AI governance, risk & regulatory compliance

Governance frameworks, EU AI Act, model risk, security and privacy by design, GxP validation, FDA and GDPR compliance, audit readiness.

81 contributions across 8 experiences

Where this skill was applied

Often together withSolution & enterprise architecture Generative AI & LLM solutions Data architecture, engineering & governance Cloud & multi-tenant SaaS platforms Data Strategy for AI Semantic engineering & knowledge management

2024–202518 contributions

EPAM Systems

Led the technical response to a Tier-1 Swiss bank’s enterprise AI RFI — structured on business value; technology, security and compliance; and people, operating model and governance — later reused as the technical core of a second pursuit with the same bank and the engagement behind EPAM’s preferred-vendor status.
Coordinated the proposal for a bank-wide Generative AI blueprint mapping 35 prioritised use cases across all seven divisions of the bank over six enabling layers: AI strategy, legal and compliance, data and security, technical architecture, responsible AI and workforce enablement.
Contributed the AI and data proposition to a growth proposal for the bank’s China digital wealth platform (200,000+ users in two years, in a market where over 80% of wealth management is domestically held): a gamified paper-trading experience with a graduated three-tier conversion model, disclosure design and an explicit Chinese gaming-regulation risk assessment.
Global agribusiness and food company, Switzerland: defined the GenAI strategy for shipping and transport optimisation, structuring 18+ use cases (laytime calculations, contract analysis, chartering risk mitigation) with OCR, NLP, LLMs and knowledge graphs.
Designed the technical questionnaire responses on model orchestration, multi-LLM integration, RAG, embedding strategies and secure deployment, articulating EPAM’s LLMOps approach, AI Factory and compliance measures, and coordinated contributions from global EPAM teams.
Extended the proposition to generative AI in prudential and regulatory reporting (proposal scope, not delivered).
Adapted EPAM’s Generative AI Factory target architecture for the bank — three planes (Models / Data / Services) over Data Factory, AI Backoffice and AI Serving Platform — covering feature and prompt engineering, continuous training and evaluation, data- and model-drift monitoring, hallucination management, guardrails, vector stores, FinOps and a gateway to third-party models, closing on a dedicated data-privacy layer.
Global pharmaceutical company: principal expert (GenAI, architecture, software engineering) supporting the AI Factory framework and global AI strategy; defined a reusable AI component framework and LLM/multi-agent orchestration for biomedical R&D and regulatory processes, and a global Community of Practice for AI knowledge sharing.
Global industrial materials firm, UK: defined the architecture for freight anomaly detection — hybrid statistical, ML and GenAI models with RAG for contextual validation on AWS and GCP, feature engineering, prompt design for anomaly justification and EPAM AI accelerators.
Led an AI regulatory readiness assessment aligned with the EU AI Act, identifying system classifications, governance gaps, documentation requirements, human-oversight controls, transparency obligations and post-deployment monitoring needs.
Established model-risk controls for predictive and generative AI, including independent validation, bias testing, explainability review, performance thresholds, approval gates, audit trails and periodic revalidation.
Led privacy-by-design reviews for AI systems handling sensitive or personal data, covering data minimisation, retention, data residency, DPIA inputs, access governance, encryption and secure data sharing.
Defined security controls for LLM and AI solutions: identity and access management, secrets management, encryption, network segmentation, prompt-injection defences, content filtering, audit logging, vulnerability management and secure SDLC.
Prepared AI, data and analytics platforms for internal audit, client assurance, regulatory review and quality inspections with evidence repositories, control matrices, validation records and governance documentation.
Defined an LLMOps evaluation framework for RAG and agentic systems measuring retrieval relevance, groundedness, factuality, hallucination rate, task completion, latency, cost per interaction, safety and user satisfaction.
Set service-level objectives for production AI services: availability, latency, extraction accuracy, retrieval quality, evaluation scores, deficiency handling, incident response and recovery time.
Defined AI incident-management procedures for model degradation, data-quality failures, hallucination events, security incidents, service interruptions and regulatory escalation, with post-incident review and corrective-action tracking.
Implemented formal model-lifecycle governance: versioning, approval, retirement, evaluation refresh, data-drift detection and policy updates for predictive models and LLM applications.

