A 1,400-person industrial services group, four weeks in.
What a thirty-day trial looks like for an organisation that has no AI strategy, no AI governance function, and a customer questionnaire sitting in someone's inbox.
Meridiaan Group does not exist. Every figure below is modelled from stated assumptions, and the assumptions are shown so you can change them for your own organisation. Moustr has no published customer references yet — when we do, they will be named, and they will say so themselves.
The organisation
Meridiaan Group
Industrial maintenance and technical services. Headquartered in Rotterdam, operating across the Netherlands, Belgium and Denmark. 1,400 employees, of whom around 500 are field engineers on mobile devices. Revenue in the low hundreds of millions.
A works council with real consultation rights. ISO 27001 certified since 2021. No AI strategy, no AI policy, no AI governance role.
Who is involved
Head of IT Governance — owns the control environment and the budget.
Reports to the CFO.
Compliance Manager — 0.4 FTE on anything AI-related, alongside 27001 and
GDPR.
CISO — influential, no budget authority, sees the exposure first.
Sales Director — holds the questionnaire that started this.
The general challenges, before AI enters the picture
A compliance function of half a person
27001 surveillance audits, GDPR, supplier due diligence and customer questionnaires all sit with one manager at four-tenths of a full-time role. There is no capacity for a new programme.
A distributed, partly mobile estate
Five hundred field engineers work from vans, client sites and home. IT has good control of the office network and considerably less visibility everywhere else.
Growth through acquisition
Three businesses acquired in five years, each arriving with its own software estate. Nobody is confident the application inventory is complete, let alone current.
How those challenges converge into an AI problem
None of the three is an AI problem. Together they produce one.
The estate absorbs AI faster than anyone notices
Microsoft 365 gains Copilot surfaces. The scheduling platform adds predictive routing. A recruitment tool acquired with one of the businesses screens CVs. None of it went through procurement as AI, because none of it was bought as AI.
People solve their own problems
Engineers use consumer AI to write up job reports on their phones. Marketing drafts copy in a free tool. Nobody is hiding anything. Nobody was asked, so nobody said.
Half a person cannot audit this
Building a register by department survey is estimated at three weeks of the compliance manager's time — which she does not have — and it would be out of date within a quarter.
And then someone asks
A German industrial client sends a procurement pack. Section 7 asks which AI systems process their data, who is accountable for each, and how oversight is evidenced. A €2.1M renewal is waiting on the answer.
The as-is state
Where Meridiaan is on the Monday the questionnaire arrives.
| Dimension | Position | Evidence |
|---|---|---|
| AI systems known | 4 — the ones bought deliberately | A SPREADSHEET |
| Named owners | 0 | NONE |
| Risk classification | Not started. The CV screening tool has not been looked at. | NONE |
| Questionnaire response | Estimated 12–15 elapsed days, across three countries and four departments | MANUAL |
| Works council | Not consulted. Any monitoring-shaped proposal will stall here. | UNENGAGED |
| 42001 readiness | 27001 in place. The AI inventory clause cannot be met. | BLOCKED |
The pain is not the regulation. High-risk obligations are eighteen months away. The pain is a €2.1M renewal held up by a question nobody can answer, and a compliance manager at 0.4 FTE being asked to answer it.
The thirty days
| When | What happens | Whose time |
|---|---|---|
| Week 1 | The three office networks connected, and the laptops set up through the existing device management. Works council informed with the written processing description, which matters more here than anywhere else in the engagement. Candidates begin appearing within the hour. | ~2 hrs |
| Week 2 | A normal fortnight of work has been observed. Embedded AI surfaces in three products already licensed. The CV screening tool appears — it had not been on anyone's list. | ~1 hr |
| Week 3 | Owners assigned centrally, one at a time. Intended use recorded. Classification run: most systems minimal risk, the CV tool flagged for Annex III review. | ~3 hrs |
| Week 4 | Evidence assembled. The client questionnaire is answered from the record. Report to the Head of IT Governance, decision taken. | ~2 hrs |
Total: about eight hours of Meridiaan's time across four weeks, plus one change per office and one works council notification, with the identification mode agreed before anything was switched on.
The to-be state
| Dimension | Before | After thirty days |
|---|---|---|
| AI systems known | 4 | 31 MODELLED |
| Named owners | 0 | 31 ALL |
| Classified by use | 0 | 31, one flagged for Annex III review |
| Questionnaire responseAI section | 12–15 days elapsed | Same day, from the record |
| Works council | Unengaged | Consulted, pseudonym mode agreed |
| 42001 inventory clause | Blocked | Satisfiable |
| Ongoing effort | 3 weeks per audit cycle | ~5 min a day and a short weekly review, one person |
Modelled, not measured. The Verizon 2026 DBIR reports that 45% of employees are now regular AI users on corporate devices and 67% use non-corporate accounts; it also finds more than 15% of users running unauthorised AI browser extensions. Applied to a 1,400-person estate with three acquired software portfolios, thirty-odd distinct AI systems and surfaces is a reasonable expectation. It is not a forecast for your organisation, and Moustr will not tell you a number before it has looked.
The money, with the arithmetic shown
Every input is an assumption you can change. None of it is a guaranteed saving, and none of it is a claim about your organisation.
Show the model
| Line | Assumption | Year one |
|---|---|---|
| Questionnaire response effortThe AI section only — not the whole questionnaire | 6 customer questionnaires a year × 2 working days of research avoided × €480 loaded day rate. Published effort for a full security questionnaire runs 10–40 hours; the AI section is a fraction of that, and it is the fraction that requires going and finding out. | €5,760 |
| Manual inventory build and refresh | 15 working days initial + 5 days quarterly, at the same rate | €33,600 |
| 42001 readiness support avoided | Inventory and ownership workstream, quoted externally | €18,000 |
| Duplicate AI-enabled licences identified | Illustrative only — depends entirely on the estate | not counted |
| Moustr — trial plus subscription, year one | Free 30-day trial, no fee and no obligation to continue | see pricing |
The €2.1M renewal is deliberately excluded. It would dominate the arithmetic and it cannot be attributed to Moustr — the deal had many moving parts and the questionnaire was one of them. Counting it would make the model look better and be worth less.
Most organisations report more than two weeks elapsed to complete a vendor security assessment, but the effort inside that is far smaller — the rest is waiting on other people. The figures above price effort only. The elapsed-time saving is usually the one that matters commercially, because a renewal sits still while the answer is assembled, but that number depends entirely on your deal and we are not going to invent it for you.
What this scenario deliberately does not claim
- That Meridiaan exists, or that any customer has achieved these results
- That thirty-one is the number you will find
- That Moustr made anyone compliant, or certified anything
- That the €2.1M renewal was won because of this
- That every AI system in the estate was found — the field engineers' personal phones on mobile networks remain outside what any network-based discovery can see
When we have customers willing to be named, this page will be replaced by what they say themselves.