Independent consultant — AI systems · sovereignty · security behaviour
I help European organisations design, build and govern AI and platform systems — from tokenization and context architecture to DORA-grade resilience and the human behaviour that decides whether security works.
01 Fields of work
Every engagement is judged by the same question: will this still hold up in production, under audit, and with the people who have to use it?
From tokens to production: context architecture, retrieval, agents and deployment that survive contact with real data.
DORA, data integrity, data sovereignty and EU-conform hosting — designed into the system, not audited in afterwards.
Security fails at the keyboard. Assess how people actually behave under pressure, then train and design for it.
Internal platforms, IT infrastructure and deployment pipelines built to be owned — by your team, on your terms, in your jurisdiction.
Dashboards, internal software and AI-assisted workflows that people use because they work — researched, accessible, measured.
Where AI creates value for your organisation, what it costs, and how to build the capability — decided on evidence, not on vendor decks.
02 How I work
Every engagement starts with evidence: architecture reviews, interviews, log and data inspection, a look at how people actually work. No slide-ware before there is a diagnosis.
Options are laid out with their trade-offs — cost, sovereignty, compliance exposure, operational load — so the decision is yours and defensible in front of a board or an auditor.
I work inside your team, not above it: prototypes that become production code, documentation that AI agents and humans can both read, and controls that are designed in rather than bolted on.
Behavioural tests, resilience exercises, red-team style reviews and follow-up measurements. If something did not hold up, we learn why and fix the cause — not the symptom.
03 Insights
Why most production failures of LLM systems are context failures, how tokenization shapes cost and quality, and a practical method for designing context windows as deliberately as you design a database schema.
Sovereignty is decided in architecture, not in contracts: where data physically lives, which law can reach it, who holds the keys, and whether you can leave. A design method for EU-conform AI and platform hosting.
A translation of the Digital Operational Resilience Act from legal text into engineering requirements — ICT risk, incident reporting, resilience testing, third-party risk — with what it means for teams that build and run AI and platform systems.
The classic social-engineering tactics, what generative AI has changed about them, why annual awareness training does not move the numbers, and how behaviour assessments and designed workflows do.
04 Principles
Data, models and infrastructure stay under your control unless there is a deliberate, documented reason otherwise. EU hosting is the baseline, not the premium tier.
Every AI recommendation comes with an evaluation, a cost model and a failure analysis. If the numbers do not support it, I will say so.
Security fails at the keyboard, not in the firewall. Systems are designed around how people behave under pressure, and people are trained for the systems they get.
Documentation is a product, not a chore. Decisions, controls and tests are written down as they happen — readable by your auditors and by your coding agents.
Contact
No forms, no funnels. Write me a short note about your situation — I answer personally, usually within two working days.
Mon – Fri, 18:00 – 20:00 CET