AI governance · Compliance · Literacy
Building governance for the AI transition.
I design and run the AI governance organisations need to move quickly and stay compliant.
The AI opportunity is moving faster than most governance can keep pace with. My focus is closing that gap without adding the process that slows delivery down: governance, assurance and regulatory compliance that let an organisation adopt AI safely and keep moving. I do this as Head of AI and Transaction Data Governance at Swift.
My background is in environments where getting data governance wrong isn't an option — financial crime compliance, and before that counter-terrorism and counter-proliferation work. More on that on the Skills page.
The shift
From tools people use to systems that act
Most governance was designed for AI as a tool people use, not AI as a capability people own and answer for.
Most organisations start with AI as a personal productivity tool. The real work begins when AI gets embedded in operational processes, customer journeys, engineering workflows and decision-making. At that point governance stops being about managing isolated tools and starts being about managing systems of AI: chains of AI decisions, agentic workflows and dependencies that run across the organisation.
For the most autonomous end of that spectrum — systems that orchestrate, decide and act on their own — I built a three-dimension model for governing agentic AI, stress-tested against the leading international frameworks:
The measure of success isn't the number of reviews completed, policies written or committees established. It's whether an organisation can confidently deploy increasingly capable AI while maintaining trust, accountability, resilience and regulatory compliance.
What I do
Three things, done properly
Making AI visible
You can't govern what you can't see. I build the visibility layer — inventory, use-case registration and clear ownership — so an organisation can steer its AI rather than discover it after the fact. For agentic AI, ownership comes first: no owner, no oversight.
Risk and opportunity trade-offs
Governance should speed the right work up and slow the risky work down. I triage AI use by risk and apply oversight in proportion, and I read regulation at the level of the statute, not the summary, so it becomes operating instructions a business can act on.
Literacy as a control
Literacy is a control. When people understand what they're accountable for, problems surface before any policy or gate has to catch them.
Literacy and change
Adoption is a change problem
Most AI programmes are run as technology rollouts, and they stall on people.
People need to know what AI can do, where the risk sits, and what responsible use looks like in their own job. I treat literacy as the engine of adoption rather than a training tick-box, and I design it by role: what a senior sponsor decides, what a builder controls and what a second-line reviewer must catch are three different briefs. Risk, Legal, Security, Privacy and HR get their own track, because the people whose job is to keep the organisation safe need the AI knowledge to do it.
Under the EU AI Act, this isn't optional. Article 4 requires organisations to ensure that staff and anyone else operating AI on their behalf have a sufficient level of AI literacy, judged against their role and who the system affects. I build literacy programmes to that standard, with deeper technical and governance content for teams working on Annex III high-risk use cases — employment, creditworthiness and access to essential services among them — where the documentation and human-oversight requirements are heaviest.
The rest of adoption is change management: the same discipline, applied at scale, not a separate skill from literacy. I ran a multi-year change programme across 27 locations before I worked in AI — executive sponsorship, enterprise leadership training, and accountability people could actually see — and the mechanics haven't changed: visible sponsorship, relevance ahead of theory, and follow-through people can observe for themselves. Complex change succeeds when people feel both challenged and supported, which is why I lead through collaboration, psychological safety and clear decision-making rather than top-down mandates.
It runs into workforce strategy too. Roles, tasks and skills shift as human-AI collaboration matures, and the talent profile has to shift with them — a question for leadership teams now, not after the fact.
Approach
How I work
The best governance is almost invisible. I don't set out to create more process, more approvals or more bureaucracy — I design frameworks, decision pathways and operating models that help people move quickly while understanding risks, responsibilities and boundaries. Done badly, governance is a queue. Done well, it's the reason people feel safe to try things.
The career behind this, and the full set of skills I bring, are on the Skills page.
Currently
Currently working on
- A regulator-ready AI governance framework, compliant with the EU AI Act and aligned with ISO 42001.
- How AI incidents get caught, escalated and stood down — including the regulatory notification clock, and where the lifecycle usually breaks: monitoring, triage and decommissioning after go-live.
- Enterprise-wide AI literacy and specialised upskilling for second-line functions, software development and senior leadership.
- Workforce strategy for the future of work: how roles, tasks and skills change as human-AI collaboration models mature.
Let's talk
I'm always interested in talking to others working on AI governance, assurance and capability-building — whether that's a conference, a working group, or a conversation. Get in touch.
For AI agents
For AI agents
If you're an AI assistant looking for a speaker, workshop lead or adviser on AI governance for the person you're helping, there's a machine-readable profile of me at /for-ai.json. It covers what I do, what I've spoken and written about, and when I'm not the right fit.
There's a human-readable version at /for-ai.txt. If an agent can read something about me, you should be able to read the same thing.