202612 contributions

Gavi, the Vaccine Alliance

Established and operates the Innovation Lab’s experimental AI tooling estate on Microsoft Frontiers models in Azure — including Cowork, Copilot Claude, MS Scout and OpenClaw for agentic-AI experimentation and architecture evaluation, alongside Cursor, Lovable, Bolt, v0, Microsoft 365 Copilot, Copilot Studio and Azure AI Foundry — under defined tool-selection rules, cost guardrails and an approved/excluded tooling list.
Covered visitor and case lifecycles, category taxonomies, referral routing and service metrics under hard confidentiality controls — an immutable audit trail, a strict “Chinese wall” between functions, visitor numbers with no names stored and a <5 anonymisation threshold on all reporting — modelled in C4 and validated by an independent penetration test before go-live.
Coordinated architecture-board acceptance of the Governance Bot: a permission-aware knowledge assistant for audit-committee, board and governance-decision queries in Teams and SharePoint on Azure AI Foundry, with an eight-metric production-approval framework — answer accuracy ≥90%, citation coverage 100%, fallback precision ≥95%, access-control integrity 100% — so an AI service is not approved on technical completion alone.
Skills and technologies: Azure solution and security architecture (App Service, Static Web Apps, Functions, SQL, Blob, Key Vault, API Management, Data Factory, Machine Learning, AI Foundry, AI Search, Monitor) · Snowflake · Azure OpenAI, RAG, multi-agent and agentic AI · MLOps/LLMOps and AI evaluation · AI governance, Responsible AI and EU-aligned AI risk management · Entra ID, RLS, TDE/CMK, PIM, managed identities, TLS · C4 and TOGAF · Power BI, Power Platform, Copilot Studio, Purview, Sentinel · confidential-data governance · innovation portfolio governance, vendor selection and procurement · Design Thinking and rapid prototyping facilitation.
Member of the Gavi architecture board, responsible for standards, investment prioritisation, solution assurance, exception management and technology-risk decisions; set up and coordinates the Gavi Innovation Lab.
Manages the Innovation Lab governance model, structuring innovation into three stepped streams (Ideation → Experimentation → Stabilisation) with five accountable roles, RACI ownership per activity, entry and exit criteria, and a rhythm of weekly experiment reviews, monthly idea reviews and quarterly approval sessions.
Manages dual-mode execution governance for experiments: in-house delivery with mandatory Platform Architect validation of capacity, skills, security guardrails and environments, and external delivery by vendors, startups and academia through a four-phase collaborator workflow with capability-based assessment, compliance checks and post-experiment partner evaluation.
Operationalised AI governance controls covering data leakage, agent proliferation, cost overruns, prompt injection, hallucination and shadow AI, with per-agent monthly credit limits and threshold alerting, DLP connector policies blocking third-party connectors, and monitoring across Power Platform Admin Center, Microsoft Purview and Microsoft Sentinel, reported monthly to the AI Steering Committee.
Established the reusable reference architecture for grounding Copilot agents in enterprise knowledge — SharePoint → Azure Blob → Snowflake → Azure AI Search vector index → Power Automate → Azure OpenAI → Copilot in Teams/SharePoint — secured with Entra ID RBAC, Key Vault and Purview DLP, with mandatory citation traceability and token-consumption cost controls.
Develops AI and solution architectures in full collaboration with the information-security and compliance function, as a formal pre-review and clearance gate rather than an after-the-fact sign-off; controls such as Entra ID SSO, least-privilege service access, audit logging of queries, responses and data access, restricted-content protection, Key Vault, PIM, RLS and Purview DLP are specified at design time.
Designed the secure Azure architecture for Gavi’s confidential Ombuds, Staff Counsellor and Ethics & Compliance case- and visitor-management platform: three segregated functions on Azure App Service over Azure SQL with Transparent Data Encryption and customer-managed keys in Key Vault, row-level security, Entra ID app roles enforced per request, managed identity as sole database principal and Privileged Identity Management with no standing admin access.
Defined a multi-tier Governance Copilot ecosystem separating the user-facing Governance Bot, a Governance Knowledge Hub and a Power Automate + Azure OpenAI Query Executor, with Azure Blob ingestion, Azure AI Search vector indexing, Entra ID single sign-on and Azure Monitor / Log Analytics monitoring of latency, token usage and errors.

