Naz van Norel
AI Assurance for Businesses — Without the Big-Consulting Price Tag

Engineer. Political Scientist.
Implementor & Readiness Advisor.

I am Naz van Norel. I bridge 33 years of Siemens project and process engineering experience with global AI compliance frameworks (ISO/IEC 42001, ISO 27001, IEEE SA CertifAId, and EU AI Act / EN 18286).

Schedule Readiness Scope Call Open Project Portfolio Page

AIMS Standard

ISO 42001 Lead Auditor

ISMS Standard

ISO 27001 Lead Auditor

Ethics Assessor

IEEE SA CertifAId

Standardization

DIN NK 42 Expert

Two reasons companies are acting now

One comes from your customer, the other from the market surveillance authority. Both apply whether you build AI systems or simply deploy them.

Reason 1 · The customer

The supplier questionnaire

Enterprise buyers and public sector clients are extending supplier due diligence to cover AI: how do you classify your systems, who owns AI risk, are you certified to ISO/IEC 42001 or planning to be?

Failing to answer rarely loses the deal outright — but the procurement stalls, and next time you are not asked. For most small vendors this is the more expensive of the two.

Reason 2 · The regulator

Article 50 already applies

The Digital Omnibus postponed the Annex III high-risk obligations to 2 December 2027. Article 50 was deliberately excluded from that deferral. The transparency duties have applied since 2 August 2026 and are enforceable by national market surveillance authorities.

They attach regardless of risk class: if your system talks to people, generates content, or reads emotions, you are in scope. Penalties reach €15 million or 3% of worldwide turnover.

Core Offerings

Fixed-Scope Readiness Services

Transparent, execution-focused engagements for Chief Risk Officers, CTOs, and engineering leads who need an independent expert assessment before a certification body arrives.

Start here · Obligations already in force Package D

EU AI Act Article 50 Transparency Check

For: Any company putting a chatbot, AI assistant, or generative feature in front of users in the EU — whether you built it or bought it.

This one is not deferred. The Digital Omnibus postponed the high-risk regime to December 2027. It did not touch Article 50. Transparency obligations have applied since 2 August 2026 and are enforceable now by national market surveillance authorities. Penalties reach €15 million or 3% of worldwide turnover.

Article 50 applies to your system because of what it does, not how it is classified. If it talks to people, generates content, or reads emotions, the duties attach — high-risk or not. They also split between the company that develops the system and the company that deploys it, and most organisations do not know which side they are on.

What you will receive  (7)
  • Operator role determination for each system — provider, deployer, or both. Everything else depends on this answer, and it is the one most organisations get wrong.
  • Screen against Article 5 prohibited practices and Annex III high-risk classification — some chatbots, including those used in hiring or access to essential services, are high-risk
  • Article 50(1) review: is the AI identification present, clear, and shown at the right moment in the user journey
  • Article 50(2) machine-readable marking status for generative output, against the 2 December 2026 deadline for systems already on the market
  • Deployer-side duties under Article 50(4) for AI-generated public-interest text and deepfake disclosure
  • Vendor contract review where you deploy someone else’s system — using a third-party bot does not transfer the duty, and most contracts signed before August are silent on who holds what
  • Article 4 AI literacy obligation, which binds providers and deployers alike

What we need from you: A list of your AI-enabled features, access to or screenshots of the user-facing flows, and any vendor contracts where you deploy a third-party system.

Duration 1 week
Your team’s effort ~3 hours
Fee €1,900 fixed
No VAT is charged (small business scheme, § 19 German VAT Act). The amount shown is the total payable.

Outcome: You will know which duties are yours, which sit with your vendor, and what to change before 2 December — with the fixes listed in the order they matter.

Request Package D Scope

Not sure which you need?

“We run a chatbot or generative feature and don’t know what applies to us.” → Package D “We need to get certified to ISO/IEC 42001.” → Package A “A customer or regulator wants proof our AI is fair and explainable.” → Package B “We sell AI into the EU and need to know what the AI Act requires.” → Package C “More than one of the above.” → A and C share ~40% of their evidence base. Ask about combining.
AIMS & ISMS Governance Package A

ISO/IEC 42001 Readiness Assessment

Where you stand against ISO/IEC 42001:2023 — Clauses 4 to 10 and Annex A — and what to fix first.

