Naz van Norel
AI Assurance for Businesses — Without the Big-Consulting Price Tag

Engineer. Political Scientist.
Implementor & Readiness Advisor.

I am Naz van Norel. I bridge 33 years of Siemens project and process engineering experience with global AI compliance frameworks (ISO/IEC 42001, ISO 27001, IEEE SA CertifAId, and EU AI Act / EN 18286).

Schedule Readiness Scope Call Open Project Portfolio Page

AIMS Standard

ISO 42001 Lead Auditor

ISMS Standard

ISO 27001 Lead Auditor

Ethics Assessor

IEEE SA CertifAId

Standardization

DIN NK 42 Expert

Naz van Norel

Naz van Norel

AI Governance Readiness Advisor · Qualified Lead Auditor

Mother of 2 Young Adults
German Citizen (Immigrated 27 years ago)
Munich, Germany Based
Behind the Advisor

Engineering Precision Driven By Human Values.

Beyond international standards and software engineering audits, my work is rooted in real-world human impact. As a mother of two young adults and an immigrant who made Germany my home 27 years ago, I understand that technology is not built in a vacuum—it reshapes societies, opportunities, and future generations.

With 33 years of Siemens engineering experience, degrees in Electronics Engineering and International Policy (LMU Munich), and experience founding Germany's first female-led AI academy, I help businesses build AI systems that are demonstrably safe, defensible, and human-centric.

Siemens Seniority

60+ global software process and technology audits across Europe, USA, Africa, and Middle East.

Standardization Committee

Directly contributing to EN 18286 AI quality standards in DIN Standards Committee 42.

Core Offerings

Fixed-Scope Readiness Services

Transparent, execution-focused engagements for Chief Risk Officers, CTOs, and engineering leads who need an independent expert assessment before a certification body arrives.

Not sure which you need?

“We need to get certified to ISO/IEC 42001.” → Package A “A customer or regulator wants proof our AI is fair and explainable.” → Package B “We sell AI into the EU and need to know what the AI Act requires.” → Package C “More than one of the above.” → A and C share ~40% of their evidence base. Ask about combining.
AIMS & ISMS Governance Package A

ISO/IEC 42001 Readiness Assessment

Where you stand against ISO/IEC 42001:2023 — Clauses 4 to 10 and Annex A — and what to fix first.

Who it’s for & what it covers

Who it’s for: Organisations preparing for ISO/IEC 42001 certification, or establishing an AI Management System for the first time — particularly those already certified to ISO/IEC 27001.

A structured evaluation of your AI Management System against the full requirements of ISO/IEC 42001:2023 — Clauses 4 to 10 and the Annex A control set — mapped against your existing ISO/IEC 27001 controls so you extend what you have rather than duplicate it.

What you will receive  (5)
  • A conformity gap register covering every requirement in Clauses 4–10, stated finding by finding against the evidence reviewed
  • An Annex A applicability review and a draft Statement of Applicability — the document your certification body asks for first
  • Assessment of your AI risk and AI system impact assessment methodology against Clauses 6.1.2 and 6.1.4
  • An ISO/IEC 27001 overlap map identifying controls that already satisfy 42001 requirements
  • A 30-day executive remediation roadmap, prioritised by what actually blocks certification

What we need from you: Twelve baseline documents, requested up front. Most organisations already hold eight to ten of them.

Duration 2 – 3 weeks
Your team’s effort ~8 hours
Request Package A Scope
Ethical Value Assessment
System Ethics Package B

IEEE SA CertifAId™ Ethical Value Impact Assessment

Delivered by a credentialed IEEE SA CertifAId Lead Assessor.

A formal assessment, not readiness preparation. Unlike Packages A and C, this produces an official IEEE SA CertifAId Assessor Evaluation Report.

Who it’s for & what it covers

Who it’s for: Organisations that must demonstrate ethical assurance to customers, procurement functions, or regulators — and need an assessment carrying an assessor credential rather than a self-declaration.

Where ISO/IEC 42001 assesses whether you have a management system, CertifAId assesses whether your systems behave ethically in operation: algorithmic fairness, explainability, privacy protection, and accountability.

What you will receive  (4)
  • Algorithmic bias and discrimination testing, with the statistical fairness metrics applied and their results
  • Evaluation of your explainability (XAI) methodology against intended audience and use context
  • Data privacy protection and governance assessment
  • Official IEEE SA CertifAId Assessor Evaluation Report — placeable in front of a customer, procurement panel, or regulator

What we need from you: Model cards, training and validation data documentation, any existing fairness test results, and access to the system or a representative environment.