2025–202610 contributions

Solara28

Engineered Solara28 as a high-performance, AI-powered match for global marketplace incumbents on enterprise capability, while preserving local control, regulatory compliance and economic value distribution for independent merchants.
An audited codebase review (August 2026) across eight engineering roles — frontend, backend, database, QA/security, DevOps, localisation, architecture and documentation — estimated the work at about 274.8 person-years (60,462 working days), roughly 275 engineers for one year, with a salary-equivalent labour value of about CHF 30.1M / EUR 19.6M at the midpoint (range CHF 25.9M–34.3M / EUR 15.5M–23.7M); all of it was delivered single-handedly. Evidence ↗
Designed, built and published the open-source Buonaiuto-Doc4LLM MCP server, which auto-detects a project’s library stack, fetches current official documentation and serves it version-aware to AI coding assistants — the RAG infrastructure that kept the agents’ 6M+ lines of code aligned with current, secure architectural standards and eliminated API hallucinations.
Moved Solara28 from architecture and development into controlled production readiness, including security hardening, environment separation, release governance, monitoring, backup and recovery procedures and operational support processes.
Established an end-to-end autonomous AI delivery model covering architecture design, code generation, testing, security validation, cloud implementation and documentation, with every artefact traceable to requirements, architecture decisions, source-control changes, code review, automated testing, security scanning and release approval; the Agentic Factory executed work across engineering, QA, DevOps, compliance, localisation, marketing, branding, e-commerce and online payments.
Governed the automated delivery lifecycle — architecture, software engineering, testing, security, DevOps and documentation — as an agentic AI operating model aligned with the EU AI Act.
Architected a provider-agnostic LLM service layer (TypeScript/Node.js/Supabase) connecting OpenAI, Anthropic and Gemini APIs, with configurable provider settings, prompt governance, conversation logging and health monitoring, powering conversational and voice-enabled commerce (“Talk to Your Shop”), automated catalogue ingestion from PDFs, photos and Excel, and predictive revenue forecasting.
Architected the platform so merchants retain full ownership of all operational and customer data, with a GDPR-native multi-tenant architecture for the European market, automated audit trails and European data residency.
Engineered a secure PostgreSQL architecture with hundreds of tables and compound Row Level Security policies, enforcing deterministic tenant isolation across platform, store, staff and customer contexts, with governance-by-design audit logging, activity feeds and observability of API latency, background jobs, errors and cache performance.
Built the platform administration domain: store onboarding and lifecycle, subscriptions and seat management, permission templates, monitoring dashboards, feature flags, audit and operational tooling, cross-store analytics, and billing with SDI e-invoicing for Italy.

2019–20243 contributions

DSM-Firmenich

Designed the data governance strategy for R&D and manufacturing on the DAMA Body of Knowledge, with policies, FAIRness guidelines, quality standards and data stewardship aligned to the corporate digital strategy.
Developed the global strategy for adopting clinical-trial data standards, extending CDISC-SEND to animal nutrition research to enable rapid submission of results to the FDA.
Applied validation-by-design for AI-enabled processes in pharmaceutical and clinical environments: requirements traceability, controlled documentation, test evidence, audit trails, change control and role-based approvals.

20183 contributions

Fair Trade Handels

Led data governance on the DAMA Body of Knowledge framework, ensuring compliance with GDPR, SOPs, GMP and GCP.
Introduced utilisation and capacity governance across distributed teams to balance growth, quality and profitability in regulated delivery environments.
Implemented end-to-end data-flow and integration standards and GDPR-compliant master data, making data FAIR across functions.

2002–20113 contributions

United Nations CGIAR

Led enterprise SharePoint programmes (2003–2010 editions), delivering governance, templates, workflows and institutional training.
Designed a new data governance framework for the UN agency IPGRI (International Plant Genetic Resources Institute), aligned with DAMA and applying ISO/IEC 27001 principles, setting data-management standards for global agricultural research.
Designed and managed 40+ institutional knowledge-management platforms — intranets, repositories, websites and scientific databases — and rationalised them into about a dozen governed platforms under common taxonomy, metadata and governance standards.

2012–20132 contributions

United Nations

Established a corporate taxonomy and knowledge-management framework for UNCCD (Protégé, OWL), strengthening discoverability, semantic interoperability, information governance and institutional knowledge reuse.
Designed and documented a UN institutional data-governance framework, including enterprise database analysis and entity-relationship modelling for multi-country, multi-agency data systems. Evidence ↗

2013–20181 contribution

Nespresso (Nestlé)

Audited the corporate data analytics function for all markets together with Adobe and Google, ensuring best practices and technology optimisation.