Who it’s for & what it covers

Who it’s for: Organisations preparing for ISO/IEC 42001 certification, or establishing an AI Management System for the first time — particularly those already certified to ISO/IEC 27001.

A structured evaluation of your AI Management System against the full requirements of ISO/IEC 42001:2023 — Clauses 4 to 10 and the Annex A control set — mapped against your existing ISO/IEC 27001 controls so you extend what you have rather than duplicate it.

What you will receive  (5)
  • A conformity gap register covering every requirement in Clauses 4–10, stated finding by finding against the evidence reviewed
  • An Annex A applicability review and a draft Statement of Applicability — the document your certification body asks for first
  • Assessment of your AI risk and AI system impact assessment methodology against Clauses 6.1.2 and 6.1.4
  • An ISO/IEC 27001 overlap map identifying controls that already satisfy 42001 requirements
  • A 30-day executive remediation roadmap, prioritised by what actually blocks certification

What we need from you: Twelve baseline documents, requested up front. Most organisations already hold eight to ten of them.

Duration 2 – 3 weeks
Your team’s effort ~8 hours
Request Package A Scope
Ethical Value Assessment
System Ethics Package B

IEEE SA CertifAId™ Ethical Value Impact Assessment

Delivered by a credentialed IEEE SA CertifAId Lead Assessor.

A formal assessment, not readiness preparation. Unlike Packages A and C, this produces an official IEEE SA CertifAId Assessor Evaluation Report.

Who it’s for & what it covers

Who it’s for: Organisations that must demonstrate ethical assurance to customers, procurement functions, or regulators — and need an assessment carrying an assessor credential rather than a self-declaration.

Where ISO/IEC 42001 assesses whether you have a management system, CertifAId assesses whether your systems behave ethically in operation: algorithmic fairness, explainability, privacy protection, and accountability.

What you will receive  (4)
  • Algorithmic bias and discrimination testing, with the statistical fairness metrics applied and their results
  • Evaluation of your explainability (XAI) methodology against intended audience and use context
  • Data privacy protection and governance assessment
  • Official IEEE SA CertifAId Assessor Evaluation Report — placeable in front of a customer, procurement panel, or regulator

What we need from you: Model cards, training and validation data documentation, any existing fairness test results, and access to the system or a representative environment.

Duration 3 weeks
Your team’s effort ~12 hours
Request Package B Scope
EU AI Act Statutory Package C

EU AI Act & EN 18286 Readiness

Assessed by a contributing member of DIN NK 42, the committee developing EN 18286.

What the AI Act requires of you, for which systems, by when — and where you stand against EN 18286:2026.

Who it’s for & what it covers

Who it’s for: Providers and deployers placing AI systems on the EU market who need to establish their obligations under Regulation (EU) 2024/1689 and position for the harmonised standards.

Determination of your obligations under the EU AI Act and alignment of your quality management system with EN 18286:2026 — the first European standard published in support of the Act.

Standards status EN 18286:2026 was approved by CEN-CENELEC in July 2026 and published. It is not yet cited in the Official Journal of the EU, so implementation does not currently confer presumption of conformity under Article 40. We assess against the published text so you are positioned when citation lands rather than starting then.
What you will receive  (5)
  • Operator role determination — provider, deployer, importer, distributor or authorised representative — and per-system risk classification under Articles 5 and 6, including any Article 6(3) derogation assessment
  • Obligation mapping across Articles 9–15 for systems classified high-risk
  • Annex IV technical documentation review against Article 11
  • Fundamental Rights Impact Assessment scoping and review under Article 27
  • EN 18286:2026 quality management system gap map against Article 17

Timing: The Digital Omnibus postponed obligations for standalone Annex III high-risk systems to 2 December 2027. This extends the preparation window; it does not remove the obligations.

Duration 3 – 4 weeks
Your team’s effort ~14 hours
Request Package C Scope
Confidentiality

How your documents are handled

Your AI policies, risk assessments and technical files are among your most sensitive material. How they are handled is agreed with you before anything is shared — never assumed.

