AI for business, with an auditor's rigour.

Not with the tool, but with two or three processes where time is lost in measurable ways today: searching for information in documents, repetitive tasks, answering customers. In parallel I check how AI is already being used in the company, often more than management realises. From there, a tightly scoped pilot with targets set up front: it only scales if the numbers come.

It depends on the use case, and that's the first thing I check. I only propose solutions (RAG assistants, predictive analytics) when the business case shows a plausible return within 6–12 months. If the available data can't prove it, we start with a tightly scoped pilot with measurable targets set up front: if the numbers don't come, we stop there, before any large-scale investment.

It is if it happens without rules, because confidential documents end up in services nobody has assessed: it's exactly what surfaced in one of the due diligence engagements described in the case studies. Banning rarely works; what works is approved tools with proper contractual guarantees, clear rules on which data can be used, and some basic training. That way spontaneous use becomes an advantage rather than a risk.

No. For every AI project I first assess what data can leave the company perimeter and under what contractual guarantees (training opt-out, EU-region hosting). Where confidentiality is critical I steer towards self-hosted models or enterprise APIs with explicit no-training clauses: the same care I apply to security and governance applies to AI.

It depends on how you use AI. Some obligations already apply to every company that uses it, such as the bans on certain practices and staff training in informed AI use; the heavier ones concern systems classed as high-risk, such as recruitment or credit scoring. The first step is an inventory of where AI is already in use and at what level of risk: the same auditor's approach I apply to security and governance.

For well-bounded tasks, yes, provided you treat them like a new colleague with privileged access: minimum permissions, every action traceable, human approval wherever a mistake is expensive. Start with work whose output is easy to verify, and raise autonomy only after measuring reliability. It's the same logic behind the mandatory human review of AI-generated code I introduced on my own projects.

A lot: when producing software becomes cheap, the limit becomes imagination, and the supplier stops being a plain outsourcer handed fixed specs and becomes a co-development partner. That needs governing: who reviews and approves generated code, who decides what goes into production, who owns the code and the knowledge the project creates (documentation, prompts, knowledge bases). I help redefine contracts, roles and release processes before the supplier does it for you.

Beyond development there are costs that grow with usage: model calls, cloud infrastructure, per-user licences, keeping the document base up to date. I estimate them in the business case before starting and monitor them after go-live with the same FinOps practice I use for cloud (budgets, alerts, choosing the right model for each task), so the cost per answer stays under control as adoption grows.

Yes, and they need managing like any other: confidential documents exposed by an assistant with overly broad permissions, malicious instructions hidden in content the model reads (prompt injection), phishing and fraud made far more convincing by generated voices and text. I fold them into the risk analysis alongside the NIS2 and ISO 27001 requirements already in place, rather than treating them as a separate chapter.

Hiring a CISO, a cloud architect and an AI specialist would run north of €200k a year in fixed salary alone. With WIRD you talk to me directly — ISACA CISA certified auditor, with hands-on experience across AWS, governance and AI — a single point of contact covering all of it, with a network of specialists I bring in when a project needs extra capacity, and you pay only for the time actually required.

I sign an NDA before any data is shared or any system access is granted, and I apply the same least-privilege principle I recommend to my clients: I access only what the project requires, for as long as the project requires it. Nothing relating to a client is shared with third parties — not even anonymised — without explicit authorisation.

It depends on the objective. An audit or a certification (ISO 27001, say) is typically project-based, with defined milestones and deliverables; a fractional CTO/CISO role is a retainer with an agreed, reviewable number of days per month. Either way you deal directly with the person doing the work, not an account manager — and it's the first conversation that settles which model fits.