Control based AI governance and assurance for organisations that cannot afford to get it wrong.
I help boards, CISOs and AI leaders turn AI principles into operational controls, evidence and audit ready assurance across the AI lifecycle.
A structured, evidence driven review of your AI use cases, data and controls, producing a clear view of what is in place, what is missing, and what you can defend with confidence.
Control coverage
Baseline and gap analysis across governance, data and security controls, mapped to your AI lifecycle stages.
Evidence and auditability
What you can prove today, what needs strengthening, and what artefacts regulators and auditors expect.
12 month roadmap
A prioritised, practical plan with ownership and sequencing, aligned to business delivery, not bureaucracy.
What I help you do
I turn AI ambitions into operational controls, measurable evidence and assurance that stands up to scrutiny.
AI controls assessment and evidence mapping
A structured review of your AI use cases, data and governance controls, focused on what you can evidence today.
- AI system and use case scoping with risk tiering
- Control baseline and gap analysis across the AI lifecycle
- Evidence inventory and auditability review
- Clear prioritisation of gaps by risk and impact
Secure AI design and Zero Trust patterns
Architecture and design support for AI enabled systems, with identity, segmentation and data controls built in.
- Threat modelling for AI services and LLM integrations
- Access control and segregation for AI workloads and data
- Secure RAG and knowledge store patterns
- Hardening of data pipelines and inference environments
Assurance readiness and independent review
Independent assurance focused on control effectiveness, evidence strength, and stakeholder confidence.
- Pre deployment and change impact assurance
- Safety, security and governance reviews for AI use cases
- Misuse and adversarial scenario testing for LLMs
- Assurance narratives for boards, customers and regulators
What makes this approach different
Many AI specialists lack security depth. Many security teams are new to AI. I bridge both, with controls and evidence as the common language.
Controls, not slogans
I focus on operational controls, evidence and auditability, not generic principle statements. You get artefacts that support decisions and stand up to scrutiny.
Security depth applied to modern AI
I combine formal Trustworthy AI training with decades of security architecture and assurance work. This allows me to connect model behaviour, data, infrastructure and governance in one view.
Practical and regulator friendly
My work is grounded in what risk teams, auditors and regulators actually expect to see. You receive artefacts that stand up to scrutiny and support real decisions.
Credentials at a glance
I am a practitioner first. Certifications support the experience rather than replace it.
Training and capability building
If you need to build internal capability in AI governance, safety and assurance, I also lead the Institute of Trustworthy AI (TITAI).
TITAI is focused on practical, control led Trustworthy AI for boards, risk and compliance leaders, security and data professionals, and career switchers entering AI governance roles.
Training is delivered separately from advisory and assurance engagements to preserve independence, while applying the same lifecycle thinking and control logic.
Visit TITAI training siteWhere I add immediate value
These examples show the type of work I do. Each engagement is tailored to the organisation, its risk appetite and its stage of AI adoption.
AI risk framework for a regulated enterprise
A large organisation needed a coherent way to understand and govern AI risk across multiple business units.
- Defined an AI risk taxonomy and governance model
- Mapped AI controls into existing security and risk frameworks
- Created AI risk cards for priority use cases
- Designed human oversight and escalation paths
Secure LLM adoption for sensitive data
A team wanted to use large language models with internal documents without creating a data breach risk.
- Assessed data, threat and regulatory constraints
- Designed safe patterns for retrieval augmented generation
- Recommended encryption and access controls around knowledge stores
- Defined operational monitoring and incident paths
Zero Trust architecture for AI driven services
An organisation wanted to align its AI platform with Zero Trust principles without blocking delivery.
- Mapped current environment and trust boundaries
- Defined a target architecture for AI services
- Integrated identity, device, network and data controls
- Created a staged roadmap that matched delivery cadence
Trustworthy AI training for security and data teams
Security teams and data scientists needed a common language for AI risk and safety so they could work together.
- Delivered workshops on AI threats, controls and failure modes
- Introduced a shared set of patterns and anti patterns
- Embedded AI aware checks into existing pipelines and processes
- Provided reference materials and templates for ongoing use
Who I work with and how
I typically support organisations that treat AI as safety and mission critical. That often means regulated or high impact environments.
Sectors that benefit most
- Critical national infrastructure and utilities
- Government and public sector bodies
- Health and life sciences
- Financial services, insurance and fintech
- Technology vendors and AI start ups
Ways of working
-
1Discovery and strategyShort, focused work to understand your AI landscape, risk drivers and constraints.
-
2Architecture and designCo designing secure and safe AI patterns and reference architectures with your teams.
-
3Assurance and reviewIndependent assessment of AI systems, suppliers and changes at key decision points.
-
4Ongoing advisoryRetained support for boards, CISOs, AI leads and risk teams as your AI portfolio grows.
AI and unstructured data safety self assessment
In a few minutes you can get an independent view of how well your organisation is protecting unstructured data and AI enabled workflows. The assessment runs in the browser and produces a report you can share with security, risk and leadership teams.
What you will get
The Unstructured Data Security and AI Safety Assessment (UDSA) provides a structured view of your current posture and highlights where to focus next.
- Coverage across data discovery, access control, protection and governance
- Specific focus on how AI and unstructured data interact in your environment
- Domain scores and clear explanations of key risks
- Prioritised recommendations you can act on quickly
Run the assessment
The assessment normally takes around 10 to 15 minutes to complete. It is designed for security, data and risk leaders who need a practical starting point.
I created the UDSA engine to help organisations understand how AI and unstructured data introduce new safety, security and compliance risks before they become incidents.
Start a confidential conversation
If you are planning a significant AI initiative or need independent assurance on existing systems, I am happy to explore how I can help. There is no obligation.