You decide how your documents are processed

Processing arrangements are fixed in writing at scoping. Options include review carried out entirely without AI assistance, or AI-assisted review conducted inside your own governed environment. Nothing is used that you have not agreed to.

Every finding is verified by a named assessor

Whatever the method, no finding reaches your report without human verification against the source document. Every finding carries a locator — document, section, page — so you can check it yourself.

Limited access, defined retention

Confidentiality terms are agreed before documents change hands. Access is restricted to the named assessor. Retention periods and deletion are fixed at the outset, and your documents are deleted on request.

Where you already operate a governed AI environment, assessment work can be carried out inside it, so your material never leaves your own perimeter. Where you would rather no AI tooling touch your documents at all, that is a standard option and carries no change in scope or price.

Scope of services Packages A and C are readiness services. They prepare your organisation for a certification audit; they are not that audit, and no certificate is issued. Certification against ISO/IEC 42001 is issued only by an accredited certification body, and engaging an independent readiness advisor places no restriction on which body you may then use. Package B is a formal assessment under the IEEE SA CertifAId programme, delivered under assessor credential.
DIN STANDARDS COMMITTEE 42 (QUALITY & RISK MANAGEMENT)

Shaping Practical Standards For Trustworthy & Responsible AI.

In my role within DIN Standards Committee 42, I contribute to the development of AI Quality Management and AI Governance standards supporting implementation of the EU AI Act, including EN 18286.

EN 18286 Quality Management Input

Direct involvement in conformity assessment frameworks enabling organizations to demonstrate regulatory compliance.

IEEE SA Ethical AI Co-Developer

Co-developed and delivered the IEEE SA Ethical AI Certification Program cohorts to international standards partners.

// Standardization & Readiness Alignment

Regulatory Conformity Stack

EU AI Act (Regulation 2024/1689) Statutory Mandate

Enforces legal obligations for high-risk AI deployments in Europe.

Standardized By
DIN Standards Committee 42 (EN 18286) Harmonized Specs

Drafts AI quality management, conformity assessment, and governance specs.

Translated Into Practice By
Naz van Norel Readiness Advisory

Qualified ISO/IEC 42001 and 27001 Lead Auditor. I prepare organisations for the certification audit — I do not perform it.

Naz van Norel

Naz van Norel

AI Governance Readiness Advisor · Qualified Lead Auditor

Mother of 2 Young Adults
German Citizen (Immigrated 27 years ago)
Munich, Germany Based
Behind the Advisor

Engineering Precision Driven By Human Values.

Beyond international standards and software engineering audits, my work is rooted in real-world human impact. As a mother of two young adults and an immigrant who made Germany my home 27 years ago, I understand that technology is not built in a vacuum—it reshapes societies, opportunities, and future generations.

With 33 years of Siemens engineering experience, degrees in Electronics Engineering and International Policy (LMU Munich), and experience founding Germany's first female-led AI academy, I help businesses build AI systems that are demonstrably safe, defensible, and human-centric.

Siemens Seniority

60+ global software process and technology audits across Europe, USA, Africa, and Middle East.

Standardization Committee

Directly contributing to EN 18286 AI quality standards in DIN Standards Committee 42.

Why smaller companies work with me

One point of contact

You speak with the person doing the assessment. No junior team, no rotating contacts, no subcontracting.

Engineering background

Electronics engineer with 60+ process and technology audits. I understand how your systems are built, not only how the standard reads.

Predictable cost

Fixed fees with defined scope. No day rates that multiply mid-project, and no structure built for enterprise budgets.

Free quick check

Which obligations apply to you?

Four questions. You get a first read on your role under the AI Act, the risk class of your system, and whether the Article 50 transparency duties already bind you.

This quick check gives a first orientation based on your answers. It is not a case-specific classification and not legal advice. Determining role and risk class definitively requires examining the actual system and its deployment context.

Direct Engagement

Schedule Readiness Scope Call

Connect directly with Naz van Norel to review your AI system architecture, target standard requirements, and readiness scope.

Direct Email naz@aisafsec.com
Location Munich, Germany (Togostr. 17a, 81827 Munich)
Mutual NDA executed prior to technical document sharing.