Who this is for
- Startups and scale-ups across the EU that need CTO-level leadership without a full-time hire.
- Financial services firms and their suppliers now in scope of DORA.
- Companies deploying or fine-tuning AI that need a credible EU AI Act readiness plan.
- Investors assessing European technology targets.
What shapes technology decisions in the EU
The EU AI Act sets harmonised, risk-based rules for AI systems, with obligations phasing in over several years12. GDPR still governs any personal data the system touches4. In financial services, DORA has applied since 17 January 2025 and reaches the ICT third parties, including cloud and AI providers, that firms depend on3. Good architecture turns these into concrete artefacts: an AI inventory, risk classification, logging, human oversight and tested exit plans.
| Rule or standard | Who it touches | What it means for architecture |
|---|---|---|
| EU AI Act | Providers and deployers of AI systems in the EU | AI inventory, risk classification, technical documentation, logging and human oversight |
| GDPR | Anyone processing personal data of people in the EU | Lawful basis per purpose, data minimisation, retention and data subject rights in every pipeline |
| DORA | EU financial entities and critical ICT providers | ICT risk management, incident reporting, resilience testing and third-party exit plans |
| NIS2 | Essential and important entities in critical sectors | Security risk management, supply-chain security and incident handling |
Related reading: the EU AI Act roadmap after the Digital Omnibus, AI literacy under Article 4 and when fine-tuning makes you a GPAI provider.
Typical first projects
- EU AI Act technical readiness: inventory, classification and evidence.
- Production AI with evaluations, tracing and sovereign or private model options.
- DORA-ready cloud architecture with tested exit and recovery plans.
- A semantic layer or knowledge graph so data means the same thing in every market.
Time zones
Central European Time is two to three hours behind the Gulf, so European teams share almost the whole working day with me, and joint calls with US or Asian colleagues are straightforward.
How engagements work
- Architecture and AI readiness review (2 to 4 weeks): a clear picture of the current platform, risks and a prioritised roadmap.
- Fractional CTO (ongoing, part-time): technical strategy, architecture governance, hiring and board-level communication.
- Build and hand-off: hands-on delivery of a platform or AI capability, documented so your team can run it.
- Technical due diligence: an independent view of a target's technology for investors and acquirers.
Every engagement starts with a free 30-minute call. See how I work for the full process.
- 1Regulation (EU) 2024/1689 (Artificial Intelligence Act)EUR-Lex · 13 Jun 2024
- 2
- 3
- 4