ISO 27001 and NIS2: consultant, software or AI agents?

When a company decides it needs ISO 27001, or finds out that NIS2 applies, the next question is who will do the work. For a long time there were two answers: hire a consultancy, or buy compliance software and do it yourself. A third option has appeared: AI agents that prepare most of the work, with a human engineer alongside. Each of the three can get you to a certificate. They differ in who does what, what stays behind when the project ends and what it costs you in time.

We offer the third option ourselves. We have tried to describe the other two fairly, including the cases where they are the better choice.

Key takeaways

• The question is who does the work, and who keeps doing it after the audit.
• Consultants bring judgement and experience. The documents they write still need someone to run them afterwards.
• Compliance software organises the work but leaves most of the writing, mapping and decisions with your team.
• AI agents prepare the recurring work and keep it current. People approve decisions, and an engineer helps prepare the audit.
• The audit itself is always independent. An accredited certification body issues the ISO 27001 certificate, whichever model you choose.

Option 1: a consultancy

A good consultant brings something no tool replaces: years of seeing how other companies solved the same problem, and the judgement to know which risks matter. They run workshops, write the policies and the risk assessment, build the Statement of Applicability and sit next to you in the audit.

The limits show after the project. The documents describe your company on the day they were written. When people leave, systems change or a second framework arrives, someone has to update them. If that someone is the consultant again, the cost repeats. If it is your team, they inherit documents they did not write. A one-off gap analysis has the same problem: it is a snapshot that starts ageing the day it is delivered.

Option 2: compliance software

Compliance platforms give structure. They come with control libraries, policy templates, task lists and integrations that pull evidence from your cloud and identity systems. For a team that already knows what it is doing, that structure is a real help.

The work itself mostly stays with you. Templates have to be adapted, controls have to be mapped to your systems, risks have to be assessed and evidence gaps have to be chased. In our experience as former CISOs and GRC managers, the software saves most time on evidence collection and least on everything that needs thinking. Teams without a dedicated compliance person often end up paying for a consultant on top.

Option 3: AI agents with a human engineer

Agents change who prepares the work. Instead of handing you a template, an agent drafts the policy from your company’s actual setup. Instead of a checklist, it maps each requirement to your controls and labels it covered, partial or missing. It collects evidence from your systems on a schedule and runs a gap audit every week rather than once a year.

People stay in charge of what needs judgement: risk acceptance, scope decisions, approval of every policy. A compliance engineer helps you prepare for the audit, and an accredited certification body carries out the audit. What stays behind after the certificate is a program that keeps running.

How to compare the three

Ask the same questions of each option:

• Who writes the first version of policies, risk assessment and Statement of Applicability?
• Who keeps them current when the company changes?
• How often are gaps found: once before the audit, or continuously?
• What happens with the second framework? Is it a new project or an extension of the same control set?
• Who is with you in the audit preparation, and who carries out the audit?
• What does your team need to know for the model to work?

Be wary of any answer that promises a fixed percentage saving without explaining where it comes from. What helps is asking who carries which task, and the answer differs from company to company.

When a consultant fits best

There are situations where we would recommend a consultant, on their own or alongside any tool:

• A complex legal question, such as a contested NIS2 classification or a dispute with a supervisor.
• A deep organisational change, where the security program is part of a wider restructuring.
• Specialist technical work, such as penetration testing or the physical security assessment for TISAX® prototype protection.
• A team that wants to learn the craft and has the time to work through it with an expert.

For the recurring work of running a security program, writing and updating documents, mapping frameworks, collecting evidence and finding gaps, agents now do the preparation well, and they do not stop when the project ends.

Where to start

Write down the frameworks you need in the next two years, the people you have and how much of their time compliance can take. Then ask each option to show you, on your own company, how the first month and the second year would look. The models differ most in the second year.

Our AI agents page shows what each agent does, and how GetTeddy works explains the model behind it.