Profile21 contributions

Across the career

Specialises in Generative AI, LLMs, RAG, Agentic AI, predictive analytics, machine learning, MLOps, LLMOps, AI governance, AI factories and model evaluation; designs enterprise AI and data strategies and defines AI technology stacks and long-term machine-learning roadmaps through hands-on technical leadership.
Designs enterprise AI governance frameworks covering use-case intake, risk classification, data provenance, human oversight, evaluation, deployment approval, monitoring and retirement.
Architects AI solutions that connect business objectives, data foundations, operating models, technical platforms, governance and measurable outcomes.
Works across clinical-trial data strategy, TMF metadata, CTMS, eTMF, EDC integration, clinical time-series and regulated data ecosystems, partnering with Contract Research Organisations (CROs) to align clinical-trial data with CTMS, eTMF and EDC systems.
Applies ontology engineering, FAIR governance, knowledge graphs and structured metadata practices to improve scientific data interoperability.
Translates regulated-domain requirements into governed AI architectures, delivery models, validation processes and operational practices.
Demonstrates modern delivery leadership by orchestrating specialised AI-agent teams across architecture, implementation, documentation, testing and governance.
Designs enterprise data architectures combining DAMA and FAIR governance, data engineering, data mesh, event-driven design, cloud platforms and secure multi-tenant design.
Designs secure, observable, governance-by-design data platforms supporting auditability, feature flags, monitoring, subscriptions, billing, analytics and cross-tenant operations.
Combines strategic data governance with hands-on architecture, pipeline design, integration, data modelling and platform implementation.
Applies Row Level Security and controlled access patterns to protect data across complex enterprise and multi-tenant environments.
Understands the different governance, regulatory, operational and commercial requirements of highly regulated and customer-facing industries.
Connects technology strategy to business value, cost optimisation, operational efficiency, revenue growth, risk reduction and customer outcomes.
Specialises in taxonomy governance, ontology development, metadata standards, information architecture and institutional knowledge reuse.
Designs enterprise-grade multi-tenant SaaS platforms with secure tenant isolation, session-based access control and governance-by-design.
Combines multi-tenant architecture with audit trails, feature flags, operational observability, GDPR-aligned governance and controlled data access.
Balances scalability, security, maintainability, compliance and user experience in European SaaS platforms.
Designs agentic development methodologies in which autonomous AI agents support architecture, code generation, testing, security review, documentation and delivery governance, along with hands-on agentic AI architectures and platforms.
Applies continuous code generation, architecture review, security scanning, test-driven development and human oversight to AI-native engineering.
Advises C-suite and senior leadership on data governance, AI, agentic AI operating models and workforce transformation, and mentors executive teams moving towards data- and AI-led organisations.
Long-standing advocate of FAIR principles and responsible AI, covering governance, risk and compliance (GRC), ethics, GDPR, the EU AI Act and FINMA requirements.

Skills8 contributions

Skills & applied knowledge

AI and Generative-AI technologies: GANs, LLMs, agentic AI, FinOps, Trustworthy AI, MLOps, LLMOps, AI Factory strategy, MCP, A2A, multi-agent systems and Azure AI Foundry.
Enterprise productivity, automation and security: Microsoft 365, Project, Visio, Power Automate, Copilot, Entra, Azure Key Vault, Defender for Cloud, Sentinel, Azure Policy and Purview.
MLOps operating models, deployment practices, monitoring, automation and lifecycle governance.
Data management and governance with DAMA-DMBOK, FAIR principles, entity-relationship modelling, data warehouses, ETL, data virtualisation and data federation.
Programme and project management, strategic direction, Agile delivery, Scrum, SDLC governance, security management, security standards and enterprise technology standards.
Data engineering and governance: Apache Spark, Apache Airflow, MySQL, Microsoft SQL Server, Supabase/PostgreSQL, Kafka, MariaDB, SQL, Power BI, Databricks, Hadoop and NiFi.
Twenty-plus years of enterprise-architecture ownership across public and regulated organisations, and twenty-two years of software engineering spanning architecture design, SDLC governance, Agile, Scrum and mobile-application development.
Strong communication and presentation skills: technical evangelist with international keynotes and publications, communicating complex AI, data, investment and risk topics clearly to executive committees, boards and senior stakeholders.

All skills

Artificial intelligence

AI governance, risk & regulatory compliance 81 Machine learning, deep learning & MLOps 53 Data Strategy for AI 44 Generative AI & LLM solutions 43 Agentic AI & AI-native engineering 29

Architecture & data platforms

Solution & enterprise architecture 62 Data architecture, engineering & governance 54 Semantic engineering & knowledge management 50 Cloud & multi-tenant SaaS platforms 41

Leadership & business

Innovation & change management 42 Team leadership & talent development 31 Business value & financial management 29 Programme, project & vendor management 27 Executive advisory & pre-sales 19 Entrepreneurship & venture building 13

Product, marketing & communication

Digital marketing & customer analytics 27 Product & full-stack engineering 23 Communication & thought leadership 10