AI management system · Information security

Inventory AI Usage. Assess Risks. Determine Mitigations.

I support upper management, heads of IT and quality managers in mid-sized companies in Germany. Together, we inventory active AI tooling across your organization, assess risks for each application, and map results to a prioritized remediation plan. For continuous, verifiable oversight, I help you build an AI management system under ISO/IEC 42001 in collaboration with your staff. I can also assist you with NIS-2 compliance—most efficiently by building on pre-existing management systems like ISO 9001 or ISO/IEC 27001.

Book an initial call

Three Out of Four Companies in Germany Provided Their Employees No Approved AI Tools in 2025

A 2025 Bitkom survey of German enterprises revealed that only 26% provided approved AI tools to staff, only 23 percent had binding rules for using AI, and in more than four out of ten companies, those responsible knew or suspected that employees were using private AI tools at work.

Since then, the share of companies using AI has risen from 36 to 57 percent (Bitkom 2026). If you do not know which AI tools are in use and what data is entered into them, you can neither assess nor limit the risks of this use. That is why everything starts with an inventory: the AI inventory.

Sources: Bitkom press releases (in German) from October 2025 and September 14, 2026

You can create the AI inventory yourself: the whitepaper "Managing AI Risk in Your Enterprise" includes an Excel template for it. If you would like support, I create the AI inventory together with your head of IT in the Shadow AI Check.

Whitepaper with template Shadow AI Check

Services

The AI Compliance Dossier answers customer inquiries in due diligence questionnaires (DDQs). The Shadow AI Check shows which AI tools are actually used in your company, and the training enables your employees to use AI tools with the necessary competence. If the review needs to take place regularly and verifiably, or a customer requires certification, I build a management system in accordance with ISO/IEC 42001 or ISO/IEC 27001 with you.

The AI Compliance Dossier: Ready for B2B Procurement Reviews

When customers or buyers ask about your use of AI in due diligence questionnaires (DDQs), the AI Compliance Dossier provides the right answers—as a structured self-declaration, without a certification audit and at a fraction of the cost of full certification.

More about the AI Compliance Dossier

Answers without delay: The dossier contains prepared answers to the usual AI questions in B2B security reviews. They're ready when a request lands on your desk and complement your existing information security answers.
Evidenced, not just claimed: Every answer is backed by specific documents: AI inventory, AI policy, RACI responsibilities, risk assessments and training records. If a document is missing, we build it together—turning a sales obstacle into verifiable evidence.

The Infosec Compliance Dossier: Evidence-Backed Answers to Your Customers' Security Questions

Clients and buyers routinely probe your information security via vendor security questionnaires—covering access rights, backups, disaster recovery, and third-party risk management. If your clients fall under NIS-2, the law requires them to manage security risks in their supply chain—and vendor questionnaires are how they do it. The Infosec Compliance Dossier gives you clean, structured answers—ready to use, without an expensive certification audit.

More about the Infosec Compliance Dossier

Derived from real-world assessments: Built on over 2,000 questions across 27 sources, including BSI C5, VDA ISA, CSA CAIQ, and the BSI NIS-2 supply chain checklist. The dossier targets what enterprise procurement teams actually ask.
15 core documents, tailored to your work: from the security policy and access and contingency concepts to a ready-made Q&A catalog. Add-on modules cover special topics such as software development, IT/cloud operations, your own server room, or on-site work at customer premises.
A first step toward certification: The documents feed into a later ISMS under ISO/IEC 27001.

Shadow AI Check With AI Inventory

Together with your head of IT, I record which AI tools are actually used in your company—including those nobody has approved. The result is an AI inventory: which tools, in which departments, with which data. The AI inventory feeds into a later AI Compliance Dossier or AI management system.

Whitepaper: Managing AI Risk

AI Literacy Training

Article 4 of the EU AI Act requires providers and deployers of AI systems to take measures that promote the AI literacy of their staff. Since the amendment by Regulation (EU) 2026/1744, a specific level of competence no longer has to be guaranteed; the duty to act remains. I train management, specialist departments and IT, each with content for their tasks, and document content and attendance. This allows you to show which measures you have taken.

AI Management System Under ISO/IEC 42001

An AI inventory is just a single point-in-time snapshot. When new tools or new purposes are added, the review has to be repeated. ISO/IEC 42001 describes a management system for this. I build it with you: scope, AI policy, roles, risk and impact assessment and the statement of applicability. Because ISO/IEC 42001 has the same high-level structure as other ISO management system standards, it can be integrated into an existing quality or information security management system. If customers require proof of how you handle AI, I prepare you for the certification audit. The audit itself is carried out by a certification body.

