Ecix Tech has become the first professional services firm to obtain ISO/IEC 42001 certification for its artificial intelligence management system — the first international standard setting out the requirements for implementing, maintaining and continually improving an AI management system within an organisation. Awarded by EQA, the certification sets a significant precedent in the legal and compliance sector.

Yet beyond the technical milestone, the certification reflects a particular way of thinking.

Carlos Alberto Saiz Peña, vice-president and partner at Ecix Tech, and Esmeralda Saracibar Serradilla, also a partner at the firm, have spent more than seven years developing artificial intelligence solutions applied to real-world cases in highly regulated environments. They do not speak of AI as a passing trend, but as a structural responsibility. In this conversation, they reflect on what they have learned, the boundaries they are unwilling to cross, and why they believe ethics will be the true differentiating factor in the years ahead.

“We learned that technology does not replace judgment”

Looking back, they don’t describe a race to adopt technology before others. They describe a process of intellectual refinement.

“The most important thing we have learned is that speed does not come from technology, but from understanding the problem well”

During these years they have seen artificial intelligence projects that were born with enthusiasm and fell by the wayside because they started from the wrong question: what can be automated.

“We start from a different premise: where real friction, risk, or loss of quality occurs in legal and compliance work.”

Working with real legal data, audits, inspections, or incidents requires extreme rigor. It’s not enough for the solution to work “in general.” It has to work in a specific context and be defensible before a regulator.

Today they are faster, they explain, because they know how to quickly discard what does not add value.

Intervene where it hurts, don’t automate out of inertia

Their approach is deliberately practical: use case – solution.In regulatory compliance, the problem is not generating more documentation, but understanding precisely where deviations exist and what real impact they have.

In incident management, urgency is not a standard text, but rather a way to organize scattered information and help coordinate decisions between technical and legal areas.

“We’ve seen clients who want a tool that automates the entire process. That usually creates more noise than solutions.”

They prefer to intervene at the points where time is actually being wasted or risk is increasing. For them, this selective intervention is a way of respecting the legal process.

Explainability is non-negotiable

Ecix combines market analysis tools with proprietary development. The decision to buy or build is not ideological.

“If a market-based tool solves the problem well and offers guarantees regarding data control, we use it. We don’t develop for the sake of development.”

They build when the use case is especially sensitive or when they need to understand exactly how a result is achieved.

“In legal and compliance, traceability and explainability are not an extra. They are part of the service.”

Accepting a black box, in certain contexts, would be incompatible with their model.

“AI works for us, not the other way around”

One of the firm’s strategic lines is called AI Driven – Human Focus. The idea is clear: technology enhances, it doesn’t replace.

“AI amplifies the team’s talent, but it does not replace professional judgment or accountability.”

This involves ongoing training, task redesign, and a clear definition of which decisions require mandatory human intervention. They measure the impact on quality, consistency, and error reduction, not just time savings. When the framework is clear, they explain, AI stops generating internal resistance.

Saying no also builds a brand

The ISO 42001 certification reinforces a positioning that already existed.

“There are projects we reject because the associated risk doesn’t align with our TEN philosophy – Technology, Ethics, and Compliance.”

In their experience, refusing when appropriate strengthens the relationship with the client and market confidence.

Ecix = Ethics, they repeat without grandiloquence.

What the market is underestimating

After working with more than 300 DPOs and CISOs, they detect patterns: undersized teams, increasing regulatory pressure, and an excessive focus on formal compliance versus actual operations.

But they are particularly concerned about the implementation of AI systems in large organizations. “There is a lack of comprehensive inventory and in-depth risk analysis. There is a tendency to think that a policy and some training will prevent problems.”

For them, the real challenge is not technical, but one of governance.

The three-year bet: to grow without losing sight of our principles

The “On Air” Strategic Plan 2025-2027 is not a document to be presented at an internal convention. It is, in fact, the formalization of a path that began seven years ago.

When they talk about this plan, they do not do so from the rhetoric of accelerated growth, but from the perspective of consolidation.

“We are entering this second year having already achieved many goals and with a different approach than other firms.”

This different approach has a clear foundation: sustained investment in technology and training when it wasn’t yet a clear trend. Over the past seven years, they have dedicated significant resources—relative to their size and specialization—to developing internal capabilities, integrating technical and legal profiles, and building their own technology governance model.

“Our investment in technology and training has been spectacular within our size and sector. This has allowed us to position ourselves in a truly unique place to face the challenges that our clients request of us.”

The plan does not pursue volumetric growth. It pursues sustainable growth. And for them, that implies three inseparable vectors:

• Innovation applied with sound judgment.
• Cohesive internal culture.
• A team committed to doing things differently.

“We didn’t want to be a firm that uses technology. We wanted to be a firm that knows how to manage it.”

Culture plays a central role. Not as motivational rhetoric, but as an operational condition. A team that understands ethical boundaries, shares technical and legal language, and recognizes that AI is not a shortcut, but a responsibility.

The motto summarizes that vision:

“Comply with the rules, mitigate the risks: tomorrow’s ethics now.”

It’s not an aspirational phrase. It’s a positioning statement.

In a market where artificial intelligence has become a selling point, Carlos Alberto Saiz Peña and Esmeralda Saracibar Serradilla advocate for something less spectacular but more structural: governance, traceability, and criteria.

And therein lies, probably, their true competitive advantage.

ISO 42001 certification was a milestone. But it’s not the focus of the conversation. It’s a consequence.

The key point is that they have decided to subject artificial intelligence—that tool that promises speed and efficiency—to verifiable rules, limits, and standards. In a sector where regulatory pressure is increasing, where DPOs and CISOs work with lean teams, and where AI is being deployed at an uneven pace, the question is no longer who adopts the technology first.

The question is who can defend her.

And in that response, for Ecix, ethics is not a reputational complement. It is the model.