Advisory

Advisory for mid-sized companies

First the assessment, then the direction: aligning AI for the future.

AI assessment, EU AI Act, NIS2, GDPR and ISO for mid-sized companies, plus customer service, operations and outsourcing

In many mid-sized companies, AI has long since arrived in everyday work, often faster than the rules and details for it, and the topic usually lands with the few people who already carry a lot. My approach: I sit down beside you. Together we clarify where you stand, go through the requirements openly and work out what needs to be done. The result is a direction that fits your teams, your processes and the German and European rules, for the AI just as much as for the people behind it.

Arrange a first meeting See the topics

free of charge and without obligation

Björn-Olaf Lange in a jacket, smiling and leaning against a brick wall

How you know it is time

It usually starts with a very specific situation at work, somewhere between two meetings. Perhaps you will recognise yourself in one of these.

AI and regulation

  • An AI tool such as Microsoft Copilot has been switched on, and nobody has said yet which data may go in and which stays out.
  • A customer's supplier questionnaire asks how you handle AI or whether you hold a certificate, and the answer is due by Friday.
  • IT, data protection and information security rest on one or two people, and every new question ends up with them again.
  • You are wondering whether NIS2 applies to you and what management would then have to do.
  • The budget for 2027 is coming up, and AI should be more than a line for licences in it.

In customer service or with your BPO

  • The contract with your service provider is about to expire, and you want to decide afresh: renew, put it out to tender again or bring it back in-house.
  • The cost per contact is rising faster than your customers' satisfaction.
  • A tender is coming up, and in the end the offers should be truly comparable, rather than each provider answering a different question.

Where you stand

Six topics, calmly sorted

They often arrive at the same time and overlap. For each one you will find what applies and what it means for you in everyday work.

EU AI Act

What applies

The AI Act sorts AI by risk level: the more is at stake for people, the more care it demands. This already affects you if you use AI in your business, because since February 2025 it has been your job to strengthen the people in your teams in how they work with it. Since August 2026, transparency obligations have been added, for example for chatbots and AI-generated content, so that everyone knows what they are dealing with. It pays to look especially closely at AI systems and processes that help decide about people: systems intended to select candidates or evaluate performance fall into the high-risk category, whose obligations apply from December 2027.

What it means for you

For most companies, this means first of all: knowing which AI is in use, enabling your people and recording what you do about it. If you use a general-purpose tool specifically in HR, it is best to clarify this before you start.

On the blog (in German): EU AI Act, 2 August 2026: what applies now

GDPR and BDSG

What applies

As soon as AI processes personal data, the familiar principles apply: legal basis, purpose limitation and transparency. AI in HR almost always involves employee data as well. Under the German Federal Data Protection Act, you generally need a data protection officer once at least 20 people are constantly involved in the automated processing of personal data (Section 38 BDSG).

What it means for you

For many AI projects, the bottleneck is the question of which data may go in. If you bring your data protection team in early, rather than asking them for a signature at the end, the rollout runs much more smoothly.

On the blog (in German): Recording is not the problem. What you do with it afterwards is.

Works council and co-determination

What applies

If you have a works council, you inform it in good time about planned work processes, expressly including the use of AI, and consult with it early enough for its proposals and concerns to be taken into account in the planning (Section 90 of the German Works Constitution Act, BetrVG). For technical systems that can be used to monitor behaviour or performance, it has a right of co-determination (Section 87(1) no. 6 BetrVG), and that applies to many AI tools. If it has to assess AI, bringing in an expert is deemed necessary (Section 80(3) BetrVG). From December 2027, the AI Act also requires employers to inform workers' representatives and the affected workers before using high-risk AI in the workplace.

What it means for you

Bring your works council on board from the start, ideally when the tools are being chosen. I talk to it as well, involve it in the assessment and make clear what a system can do and what happens to the data. That is how I build bridges, and co-determination becomes a joint project in which concerns are raised early, while everything can still be shaped.

NIS2 and the German BSI Act

What applies

Since December 2025, the German BSI Act (BSIG) has implemented the European NIS2 Directive in Germany. It covers companies in the sectors it lists, in many cases from 50 employees or more than ten million euros in both annual turnover and balance sheet total. Whether this applies to you is something you check yourselves. Those affected must register with the BSI, Germany's Federal Office for Information Security, within three months and implement risk management measures, while management oversees the implementation and regularly attends training.

What it means for you

It starts with the self-check, and the BSI offers an applicability check for that. If you have been covered since December 2025 and have not yet registered, it is best to catch up now. With ISO 27001 you already have a good foundation for risk management.

ISO 27001 and ISO 42001

What applies

Both standards describe management systems: ISO 27001 for information security, ISO 42001 specifically for AI. They are voluntary and give customers and partners visible proof that you manage information security and AI in a structured way.