ISMS Under ISO/IEC 27001 Including NIS-2 Requirements

Germany's NIS-2 Implementation Act has been in force since December 6, 2025, with no grace period. Regulated entities must implement risk management controls under Section 30 of the German BSI Act (BSIG); executive leadership bears personal liability under Section 38 BSIG. An ISMS in accordance with ISO/IEC 27001 is an obvious framework for it. I work with you on the gap analysis, the risk register, the statement of applicability and a mapping of the requirements of Section 30 BSIG to the controls in Annex A of the standard. Combined with an AI management system, this creates a joint risk process for information security and AI.

Whitepaper: Implementing NIS-2 on the Basis of ISO 9001

Approach

This is how we work together—whichever service you choose.

Initial Discovery Call

Tell us about your use case—whether you’re responding to a client compliance questionnaire or investigating potential shadow AI. By the end of the call, you’ll know exactly which service fits your needs and what level of effort is required on your end.

Proposal & Scope

You’ll receive a written proposal detailing the scope, deliverables, and timeline. To keep expectations clear, any deliverable not explicitly listed in the proposal is considered out of scope.

Confidentiality & Access

Before reviewing any internal documents or software, we’ll execute an NDA. I operate strictly under the access rights authorized by your Head of IT.

Deliverables & Handoff

You retain full ownership of all deliverables. Everything is handed off in maintainable formats—such as Excel, Word, or directly within your existing compliance platform—so you are never locked into a vendor dependency.

Resources

Technical whitepapers for leadership, IT heads, and quality managers—100% free, no sign-up needed.

Whitepaper · PDF

Implementing NIS-2 on the Basis of ISO 9001

Transitioning from quality management to robust information security governance—with a worked example, roadmap and evidence model for mid-sized companies

Organizations with an active ISO 9001 system don't need to build a NIS-2 compliance framework from scratch. They extend their existing system and put budget and expertise where NIS-2 genuinely requires something new: in the security measures. The whitepaper shows which obligations apply now, which parts of your quality management system you can reuse and where you need to build from scratch.

To the whitepaper

Whitepaper · PDF · with Excel template

Managing AI Risk in Your Enterprise

The key sources of risk when using AI—and the measures that limit them

This guide for management and heads of IT gives factual information on the key sources of risk when using AI—from passing on confidential data to unchecked AI results. For each risk source, it names recommended measures. With the Excel template, you can carry out your first AI risk inventory yourself.

To the whitepaper

About Me

I have been working intensively with generative AI since 2023—and that is exactly where I recognized the growing need for clear compliance and information security. Today, I help mid-sized companies integrate AI into their business processes according to clear rules and without bureaucratic overkill.

My work combines technical practice with many years of B2B experience: for the SMITS project, I am currently developing a market analysis system that evaluates information security job advertisements using LLMs and SQL pattern recognition. Before that, I was a product manager at InfoOffice GmbH and marketing director at Red Dot Solutions in New York, where in my first year I also implemented software and designed editorial workflows.

I also bring more than 15 years of experience in training specialists and managers—among others for automotive suppliers, machine builders and large corporations, for individual clients with documented training objectives. As a result, I do not just produce abstract policies, but practical compliance processes that teams understand and support.

As a native English speaker who has lived and worked in Germany for many years, I work with you in English or German—and can bridge the two where your group language and German law meet.

AI governance and information security

Derek Carson

Passed the Lead Implementer exams for ISO/IEC 42001 and ISO/IEC 27001 · ISC2 Certified in Cybersecurity · English, German, Spanish

What I Do Not Take On

Legal opinions are provided by your lawyer, certification audits are carried out by a certification body, and penetration tests are performed by specialist providers. I tell you where one of these services is needed, so you know whom you need for it.

For Consultants in Data Protection, Compliance and Information Security

If your clients ask about AI, I take on that part of the engagement: AI Compliance Dossiers, AI management systems under ISO/IEC 42001 or AI literacy training—under your brand or together with you. In ISMS projects under ISO/IEC 27001, I support you with implementation, including linking it to an AI management system. You keep the client relationship; I provide the AI expertise.

Contact

Location

Künzell near Fulda, Germany
On-site appointments throughout Germany, also remote

Email

derek@carson.de

Phone

+49 661 9452622