
My focus is the manufacturing mid-market, precision machining, metal and mechanical engineering, industry and industry-adjacent services, plus international companies that source from or operate in Europe. In other words, organisations that use AI in real operation and must prove to customers, supply chains or the EU AI Act that they have it under control. I speak the language of the shop floor because I run one myself, and I carry exactly that practice into ISO 42001, ISO 27001 and the AI Act.
The world's first standard for responsible AI. As a Senior Lead Auditor and Senior Lead Implementer (PECB) I build your AI management system from gap analysis to certification readiness, or I audit it. One role per company applies.
The foundation of any serious AI governance: a solid ISMS. I support the build and preparation for certification to ISO/IEC 27001, or I audit an existing ISMS. One role per company applies.
Prohibited practices, high-risk systems, transparency obligations: I classify your AI applications and show what needs doing by when, with the extraterritorial reach that catches many non-EU firms.
You have to decide on AI without being an AI expert yourself? I advise management and leaders independently: where AI pays off, where it becomes a risk, and what ISO/IEC 42001 and the EU AI Act ask of you as leadership. Plain talk instead of hype, from an owner-manager's perspective.
I already act as AI officer for several companies. It fits best at the start, when AI is already in use but it is still unclear whether a dedicated full-time position pays off. If the role is filled internally later, I train the person and hand over.
I help you find where AI really saves time in your business and build the solution as software with Timo Külbel. My own projects include a legal monitoring and ISO management system, an AI-driven ERP and VoiceWall. Where it fits, the AI runs locally at your company.
Also available on its own
You need to audit a supplier or site but have no capacity of your own, or you need an independent auditor with manufacturing experience? I take on supplier and second-party audits as a standalone service, in Germany and worldwide, on-site or remote.
For clarity: official certification may only be issued by an accredited certification body. A supplier or second-party audit is something else, an audit on your behalf that lets you have your suppliers or your own processes checked independently.
ISO/IEC 42001 is an international standard, my PECB qualification is globally recognised, and I have not only been abroad in theory: I have audited in several countries and helped build up a manufacturing operation abroad from the ground up. Because I sat on the audited side myself as a managing director, I know how a management system has to work in real operation, not just on paper. That is the difference between a report and a result.
Audited on-site in
…plus Germany as the base.
Efficiently delivered
ISO 42001 and ISO 27001 share a core structure, risk logic and a large part of the evidence. Tackling both together, or building on an existing ISMS, means you do not build the core structure and evidence twice; that often cuts the additional effort noticeably. A reliable estimate follows the gap analysis. I plan for exactly this from the outset.
I don't sell you software that ties you down. Your management system runs on the tools you already have, from a spreadsheet to a GRC platform. You keep control of your data, your processes and your running costs.
For German-based SMEs, advisory and implementation work around digitalisation and AI is frequently eligible for funding, for example via the nationwide BAFA advisory programme or state programmes. What is possible in your region we clarify in the free intro call. More on cost & funding
Your advantage
No junior team learning on your project: you work directly with me. PECB awards the Senior level only from 1,000+ documented audit hours and at least seven years of professional practice.
I can build management systems and examine them as an auditor, but I take only one role per company. When I build, I know what auditors ask for, so the system is built to pass the external audit from day one.
I have sat on the audited side myself and run a manufacturing company. I know the pressure of day-to-day operations and build systems that relieve the business rather than paralyse it.
No ties to any certification body: you choose the body freely, and my recommendations answer only to your interests.
Seven years of AI practice, from building my own AI and ERP systems to AI governance. I don't just talk about AI, I have built and run it myself.
Fewer consulting days for the same result: I work AI-supported and without overhead. That lowers your investment, and for German-based clients advisory work is often eligible for funding.
Packages & process
Each package builds on the previous one, and you can start with the baseline alone. The investment is project-specific; you get a firm fixed price after the free intro call, no inflated figures. For rough orders of magnitude, see the cost insight.
Where do you really stand?
approx. 2-4 weeks
A stocktake against ISO 42001 / ISO 27001 and a classification of your AI applications under the EU AI Act.
You receive
Fixed price after the free intro call
From finding to a working system
approx. 1-3 months
Build of the management system that holds up in operation, policies, roles, risk assessment and controls.
