Independent consultant — AI systems · sovereignty · security behaviour
I help European organisations design, build and govern AI and platform systems — from tokenization and context architecture to DORA-grade resilience and the human behaviour that decides whether security works.
01 Fields of work
Every engagement is judged by the same question: will this still hold up in production, under audit, and with the people who have to use it?
From tokens to production: context architecture, retrieval, agents and deployment that survive contact with real data.
DORA, data integrity, data sovereignty and EU-conform hosting — designed into the system, not audited in afterwards.
Security fails at the keyboard. Assess how people actually behave under pressure, then train and design for it.
Internal platforms, IT infrastructure and deployment pipelines built to be owned — by your team, on your terms, in your jurisdiction.
Dashboards, internal software and AI-assisted workflows that people use because they work — researched, accessible, measured.
Where AI creates value for your organisation, what it costs, and how to build the capability — decided on evidence, not on vendor decks.
02 How I work
Every engagement starts with evidence: architecture reviews, interviews, log and data inspection, a look at how people actually work. No slide-ware before there is a diagnosis.
Options are laid out with their trade-offs — cost, sovereignty, compliance exposure, operational load — so the decision is yours and defensible in front of a board or an auditor.
I work inside your team, not above it: prototypes that become production code, documentation that AI agents and humans can both read, and controls that are designed in rather than bolted on.
Behavioural tests, resilience exercises, red-team style reviews and follow-up measurements. If something did not hold up, we learn why and fix the cause — not the symptom.
03 Insights
A language model will not give the same answer twice, and no prompt changes that. What can be made deterministic are the properties that matter: what never happens, what always happens, in which order and shape, and what cannot ship unverified. A close reading of Claude Code shows where instructions end, where guarantees begin, and where people belong.
Every AI option buys three things at once: a capability, a dependency and an option on the future. A decision method with three gates, a three-year cost model that includes leaving, explicit lock-in and sovereignty scores — and why the honest answer is usually a hybrid.
On 4 September 2026 the Rhysida group published 1.44 million files from two Berlin Senate administrations after the state refused a 30-bitcoin ransom. Refusing was right. What made it expensive was decided years earlier: identity, segmentation, data hygiene, egress monitoring and a consolidation that never happened.
Frontier models turned expert attention — the scarce input on both sides of cyber security — into a metered commodity. What that changed for attackers and for defenders, why the exploit window collapsed to hours, and why "nobody is looking at our custom code" stopped being a defence.
04 Principles
Data, models and infrastructure stay under your control unless there is a deliberate, documented reason otherwise. EU hosting is the baseline, not the premium tier.
Every AI recommendation comes with an evaluation, a cost model and a failure analysis. If the numbers do not support it, I will say so.
Security fails at the keyboard, not in the firewall. Systems are designed around how people behave under pressure, and people are trained for the systems they get.
Documentation is a product, not a chore. Decisions, controls and tests are written down as they happen — readable by your auditors and by your coding agents.
Contact
No forms, no funnels. Write me a short note about your situation — I answer personally, usually within two working days.
Mon – Fri, 18:00 – 20:00 CET