Who this is for
- Seed to Series B startups that need CTO-grade judgement on architecture, hiring and investor diligence before a full-time CTO makes sense.
- Scale-ups whose platform is straining under growth, or whose AI pilots are stuck before production.
- Healthcare and life sciences companies building on clinical data, where interoperability and privacy decide what is possible.
- Investors who want an independent technical view before they commit.
What shapes technology decisions in the US
There is no single federal AI law. Instead, buyers expect a recognised security attestation, sector rules apply to the data you hold, and a growing number of states are legislating on AI. Health data falls under HIPAA1; enterprise customers usually ask for a SOC 2 report built on the AICPA Trust Services Criteria3; and many organisations use the voluntary NIST AI Risk Management Framework to structure AI governance2. States such as Colorado have passed laws aimed at high-risk AI decisions4, so it pays to design for documentation and impact assessment early.
| Rule or standard | Who it touches | What it means for architecture |
|---|---|---|
| HIPAA | Providers, payers and their business associates | Encryption, audit trails, minimum necessary access and de-identification built into the data platform |
| SOC 2 | B2B software selling to enterprises | Access control, change management, logging and vendor management, including model providers |
| NIST AI RMF | Any organisation deploying AI | A shared vocabulary for mapping, measuring and managing AI risk, with evaluations and monitoring |
| State AI laws | Deployers of high-risk AI decisions | Impact assessments, notices and documentation designed in rather than bolted on |
Related reading: SOC 2 for AI startups, Colorado's AI Act, HIPAA and AI platforms and ISO 42001 vs NIST AI RMF.
Typical first projects
- Getting an AI or RAG pilot into production with evaluations, tracing and a known cost per query.
- Re-architecting a platform for scale: event-driven cores that have carried 1M+ transactions a day.
- A HIPAA-aligned clinical data platform on FHIR and OMOP.
- Technical due diligence ahead of a funding round or acquisition.
Time zones
I work on US hours for US clients, with Eastern and Pacific time both covered. Teams split between the US and Europe, the Middle East or India get an operating rhythm with written decisions, so nobody waits a day for an answer.
How engagements work
- Architecture and AI readiness review (2 to 4 weeks): a clear picture of the current platform, risks and a prioritised roadmap.
- Fractional CTO (ongoing, part-time): technical strategy, architecture governance, hiring and board-level communication.
- Build and hand-off: hands-on delivery of a platform or AI capability, documented so your team can run it.
- Technical due diligence: an independent view of a target's technology for investors and acquirers.
Every engagement starts with a free 30-minute call. See how I work for the full process.
- 1HIPAA for ProfessionalsUS Department of Health and Human Services
- 2
- 3
- 4SB24-205 Consumer Protections for Artificial IntelligenceColorado General Assembly