Sign-off
AI projects in the mid-market rarely fail on technology. They fail on the missing sign-off.
AI ASSURANCE
AI Assurance:secure and responsible AI for mid-sized companies
We help companies introduce, implement and sustainably use AI in a secure, compliant and effective way.
Founded by Fabian Hausner · SAP Global Security Advisory LeadRecommendation with implementation
The assessment ends with a clear recommendation: technical, organisational, process and system. On request, we implement it ourselves.
Model-neutral
The choice of model follows your process and your requirements, not a vendor: Anthropic, DeepSeek, Google, Meta, Mistral, OpenAI.
Senior-staffed
Founder-owned mandates. Delivered by a curated team of senior practitioners.
Technology Partners
Partnering with the best
The new reality
The technology is here. The sign-off is missing.
This is the new reality for mid-sized companies: AI tools are available, licences are bought, first pilots are running. What is missing is the organisation's ability to approve an agent, justify it economically and control it in operation.
Not for lack of competence. But because the wrong kind of help is on offer: vendors selling chatbots. Consultants billing hours. Compliance agencies working through checklists.
Woodlands works differently.
Business case
Licences are bought, a chatbot is running. But no process runs end to end, and there is no robust business case.
Control
Management will not put an agent into production whose actions it cannot evidence to customers, auditors and insurers.
THE NEW REALITY
Agents are arriving, planned or not.
This is not a forecast. These are announcements from vendors whose software already runs in your organisation. Agents do not enter through a project you approve. They enter through an update you install.
Through applications
SAP runs more than 50 Joule assistants and more than 200 agents. Salesforce has announced Agentforce with agent-to-agent communication as generally available for the fourth quarter of 2026.
Through identity
Microsoft Entra Agent ID is generally available. Agent identity is now a product reality, no longer architectural theory.
Through the business
The first agent rarely originates in IT. It originates where someone connects a model to a system because it saves time.
What this means for youThe question is not whether agents will act inside your organisation. The question is whether anyone can say under which identity, with which permissions, and under which rule.
THE GAP
Three agents are a pilot. Thirty are a gap.
The first agent is easy. Someone connects a model to a system, it works, it saves time. The tenth is a question nobody can answer: which agent was that, on whose behalf, under which rule, and who approved it.
A chatbot answers. An agent acts. It reads data, operates systems, prepares decisions and triggers transactions. At that point AI stops being a productivity topic and becomes a question of access, permissions and evidence.
The anchor pointSince its guidance of 18 December 2025, Germany's financial regulator BaFin classifies AI systems as network and information systems in the sense of DORA. In a regulated environment AI is therefore not a data science topic and not an ethics topic. It is ICT risk, and ownership moves from innovation to the second line of defence.
We do not come from the AI world.
Woodlands comes from cybersecurity, governance, compliance and enterprise risk. We did not move towards this category. The category moved towards us.
Most AI governance projects end as a PDF. Ours end as a control you can test.
CONTROLSee controlled AI agents
The sequence is the argument.
Control before execution, not logging afterwards. Seven stations between an agent's intent and the evidence about it.
Why this matters commerciallyA portfolio under one set of controls instead of ten isolated solutions each with its own governance. The effort happens once, not per agent.
Scrutiny comes from outside.
Regulators, auditors, customers and insurers do not ask whether you use AI. They ask who approved it and where the evidence is. The control chain settles both before the agent acts.
- Intent
An agent wants to act. Nothing has happened yet.
- Identity
It acts under its own identity. Not a person's, and not a shared service account.
- Permissions
It holds its own permissions. User permissions are not agent permissions, and the shortcut is the fastest route into identity and privilege abuse.
- Rule
The rule is executed, not looked up. A rule nobody can execute is a document.
- Risk
The action is classified. Not everything should run on its own.
- Approval
Above the threshold, a human decides. Approval thresholds are a feature, not a defect.
A human decides here. - Evidence
Who wanted it, who did it, under which rule. The evidence runs alongside; it is not produced afterwards.
Our Approach
Not IT consulting. Not a compliance agency. Not an MSSP.
Woodlands Advisory helps companies use AI in a secure, compliant and effective way. From assessment and AI governance to controlled AI agents.
One department. One process. One agent. One connection. We introduce AI step by step, not as a big-bang project.
We do not just review existing AI. We build the automation ourselves.
Cybersecurity and compliance are where we come from: Compliance Sprint and vCISO Mandate when ISO 27001, NIS2 or ongoing security leadership are on the agenda.
Our approach is built for managing directors, CFOs, IT leads and compliance owners at mid-sized companies who need a basis for decisions, not technical reports.
Services
Five packages. Clear outcomes.
From controlled AI agents to ISO 27001 and NIS2: every mandate has a defined scope and an outcome you can test.
AI Discovery & Process Design Assessment
The right process for an AI agent. Decide on analysis.
Upstream analysis of a specific process before you invest in an implementation. Decision basis, prerequisites and next steps.
Defined in proposal
Details →Controlled AI Agents
AI agents that may act. Under control.
Their own identity, their own permissions, executable rules, approval thresholds and evidence that runs alongside. No platform change and no data migration. Vendor-neutral.
On request
Details →AI Governance
Deploy AI at scale, without governance debt.
For mid-sized companies in DACH. EU AI Act classification, GDPR-compliant LLM use, technical guardrails and one productive pilot use-case. Vendor-neutral.
On request
Details →Compliance Sprint
Audit-ready at boutique speed. Minimal effort on your side.
For B2B enterprises under regulatory pressure. ISO 27001, NIS2, SOC 2, DORA.
Fixed-price programme
Details →vCISO Mandate
Strategic security leadership without full-time costs.
For regulated mid-sized companies. Monthly strategy syncs, quarterly board decks, ongoing risk management.
12-month minimum term
Details →Trust
Trust is an architecture. Not a prompt.
Complete delivery
Chat, workflows, AI agents and the connection to your systems. We build and run your AI department, from the first process to company-wide use.
All integrationsEnterprise security
The platform we build your AI department on is ISO 27001 and SOC 2 Type II certified. GDPR-compliant, with a data processing agreement and no training on your data.
Flexible deployment
Which deployment model fits your IT policies, your data protection requirements and your company size is something we decide together within the engagement.
Model-neutral
No lock-in to a single model provider. Model choice follows your process and your requirements: Anthropic, DeepSeek, Google, Meta, Mistral, OpenAI.
All modelsRegulatory Coverage
EU AI ActDSGVONIS2DORACRA
EU AI ActDSGVONIS2DORACRA
EU AI ActDSGVONIS2DORACRA
EU AI ActDSGVONIS2DORACRA
EU AI ActDSGVONIS2DORACRA
EU AI ActDSGVONIS2DORACRA
Data ActTDDDGCSADGACSRD
Data ActTDDDGCSADGACSRD
Data ActTDDDGCSADGACSRD
Data ActTDDDGCSADGACSRD
Data ActTDDDGCSADGACSRD
Data ActTDDDGCSADGACSRD
ORIGIN
Woodlands is a golf course. The first one the founder ever played. A place that existed long before the company did.
Growth needs security. Not someday. Now.
Whether you are introducing AI, automating a process or preparing for a certification: Woodlands delivers predictable results.
Schedule Initial Consultation →
20 minutes. Confidential. No obligation.