This case study begins with a disclosure, because without that disclosure it would be worthless: I am CEO of Eucerta AG and founder of Netgen. That made Netgen Switzerland our own testing ground – the first company to go through our platform from end to end, with all the friction that came to light along the way.
Anyone concluding that this case study is not an independent customer report is correct. It is something else: documentation of what happens when you build four standards simultaneously as one system instead of working through them one after another. The audit itself followed the same rules as any other procedure – the same standard, the same yardstick, the same number of audit days. How we organise independence is set out on the page Independently certified.
“We wanted to know whether our own promise holds. So we tested it on ourselves first – and with four standards at once, because that is precisely the hardest case.” – Christian Paredes, CEO Eucerta AG
The company and the scope
Netgen Switzerland is a web and digital agency based in Zurich, operating in the technology and software sector. The scope stated in the certificate reads: “Tailor-made web solutions for optimal customer experiences in digital marketing”.
This is a typical case for a service organisation with four relevant topics at once: project quality towards customers, information security, because customer data and access credentials are processed, the environmental aspects of an office operation with IT infrastructure, and the use of AI in service delivery. That is exactly where the four standards came from: ISO 9001, ISO 14001, ISO 27001 and ISO 42001.
The facts about the procedure
The verifiable data first, because they set the frame:
- Four standards as one integrated management system: ISO 9001, ISO 14001, ISO 27001, ISO 42001
- Certified on 8 May 2026, valid until 7 May 2029
- Certificate numbers: eca-20260630-001 for quality management and eca-20260818-001 for environmental, information security and AI management
- First project created in the platform in February 2026, further ones in March and April, all four certified in May 2026
- 164 tasks across the clauses of the standards, 54 documents in the system
Each of these certificates can be verified in the public register at eucerta.org via the certificate number. A case study whose certificates cannot be looked up is merely a claim.
Around three months from the first project to certification against all four standards – that is the figure from the headline, and it comes with a condition: the company was already working in a structured way beforehand. The standards organised existing practice; they did not replace missing practice.
What the figure 164 says about the way of working
164 tasks sounds like a lot, but it is the very reason why four standards are faster together than separately. Since the introduction of the common basic structure, the four standards follow the same layout: context of the organisation, leadership, planning, support, operation, performance evaluation, improvement – in the same order, with largely the same content.
Anyone introducing them separately writes these clauses four times, runs four internal audit programmes, holds four management reviews and is audited four times. The added substantive value of this quadruplication is zero – and the effort comes at the expense of the topics that genuinely need attention. For an agency that processes customer data and access credentials, that is above all information security: the BSI report on the state of IT security in Germany 2025 names the consistent management of one's own attack surface as the decisive lever and attributes around 80 per cent of reported attacks to small and medium-sized enterprises. In an integrated system, the shared clauses are created once, and what remains standard-specific is exactly the parts that really do differ: the environmental aspects and the register of legal requirements for ISO 14001, the risk assessment and the 93 controls of Annex A for ISO 27001, the AI system inventory with its impact assessments for ISO 42001.
Seen in this light, the 54 documents are the more telling figure. Four separate systems would have produced considerably more documents for the same substance – with the familiar knock-on problem that four versions of the same rule eventually drift apart.
`[CHECK: If the platform can supply the number of documents from a comparable single-standard project, a substantiated comparison would be strong here, e.g. “54 documents instead of X with four separate systems”. Without a substantiated comparative figure, the statement remains qualitative, as it stands now.]`
What ISO 42001 meant in concrete terms for an agency
The most interesting part was the AI standard, because this is where the least routine exists. For an agency that uses AI in service delivery, ISO 42001 requires, among other things, an inventory of the AI systems in use, an assessment of their impacts, clear responsibilities and rules for handling results – including the question of where a human decides and not the system.
For day-to-day operations this means less technology than expected and more organisation: which tools are approved? Which customer data may be fed in and which may not? Who reviews results before they go to customers? How is that documented?
These questions are also the reason why ISO 42001 and the EU AI Act should be thought through together: the standard structures how AI is operated responsibly, the regulation governs what is permitted. It has been in force since 1 August 2024, the obligations for general-purpose AI models have applied since 2 August 2025, and further stages follow in 2026 and 2027. Experience shows that using AI in a product generates the same foundations – system inventory, risk assessment, responsibilities, documentation. Details can be found on our pages on ISO 42001 and on the EU AI Act.
`[CHECK: A concrete, approved example from the Netgen procedure would be valuable here – for instance a rule on handling customer data in AI tools that emerged from building the AIMS. Please only with Netgen's approval, as it describes their operations.]`
What happens between the audits
The part that is usually missing from case studies is the most important one: a certificate is valid for three years from the audit date – in Netgen's case, therefore, until 7 May 2029. Those three years decide whether the system lives or gathers dust in a folder.
What is envisaged for this is ongoing maintenance in the platform rather than resuscitation before the next audit: tasks with due dates, documents with owners, an internal audit programme covering all four standards, and a management review that serves as a basis for management decisions and not as a record for the auditor. Anyone who does not want to handle this maintenance themselves works with a partner from our partner network as internal auditor – what we call a “Kümmerer”.
`[CHECK: Status of the surveillance phase at Netgen as at the publication date (11 November 2026) – have internal audits or a management review already been carried out in the new cycle? Suggestion: add one sentence with the actual status, which makes the section robust rather than programmatic.]`
What we took away from this for other projects
Three observations have since been confirmed in other procedures:
- The scope is the most expensive decision at the outset. With four standards, it determines the effort fourfold.
- Sequence beats pace. First the shared clauses, then the standard-specific parts – the other way round creates duplicated work.
- What already exists counts for more than what is new. The time gained came from organising existing practice, not from inventing new processes.
`[CHECK: If there are concrete empirical figures on the time saved compared with four separate procedures (audit days, person-days), please add them here with evidence. I have deliberately not written a percentage, because it is not substantiated.]`
Conclusion
Four standards in one system and around three months to certification – that is possible, but it is not a promise for every business. The precondition was a company that was already working in a structured way, and a decision to think about the four standards together from the very start.
What can be generalised is the logic behind it: the common basic structure of the standards is not theory but a real lever. Those who use it pay for the groundwork once instead of four times. And anyone who uses their own company as a testing ground should disclose it – which is why the disclosure in this article is at the top and not in the small print.
Your next step: Use the cost calculator to work out the bundle price for your standards – from the second standard onwards, 149 instead of 179 euros per month – or take a look at how an integrated management system is structured.
Further reading:
