I help regulated service providers close the enterprise trust gap — turning GRC, cyber resilience and AI governance from paperwork exercises into shippable systems.
Over 20+ years I've built and run enterprise-grade information security, cybersecurity management and AI governance programmes for organisations ranging from a €75BN global credit-asset manager to the UK's public spending watchdog; through to technology leaders such as Rackspace and Microsoft.
I now bring that same depth to growth-stage and scale-up B2B firms as founder of GRCMANA, an AI-native cybersecurity and GRC advisory practice built to reduce risk, build resilience and accelerate trust with your customers, regulators and investors.
What I'm best at
I'm at my best when I'm helping regulated service providers across financial services, insurance, fintech, healthtech, medtech and technology build real solutions that solve big problems.
- Fractional CISO & security leadership — I own security strategy, governance and risk management end-to-end, so you get board-level security leadership without a full-time hire.
- Building Trust Systems - I build modern, automated systems that deliver audit-ready compliance and builds trust with clients, regulators and investors.
- Building Cyber Resilience - I design, build and optimise cyber defence capabilities that anticipate, withstand and recover from cyber threats.
- Building AI Security & AI governance — I apply ISO 42001, the EU AI Act and NIST AI RMF to make AI adoption defensible, not risky.
Responsible AI: turning principles into controls, owners and evidence
Responsible AI means developing and using AI in ways that are safe, transparent, fair, accountable and open to challenge. For a UK firm, the 2023 white paper's five principles are the natural spine. Each principle needs one control, one owner role and one evidence record, which together answer the AI section of a customer questionnaire and lay groundwork for ISO/IEC 42001:2023.
AI risk: the risks your firm actually carries when it uses AI
AI risk is the chance that an AI system a firm builds, buys or lets staff use causes legal, data, output, supplier, operational, security or reputational harm. Most of it extends risks the firm already manages. Whether the firm is a provider or a deployer decides which risks it carries, and each category belongs in the existing risk register with a named owner.
AI policy: what it must contain and how it fits your policy set
An AI policy has two layers: a short governance policy that sets commitments, names an owner and defines how AI use is approved, recorded and reviewed, and staff usage rules that belong in the acceptable use policy. Each other policy keeps the AI rule for its own subject. Approval and review records, plus an AI register, are the evidence customers ask for.
AI risk assessment: how to assess one AI use case for ISO 42001, the EU AI Act and UK GDPR
An AI risk assessment looks at one AI use case and asks what could go wrong for the organisation and what could happen to the people it affects. Scoped per use case, one record can serve ISO/IEC 42001, a UK GDPR DPIA and the provider inputs a customer needs for its EU AI Act fundamental rights impact assessment.
AI register: how to inventory every AI system your firm builds, buys or switches on
An AI register is a firm's own record of every AI system it builds, buys or uses, including AI switched on inside approved SaaS. We recommend one row per system per business purpose, built as an extension of the ISO 27001 asset inventory. Each entry records an owner, purpose, data, EU AI Act role, high-risk screen and review date, so one record serves regulation, risk and customer questionnaires.
The AI regulation UK firms already face, and where the EU AI Act reaches
The UK has no AI Act and, as of October 2026, no government AI bill. AI is still regulated by three routes: UK law such as UK GDPR Articles 22A to 22D and the Equality Act 2010, sector expectations from the FCA and PRA that regulated customers pass to suppliers, and the EU AI Act wherever AI output is used in the EU.
Stop losing deals to trust deficits.
Book a free 30-minute Discovery Call. We'll identify your biggest trust gap and map a clear path to your first certification.