What it means for you

If you already live ISO 27001 or another standard, you build on what is there for AI and extend it. The goal is a secure and transparent process that stays alive after the audit.

On the blog (in German): ISO certification and AI: turning the audit sprint into a quality process

Microsoft Copilot and the AI budget

What applies

Microsoft 365 Copilot is now called Microsoft Copilot, and some licences and features still carry the old name for a transition period. Copilot uses everything a person is allowed to at least view in Microsoft 365, and only that. This suddenly makes permissions that have grown over the years in SharePoint and Teams important, as Microsoft itself expressly points out. Alongside the fixed licence, Microsoft bills more and more services by consumption in Copilot Credits, for example agents that start on their own.

What it means for you

Before a broad rollout, it pays to look at permissions, data storage and your contracts with AI providers. For the 2027 budget, this means planning not only the licences but also the work that AI does.

On the blog (in German): How do we budget for Copilot and AI agents in 2027?

My overview helps you get your bearings and brings clarity to the topics. Other regulations also apply alongside them, such as the EU Data Act for connected products and cloud contracts. I place them in context during the assessment, and where they might apply, they go on the list of regulations to be checked. The legal assessment of your individual case needs support and sign-off from a lawyer.

The direction

Three building blocks for AI in your everyday work

Each building block can be commissioned on its own. I almost always recommend starting with the assessment, because it shows where your effort really pays off.

01

Assessment

Together we look at which AI is actually running in your company, especially the AI that was never officially introduced. Then we clarify where it touches data, which risk level the AI Act assigns to it, which other regulations come into play, what it costs you and which use cases are worth the money. The result is an honest map, including where it is uncomfortable: what works well, what needs documenting and what takes priority.

02

A management system that holds up

Roles, policies, documentation and audit preparation along ISO 27001 and ISO 42001, and where NIS2 applies, the risk management that management implements and oversees. I take care of the writing, your people contribute their knowledge of the business. I have been through many certifications myself and know the difference between a “quality manual” that survives the audit and a process that lives on sustainably afterwards.

03

Training and enablement

Since February 2025, supporting the AI literacy of your teams has been part of your job. This means the people who work with AI every day. I offer tailored training for employees and leadership, documented with agenda, materials and confirmation of attendance, and support you with clear guardrails for everyday work, so the rules land in the business.

Training

The fastest lever is almost always training, not a document. Since February 2025 the EU AI Act has required companies to take measures to support the AI literacy of their staff, and that is often exactly where things get stuck when a tool is simply switched on. I run the sessions myself, on site or remote, in the language of your everyday work rather than in legal clauses, in German or English. Training also works as a standalone module, without ordering a complete management system alongside.

Fundamentals for everyone

What the tools can do, where they reliably get things wrong and which data must never go in. The foundation for AI literacy under the EU AI Act, with examples from your own working day, so that everyone gets started with confidence afterwards.

Copilot and Microsoft 365

For teams where Copilot is already running: what may go in, what stays out, how to recognise confidential content, and what good use actually looks like.

Leadership and management

Risk tiers, liability, responsibilities and decision paths, with a view to NIS2 and co-determination where needed. Compact and candid, so you know what you are approving when you approve something.

Multipliers in the business

So the knowledge stays with you once I leave: I bring a handful of your people far enough that they can train others and answer questions themselves. My goal is that you can carry on on your own afterwards. I am always happy to come back, though.

Customer service and outsourcing

The same logic in service: first the assessment, then the direction

Before AI became my focus, I led service and operations organisations for almost twenty years, with people, KPIs and all those days when everything happens at once. I know outsourcing from all three sides of the table: from the company that hands work out, as the consultant who supports the tender and selection, and from the side of the service provider who ultimately delivers the work. That is why I know where things tend to grind between the sides.

01

Assessment and strategy for your service

Where does your service stand today, where should it develop, and how will you know it has arrived? We work this out together with your teams, because they usually know best where things get stuck. From this come goals that cascade from the leadership team down to the teams, and a strategy that holds up in everyday work.

On the blog (in German): Series: developing a service strategy

02

Outsourcing: keep it, hand it out or both

It starts with your own reason, and only then comes the list of providers. I help you position outsourcing properly, build the tender, make offers comparable and support selection and award, with a service description and KPIs that measure more than the answer rate. Sometimes the honest answer is to do it yourselves, and then I will tell you exactly that.

On the blog (in German): Series: outsourcing in customer service, on tenders especially part 2: what you should really ask

03

AI in customer service

This is where both fields meet. At ThinkOwl, I prepared and planned the introduction of AI at enterprise customers as a senior consultant, tested it internally on the technical side, supported it and was responsible for it, together with our technical consultants on site. The framework reduced handling time by an average of 22 per cent (ThinkOwl, own project figures). My principle: automation where it helps, people where they make the difference, and the rules built in from the start.

