Systems & Evidence
Strategy is only credible when it can be engineered, governed and deployed.
The systems below show how I translate executive requirements into working capability across regulated fintech, cybersecurity, digital health and enterprise AI. Each case connects the operating problem, the system intervention, the evidence and the resulting control or capability.
Private LLM Systems for Regulated Fintech
I designed the architecture and governance model for private large-language-model capability inside a regulated payments environment, where uncontrolled data movement, tool access or model behaviour could create direct regulatory, cybersecurity, privacy and operational exposure.
The core design problem was not simply where to host the model. It was how to make generative AI usable inside an existing control environment without weakening the boundaries the business depended on. The architecture therefore isolates the model from cardholder data and public egress, while a policy-enforcement layer governs identity, purpose, retrieval, tool access, human approval and consequential actions.
Every interaction is retained within an auditable decision record, allowing the organisation to understand not only what the model produced, but how it was authorised to operate.
The wider challenge was organisational. Generative AI had to become a governed enterprise capability rather than an experimental tool. That required executive strategy, GRC, information-system architecture, programme delivery and applied AI engineering to develop together.
The outcome is a controlled operating model in which the organisation can use private AI capability without surrendering visibility, accountability or regulatory defensibility.
Agentic AI Oversight System
As AI systems become capable of acting rather than merely recommending, the governance problem changes. The question is no longer only whether the model is accurate, but what authority the agent has, which actions it may take, and who remains accountable when it acts.
I designed and built an enterprise control architecture for autonomous AI agents around that problem. Before a consequential action is executed, the system evaluates whether it falls within the agent's delegated authority, data permissions, jurisdiction, financial limits, operational context and current security posture.
The control layer can permit, constrain, escalate, deny or suspend an action. Where human approval is required, authority is granted for the specific action rather than indefinitely, and the full decision chain is retained for audit and review.
The strategic objective is to allow organisations to increase AI autonomy without losing executive control. Governance therefore becomes part of the runtime architecture rather than a policy applied after the fact.
The result is an operating model for agentic AI in which autonomy can scale while human accountability, security boundaries and regulatory defensibility remain intact.
Etheras: AI Cybersecurity and Governance Platform
I conceived and built Etheras around a simple principle: cybersecurity, explainability, assurance and governance should operate as properties of the same AI system, not as separate controls added later.
The platform brings together explainability, bias detection, continuous assurance, counterintelligence, zero-day detection, governance controls and attack simulation within a common architecture. The objective is not simply to test whether a model performs well, but to determine whether its behaviour remains secure, trustworthy and defensible as operating conditions change.
From an executive perspective, Etheras addresses a broader problem: how to move from periodic review to continuous assurance. It turns governance requirements into technical controls that operate alongside the AI system, giving organisations greater visibility into behaviour, risk and evidence as the system runs.
Etheras represents how I believe enterprise AI governance must evolve: from static documentation and point-in-time approval toward embedded, continuous and operational assurance.
Explainable AI and Model Audit System
I designed and built this capability for a regulated clinical environment where an AI recommendation had to do more than perform well. It had to remain understandable, traceable and defensible to the clinician accountable for acting on it.
The system exposed model behaviour, surfaced bias and created a traceable evidence record around the decision process. It operated within a bespoke home-rehabilitation platform monitoring patient recovery across seventeen comorbidities while preserving interpretability at the point of clinical use.
The wider challenge was organisational as much as technical. Clinical requirements, patient safety, data quality, information-system architecture, governance, human oversight and deployment constraints all had to work together before the capability could be trusted in practice.
The executive question was therefore not simply “does the model work?” It was whether the organisation could understand the recommendation, evidence how it was produced, manage the associated risk and remain accountable for the resulting decision.
This work shaped a principle that still informs my approach today: explainability is not a reporting feature. In high-consequence environments, it is part of the operating and accountability model.
AI Governance Assessment Engine
I designed the assessment engine to answer a question executives increasingly face: is this AI system actually ready to be deployed, and can the organisation defend that decision?
The engine evaluates AI across algorithmic fairness, model transparency, data governance and human oversight. Its scoring model is deliberately designed so that strength in one area cannot conceal a material weakness elsewhere. Mandatory control floors and sector-specific thresholds establish the minimum conditions for deployment.
Regulatory and governance requirements are mapped directly to controls across the EU AI Act, GDPR, ISO/IEC 42001, NIST AI RMF, Swiss revFADP and relevant sector obligations. The output therefore goes beyond a maturity score. It identifies evidence gaps, deployment constraints, remediation priorities and the actions required before an executive can make a defensible go / no-go decision.
The purpose is not to score governance for its own sake. It is to convert fragmented regulatory, technical and operational evidence into a clear decision about whether an AI capability should proceed, be remediated or stop.
Continuous Assurance and Regulatory Intelligence System, FCRAS
I am developing FCRAS around a simple problem: most organisations still manage regulatory assurance through periodic reviews, while technology, controls and regulatory obligations change continuously.
FCRAS is designed to close that gap by turning assurance into an ongoing operational capability. Governed evidence pipelines bring together telemetry from identity, security, cloud infrastructure, payment systems, AI registries and other regulated assets, allowing the organisation to test whether controls are actually operating rather than relying only on documented intent.
A regulatory-intelligence layer monitors legislation, supervisory guidance and standards, identifies material change, and connects new obligations to the systems, controls, evidence sources and accountable owners they affect. The objective is to maintain traceability from regulation through control to operational evidence.
At executive level, this changes the nature of assurance. Instead of receiving a point-in-time snapshot, leadership gains continuous visibility into control health, regulatory exposure, ownership, evidence quality and remediation priority.
The strategic goal is to move GRC from retrospective compliance reporting toward a live management capability: one that can show where the organisation is exposed, why, who owns the risk, and what needs to happen next.
Aegis AI Engineering and Assurance Platform
I am developing Aegis for environments where advanced AI capability must remain continuously authorised to operate, not simply approved once and trusted indefinitely.
The core idea is that deployment should depend on a validated operating envelope. Before operational use, models are developed, simulated, challenged and adversarially tested. Approved capabilities are then bounded by defined tasks, data conditions, confidence thresholds, human-oversight requirements and authority limits.
Once deployed, Aegis continues to test whether those conditions still hold. A control plane evaluates consequential outputs against the approved envelope and can reduce, restrict or suspend authority when assurance conditions are no longer satisfied. Drift, attack, behavioural change and explanation instability therefore trigger requalification rather than waiting for periodic review.
From an executive perspective, this changes the governance model. AI is no longer treated as something that is approved at a point in time and then left to operate. Authority becomes conditional, observable and revocable throughout the system lifecycle.
Aegis brings AI engineering, governance, assurance, executive risk decisions, programme delivery, applied research and bespoke systems architecture into the same lifecycle.
The objective is to allow more capable AI to operate without forcing the organisation to surrender control over when, where and under whose authority it acts.
Strategic Integration
Across these systems, the same seven dimensions remain connected.
I advise leadership on what should be built, where the value lies, what risk the organisation is prepared to carry and whether it is ready to own the resulting capability. I then connect those decisions to governance, architecture, transformation, programme delivery, applied AI and the information systems required underneath them.
Where existing approaches are insufficient, I work directly with technical and research teams to develop new methods. Where the challenge is organisational, I design the operating model, accountability structure, controls and adoption path required to move the capability into real operations.
The point is not to optimise each discipline independently. It is to make strategy, technology, governance, risk and delivery reinforce one another.
The result is not simply AI that works. It is AI capability that an organisation can govern, deploy, operate, challenge, defend, and scale.