Duration 3 weeks
Your team’s effort ~12 hours
Request Package B Scope
EU AI Act Statutory Package C

EU AI Act & EN 18286 Readiness

Assessed by a contributing member of DIN NK 42, the committee developing EN 18286.

What the AI Act requires of you, for which systems, by when — and where you stand against EN 18286:2026.

Who it’s for & what it covers

Who it’s for: Providers and deployers placing AI systems on the EU market who need to establish their obligations under Regulation (EU) 2024/1689 and position for the harmonised standards.

Determination of your obligations under the EU AI Act and alignment of your quality management system with EN 18286:2026 — the first European standard published in support of the Act.

Standards status EN 18286:2026 was approved by CEN-CENELEC in July 2026 and published. It is not yet cited in the Official Journal of the EU, so implementation does not currently confer presumption of conformity under Article 40. We assess against the published text so you are positioned when citation lands rather than starting then.
What you will receive  (5)
  • Operator role determination — provider, deployer, importer, distributor or authorised representative — and per-system risk classification under Articles 5 and 6, including any Article 6(3) derogation assessment
  • Obligation mapping across Articles 9–15 for systems classified high-risk
  • Annex IV technical documentation review against Article 11
  • Fundamental Rights Impact Assessment scoping and review under Article 27
  • EN 18286:2026 quality management system gap map against Article 17

Timing: The Digital Omnibus postponed obligations for standalone Annex III high-risk systems to 2 December 2027. This extends the preparation window; it does not remove the obligations.

Duration 3 – 4 weeks
Your team’s effort ~14 hours
Request Package C Scope
Confidentiality

How your documents are handled

Your AI policies, risk assessments and technical files are among your most sensitive material. How they are handled is agreed with you before anything is shared — never assumed.

You decide how your documents are processed

Processing arrangements are fixed in writing at scoping. Options include review carried out entirely without AI assistance, or AI-assisted review conducted inside your own governed environment. Nothing is used that you have not agreed to.

Every finding is verified by a named assessor

Whatever the method, no finding reaches your report without human verification against the source document. Every finding carries a locator — document, section, page — so you can check it yourself.

Limited access, defined retention

Confidentiality terms are agreed before documents change hands. Access is restricted to the named assessor. Retention periods and deletion are fixed at the outset, and your documents are deleted on request.

Where you already operate a governed AI environment, assessment work can be carried out inside it, so your material never leaves your own perimeter. Where you would rather no AI tooling touch your documents at all, that is a standard option and carries no change in scope or price.

Scope of services Packages A and C are readiness services. They prepare your organisation for a certification audit; they are not that audit, and no certificate is issued. Certification against ISO/IEC 42001 is issued only by an accredited certification body, and engaging an independent readiness advisor places no restriction on which body you may then use. Package B is a formal assessment under the IEEE SA CertifAId programme, delivered under assessor credential.
DIN STANDARDS COMMITTEE 42 (QUALITY & RISK MANAGEMENT)

Shaping Practical Standards For Trustworthy & Responsible AI.

In my role within DIN Standards Committee 42, I contribute to the development of AI Quality Management and AI Governance standards supporting implementation of the EU AI Act, including EN 18286.

EN 18286 Quality Management Input

Direct involvement in conformity assessment frameworks enabling organizations to demonstrate regulatory compliance.

IEEE SA Ethical AI Co-Developer

Co-developed and delivered the IEEE SA Ethical AI Certification Program cohorts to international standards partners.

// Standardization & Readiness Alignment

Regulatory Conformity Stack

EU AI Act (Regulation 2024/1689) Statutory Mandate

Enforces legal obligations for high-risk AI deployments in Europe.

Standardized By
DIN Standards Committee 42 (EN 18286) Harmonized Specs

Drafts AI quality management, conformity assessment, and governance specs.

Translated Into Practice By
Naz van Norel Readiness Advisory

Qualified ISO/IEC 42001 and 27001 Lead Auditor. I prepare organisations for the certification audit — I do not perform it.

Interactive Diagnostic Tool

EU AI Act Risk & ISO 42001 Estimator

Evaluate your system's regulatory risk tier under the EU AI Act and estimate baseline ISO/IEC 42001 readiness.

Direct Engagement

Schedule Readiness Scope Call

Connect directly with Naz van Norel to review your AI system architecture, target standard requirements, and readiness scope.

Direct Email naz@aisafsec.com
Location Munich, Germany (81827 Munich)
Mutual NDA executed prior to technical document sharing.