rameus solutions delivers regulated-technology consulting across three connected fields: medical devices and SaMD, information security, and AI governance. Whether you need a certificate, market access, or a system that stands up to audit, we take you from strategy to certified implementation — and one team keeps the parts coherent instead of leaving you to stitch them together.
Our fields of expertise
Medical Devices & SaMD (ISO 13485)
Regulation is strategy. From requirement to market across ISO 13485, MDR/IVDR and SaMD.
Strategy & Board — cyber, AI and technology risk at C-level
Strategy & Board (C-LEVEL)
Technology risk on the board agenda. Independent counsel you can own. We give boards and leadership teams independent counsel on cyber security, AI and EU regulation, then implement what they decide.
Standards and regulations overlap more than they differ: they all ask you to govern risk, control your processes, and prove it. We build each management system so it reuses a shared backbone, so ISO 13485, ISO 27001 and ISO 42001 reinforce each other rather than duplicating effort. That is what keeps regulated technology affordable to run.
From strategy to certificate
Strategy & direction — where regulation and technology meet the business – also a topic for Strategy & Board
Build & implementation — the management system, documentation and controls
Audit & certification — readiness, internal audit, and support through the certification body
Ongoing assurance — interim leadership, surveillance, and keeping pace with new rules
Why rameus
You work with practitioners, not slide-writers. Thomas Kempf is a certified ISO 27001, ISO 22301 and ISO 13485 auditor who has helped bring diagnostic instruments to market; Lars Brunner leads medical and pharma quality and regulatory. We work in German, English and French, from the greater Zurich area, worldwide.
Usually the one with the nearest deadline or customer requirement. Because the underlying management systems share a common structure, starting well in one makes the others easier rather than duplicating the effort.
Can you both advise and implement?
Yes. We provide strategy and oversight, then the same team carries out the certified implementation, and we keep advisory work separate from certification-audit work so that independence stays real.
Do we get one team across several standards, or separate specialists?
One team. A single partner can carry medical-device, information-security, AI and management-system work, which is what lets us build a shared foundation instead of a disconnected project for each certificate.
Do you work outside Switzerland?
Yes. We are based in the greater Zurich area and work worldwide, with project experience across Europe, Asia, Africa and North America, in German, English and French.
Can one management system hold several certifications?
Yes. The standards share the Annex SL structure, so one set of processes, risks and controls can carry ISO 9001, ISO 13485, ISO 27001, ISO 42001 and more. This is the basis of the management-system fundamentals and integrated management systems.
Do you offer auditing, interim management and training as well as implementation?
Yes. These run across every field as how we work: independent auditing, experienced interim managers for a defined period, and tailored training. The domain-specific instances, such as an interim CISO, sit within their cluster and connect up to these.
Do the EU AI Act, CRA, NIS2 and DORA apply to Swiss companies?
Often yes. Swiss companies are frequently in scope through EU operations, EU customers or supply chains. We assess your exposure and build readiness on an ISO 27001 foundation, within information security and AI governance.
Who leads the work, and what are their credentials?
Founder Thomas Kempf, a certified multi-standard lead auditor with board mandates and a Harvard credential in cyber risk management, leads information security, AI and board work; Lars Brunner leads medical and pharma with more than fifteen years in IVD and GxP. You work with the senior people directly.
How does an engagement usually begin?
Most start with a conversation and then a gap or readiness assessment against the relevant standard, so you have a clear, prioritised picture of where you stand before any implementation begins.
How do you decide how much rigour a piece of work needs?
We right-size the approach to the risk and the goal, applying full formality where a certificate or a regulator requires it and a lighter touch where that is safe. That calibration is the method behind every service. What scaled precision technology means →
To provide the best experiences, we use technologies like cookies to store and/or access device information. Consenting to these technologies will allow us to process data such as browsing behaviour or unique IDs on this site. Not consenting or withdrawing consent, may adversely affect certain features and functions.
Functional
Always active
The technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a communication over an electronic communications network.
Preferences
The technical storage or access is necessary for the legitimate purpose of storing preferences that are not requested by the subscriber or user.
Statistics
The technical storage or access that is used exclusively for statistical purposes.The technical storage or access that is used exclusively for anonymous statistical purposes. Without a subpoena, voluntary compliance on the part of your Internet Service Provider, or additional records from a third party, information stored or retrieved for this purpose alone cannot usually be used to identify you.
Marketing
The technical storage or access is required to create user profiles to send advertising, or to track the user on a website or across several websites for similar marketing purposes.
