The problem
In regulated industries, AI projects rarely fail on technology. They fail in the approval process. Data protection, information security and legal ask fair questions - and nobody has prepared the answers. The pilot stays a pilot.
Our approach
We treat compliance as a design requirement, not a hurdle at the end. Three frameworks, one approach:
- AI Governance - roles, policies and processes: who may use which model with which data, and who is accountable?
- Information security - set up AI applications so they fit the existing ISMS - under ISO 27001 and, where required, TISAX.
- EU AI Act - determine risk classes, derive obligations, keep documentation from day one.
- Enablement - your teams learn to use AI safely and effectively: with guidelines, training and contacts in the business units.
Where data must not leave the building, we also set up AI on-premises and in environments without internet access (air gap) - with open models that trail the cloud by a few months but already carry many tasks (the gap in numbers). In projects with classified-information requirements, security-cleared staff work on them who are familiar with such isolated systems. We carry out export-controlled and classified work exclusively with authorised staff in Germany or the EU.
We work within SII Group’s ISO 27001 certified processes; SII Germany holds the TISAX label at the highest level AL3. We know these audits from both sides of the table.
How we work
- AI inventory - which AI systems are already running, officially and unofficially?
- Risk mapping - classification under the EU AI Act, alignment with your ISMS and TISAX requirements.
- Guardrails - technical and organisational measures, implemented rather than just described.
- Approval with complete documentation - a repeatable process that gives data protection, information security and legal everything they need for their review from the start.
What you get
- Clarity on which AI applications trigger which obligations.
- A governance framework that fits your organisation.
- Audit-ready documentation.
- A way to use AI productively - instead of banning it.