You receive
Fixed price after the free intro call
Into the external audit without surprises
up to the certification audit
I prepare you for the internal audit, which an independent party carries out, work through the corrective actions with you and accompany you into the external audit.
You receive
Fixed price after the free intro call
What you concretely get
No PowerPoint clouds, but auditable artefacts. In a project they are produced tailored to your company.Note: samples for illustration, not client material.
Every AI application with purpose, data types, EU AI Act risk class and owners.
Principles, roles, risk and impact assessment, transparency, AI literacy.
A structured impact assessment of an AI system, including a GDPR note.
12 points that must be in place before any ISO 42001 / 27001 audit.
Where you stand today against ISO 42001 / 27001, optionally with a 27090 check for AI attacks, with a prioritised action plan.
An audit report to ISO 19011 with corrective-action tracking, as a separate engagement where I have not built the system.
As a PECB partner and certified trainer I train you and your team directly on the standard, with an exam and a PECB certificate. Official PECB courses, bookable individually or as in-house training.
Industry focus
My background runs from precision manufacturing, metal and mechanical engineering through industry into aerospace. I carry that practice, industry by industry, into ISO 42001, ISO 27001 and the EU AI Act, with real shop-floor experience rather than textbook theory. A few reads:
ISO/IEC 42001 is the first international standard for AI management systems (AIMS). It helps you run AI responsibly, transparently and defensibly, and is the practical proof that you have your AI under control. With the EU AI Act, exactly that proof becomes a competitive advantage.
ISO 27001 secures your information (the foundation). ISO 42001 builds on it and governs the responsible use of AI. The EU AI Act is the law, and a system built to ISO 42001 is a proven, structured way to meet its obligations demonstrably.
Certification itself is always issued by an accredited certification body, for reasons of independence. As an ISO/IEC 42001 Senior Lead Auditor I get you there: gap analysis, build and preparation for the internal audit, which an independent party carries out. That way you enter the external certification audit without surprises.
Yes. Supplier and second-party audits can be booked as a standalone service, in Germany and worldwide, on-site or remote. I audit against ISO 42001 / 27001 or your own requirements and deliver a clear audit report with findings and recommended actions. This is especially useful when your own team has no capacity or you need an independent auditor with real manufacturing experience. Accredited certification audits are unaffected; those are issued by an accredited certification body.
In three steps: first we agree the objective, scope and criteria (which standard or which of your own requirements, which sites, which processes) and I draw up an audit plan. Second I run the audit, on-site or remote, with document review, interviews and on-the-floor observation. Third you receive a traceable audit report with findings, risk rating and concrete recommended actions. On request I also follow up on the corrective actions.
A second-party audit is an audit 'by an interested party', typically you as the buyer having a supplier audited on your behalf. A certification audit (third party) is carried out by an accredited certification body and results in an official certificate. Both have their place: the second-party audit gives you fast, independent assurance about a supplier or site, without that party needing to be certified.
For any organisation that uses AI seriously, in production, administration, sales. If AI influences decisions, processes customer data, or you must provide evidence to clients, a clean management system is worthwhile. There is no minimum size.
Either works. A solid information security management system (ISO 27001) is a good foundation, but not a mandatory precursor to ISO 42001. It is often worth looking at both together and saving duplicate work. In the intro call we settle the order that makes sense for you.
There is no minimum size. What matters is that you use or introduce AI and want to take responsibility for it. The approach is tailored to be pragmatic and without corporate overhead.
That can only be answered seriously after a short assessment, which is why it starts with a free intro call and, where useful, a baseline. You then get a clear price, no inflated figures. Thanks to a lean, AI-supported way of working the effort stays low; and for German-based clients advisory work is often eligible for funding (e.g. the BAFA advisory programme, state programmes).
With clear rules. A non-disclosure agreement (NDA) is standard on request, just say the word. Any potential conflicts of interest, such as proximity to a competitor of my own manufacturing company, I disclose before accepting the engagement, so you can decide. Audit reports and results go exclusively to you as the client. And advice and accredited certification stay strictly separate: the official certificate is always issued by an independent, accredited certification body. I take one role per company: either I advise and build, or I audit.
Yes, both. I act as external AI officer for several companies, especially where it is still unclear whether a dedicated full-time position pays off. And together with Timo Külbel, a software developer with more than 25 years of experience, I build AI projects as software. One role per company applies: where I advise, build, support or implement, I do not audit.