Question 1

What is NormPilot?

Accepted Answer

NormPilot is a SaaS platform that guides small and medium-sized businesses step by step through the implementation of ISO management systems. We currently support ISO 45001 (occupational health & safety), ISO 14001 (environmental management) and ISO 50001 (energy management).

Instead of expensive consulting engagements, you get a guided wizard, AI-drafted policies and procedures, a risk register, a CAPA hub for actions, and printable audit reports — all in one application, bilingual DE/EN.

Question 2

Who is NormPilot built for?

Accepted Answer

NormPilot is built for companies with roughly 10 to 250 employees in the DACH region that want to build or maintain an ISO management system without an in-house compliance team or a multi-thousand-euro consulting budget.

Typical profiles:
- First-time implementation of ISO 45001 or ISO 14001
- Energy-intensive operators with ISO-50001 obligations under EDL-G
- Companies running multiple standards in parallel

Question 3

How is NormPilot different from an ISO consultant?

Accepted Answer

Classic ISO consulting engagements typically cost between €5,000 and €25,000 and run four to nine months. NormPilot replaces most of that work with a guided wizard, AI suggestions, and pre-built templates — you provide the inputs, NormPilot provides the structure and documents.

Punctual consulting still makes sense for narrow expert tasks (complex hazard assessments or external energy audits); the rest you can do yourself. Our target: audit-ready in weeks, not months.

Question 4

What does NormPilot cost?

Accepted Answer

Three plans — Starter (1 ISO standard, from €99 / month), Growth (2 standards, from €199 / month) and Pro (all 3 standards, from €399 / month), plus VAT. Plans differ only in the number of activated ISO standards and the number of team members. The feature set is identical across plans — wizard, risks, AI suggestions, audit reports, and (when ISO 50001 is active) the §6.3 energy review.

No setup fee, monthly cancellation. Final terms are confirmed in an initial call — self-service plan management ships with our upcoming billing release.

Question 5

How do I delete my account or my organisation?

Accepted Answer

You can delete your account and your organisation at any time. Self-service deletion (GDPR Art. 17) is being implemented; until it ships, please contact us via the contact form or email b.lambernd@gmail.com.

We delete all personal data and your organisation's content within 30 days and confirm deletion in writing.

Question 6

Which ISO standards are currently supported?

Accepted Answer

Currently fully supported:
- ISO 45001 (occupational health & safety)
- ISO 14001 (environmental management, incl. the 2024 Climate Change Amendment)
- ISO 50001 (energy management, incl. §6.3 energy review, EnB methodology, and §9.3 management review)

All three standards can run in parallel in one organisation; shared §4–§7 content (context, interested parties, policy, roles) is cross-standard-validated.

Question 7

When are ISO 9001 and ISO 27001 coming?

Accepted Answer

ISO 9001 (quality management) is the next standard module in the roadmap and will ship after the MVP validation of 45001/14001/50001 (tracked as PROJ-45 internally). A concrete release date follows once initial pilot customers have completed their audits.

ISO 27001 (information security) is a long-term goal anchored in our PRD, with no committed delivery date this quarter.

Question 8

Are the generated artefacts audit-ready?

Accepted Answer

Yes — the artefacts are structured to be defensible in an ISO audit: printable audit reports, evidence links per clause, full §9.2/§9.3 audit programme and management review, CAPA actions with owners and due dates.

AI-generated content (policies, procedures, improvement suggestions) is proposed for your review — never published automatically. Responsibility for content and audit attendance remains with your organisation.

Question 9

What is a SEU (Significant Energy Use)?

Accepted Answer

SEU stands for Significant Energy Use — a meaningful energy application. ISO 50001 §6.3 requires organisations to identify their energy uses and prioritise them by consumption. A SEU is an application that contributes substantially to total consumption (typically: everything that makes up the Pareto-80 % share — surfaced in NormPilot's 90 % coverage validation).

Examples: compressed-air system, Hall 2 lighting, building heating, a production-critical furnace.

Question 10

What is a relevant variable (REV / Relevant Energy Variable)?

Accepted Answer

REV stands for Relevant Energy Variable — a driver that influences the energy consumption of a SEU. Examples: operating hours, production volume, heating-degree days, outside temperature, runtime of a specific machine park.

In NormPilot, REVs are first-class data objects and can be linked to any number of SEUs. The Energy Performance Indicator (EnPI) is then calculated as energy consumption per REV unit (e.g. kWh / operating hour) — the foundation of §6.4 EnPI methodology and §6.5 energy baseline.

Question 11

What does elasticity mean in the §6.3 forecast?

Accepted Answer

Elasticity ε describes how strongly the energy consumption of a SEU changes when a relevant energy variable (REV) changes by 1 %. Mathematically: Δconsumption [%] = ε × ΔREV [%].

NormPilot's default is ε = 1.0 (linear: 1 % more production → 1 % more energy). Range: [-2, +5]; values below 1 typically apply to base-load-dominated plants, values above 1 to scaling-sensitive processes.

For multi-year forecasts, NormPilot compounds the annual change rate geometrically:
Δ_total [%] = (1 + r) ^ h − 1
where r = annual change and h = horizon in years.

Worked example:
- SEU: compressed-air system
- REV: operating hours
- Elasticity: ε = 0.85
- Expected REV change: +5 % per year
- Forecast horizon: 3 years
→ Δ_REV_total = (1.05)^3 − 1 = 15.76 %
→ Δconsumption = 0.85 × 15.76 % ≈ 13.4 %

This is how NormPilot models §6.3 (e) Future Energy Use Estimation transparently and in an audit-ready way.

Question 12

Which AI model do you use, and is my data used for training?

Accepted Answer

NormPilot uses Anthropic Claude for AI suggestions on policies, procedures, and §10.1 improvement proposals. Your data is used only to generate the requested suggestions — Anthropic processes inputs as a data processor on your behalf and does not use them to train its own models.

All AI-generated content is a suggestion for human review; nothing is auto-published as a binding policy. If a compliance officer does not approve a suggestion, it never enters the management system.

Question 13

Where is my data stored?

Accepted Answer

NormPilot runs on Vercel (frontend, edge functions, EU region) and Supabase (PostgreSQL, storage, auth — EU region). All personal data and compliance content stay within the EU.

Connections are TLS-encrypted; data at rest is encrypted (Supabase default). Daily backups are stored automatically in the EU.

Question 14

Is NormPilot GDPR-compliant?

Accepted Answer

Yes. We host exclusively in the EU, sign Data Processing Agreements (DPAs) with business customers, transparently document processing purposes in our privacy policy, and support data-subject rights under GDPR Art. 15-22 (access, rectification, erasure, restriction, portability, objection).

Cookies are set on consent only (TTDSG-compliant). See our privacy policy for full details.

Question 15

How does multi-tenant isolation work?

Accepted Answer

Multi-tenant separation is enforced at the database layer via Supabase Row-Level Security (RLS): every table holding organisation-specific data has an RLS policy that restricts access to the active user's organization_id.

Even a bug in application code couldn't accidentally grant one org access to another's data — the database simply refuses. Audit-relevant actions are additionally logged in a separate audit-log table.

Frequently asked questions

General & pricing

ISO standards

Wizard, tools & AI

Privacy & security