On the blog (in German): Automation vs. augmentation: what AI should really deliver

I work out the service description, KPIs and service levels with you. I also show how the contract works operationally for the service provider and prepare the subject-matter and operational points for the contract review in detail. The legal review and sign-off are handled by your law firm.

How we work together

  1. Getting to know each other

    A conversation, free of charge and without obligation, ideally at your premises. You tell me, I listen and ask questions: where the pressure is, who should be at the table, with AI also your works council if you have one, and what you want to achieve.

  2. Assessment

    I look at what is running in your company today, in AI, data, processes or service, and talk to the people who do the work, to your works council where there is one, and especially to those who have concerns, because they often see risks first. The result fits on a few pages and is clear enough for management to see quickly where you stand.

  3. Roadmap

    The map becomes a roadmap with priorities, responsibilities and realistic timelines, matched to what your team can manage alongside day-to-day business.

  4. Implementation and training

    We implement together: policies, roles, processes and the training that brings the rules into everyday work. I stay at your side until it runs, and your team keeps a clear head for day-to-day business.

  5. Follow-up

    After a few weeks we review together what is working and where we adjust. I also ask questions where it gets uncomfortable, because the result should stay with you for good.

Why me

I come from operations. For almost twenty years I led service and operations organisations, introduced AI where it had to work in everyday business, and went through audits and certifications on the company side, from ISO 22000 and ISO 13485 to SOX. Between the law firm that knows the legal text and the vendor that supplies the tool, I sit on your side, where operations and audit meet. The attitude behind this has a name, and I have written a whole book about it: Das Caretaker-Gen (in German). For you, this means: I listen, take responsibility and say clearly what I see, even when it is uncomfortable, because I care about you and your results.

“The responsibility stays with you, we carry the load together.”

What I take on

I take on structure, processes, roles and capability, in other words what you need to meet requirements in everyday work. The legal assessment of individual cases belongs with a lawyer, and when a question belongs there, I will tell you openly.

What I have written about it

Show rather than tell: in these articles you can read how I think and approach topics, even before we meet. They are written in German.

To take away: the AI Budget Model 2027

An Excel model with a manual for Copilot and AI agents, covering licences, consumption, operations, rollout and the benefit of each use case. Free of charge, no registration, under CC BY 4.0. Model and manual are available in English, the article behind them in German.

Download model and manual Manual as PDF

AI and regulation

Customer service and outsourcing

All articles on the blog

Frequently asked questions

Do we need AI training?

To be honest, the law does not prescribe training. But since February 2025 it has required companies that use AI to take measures for their staff's AI literacy, and no certificate is needed for that. Training is usually the fastest and most tangible route, ideally tailored to the tools you actually use and recorded with agenda, materials and a list of participants.

Does the AI Act apply to us?

Probably yes. As soon as you use an AI system professionally, you are a deployer in the language of the law. This means that at least the rules on AI literacy apply to you and, depending on the use, the transparency obligations. Which further obligations apply depends on the risk level of your applications, and that is exactly what we clarify together in the assessment.

Does NIS2 apply to us?

That depends on your sector and your size, and you have to check it yourselves. The German BSI Act lists the sectors in two annexes, and for many companies the obligations start at 50 employees or more than ten million euros in both annual turnover and balance sheet total. A good first step is the BSI's applicability check, because those affected must register with the BSI within three months. The binding assessment of your case belongs with a lawyer, and I support the structure and implementation afterwards.

Do we need to involve the works council when it comes to AI?

If you have one, yes, and early. You inform it in good time about planned work processes involving AI and consult with it early enough for its concerns to be taken into account in the planning (Section 90 of the German Works Constitution Act, BetrVG). If a system can be used to monitor behaviour or performance, the works council has a right of co-determination, and that applies to many AI tools. I involve the works council from the start and create transparency, because starting together is usually faster than reaching agreement later. The legal assessment of your individual case belongs with a lawyer.

Should we outsource our customer service?

That depends on your reason. Languages, peak loads, availability or headcount can all be good reasons, and if you know yours, you decide on more than price. Often the most sustainable answer is a mix of your own people and a partner.

Contact

The first step is a conversation.

Tell me briefly where things are pressing for you right now, whether in AI, regulation or service. I will reply to you personally. The first meeting is free of charge and without obligation, and I am happy to come to you.

Write a message

Or directly by email kontakt@langeatn.de

To be straightforward about it: I am building this practice right now, after almost twenty years in permanent employment. What sits behind it is nothing new, though, it is what I have been writing about publicly for the past eighteen months and what I was responsible for in companies before that. If the topic is on your mind, simply get in touch, a first conversation costs nothing.