AI governanceAI transformationDAIGI Ambassador
NIST AI RMF, the EU AI Act, ISO/IEC 42001 and African regulation, turned into controls people operate on Monday morning. Nine years inside a regulated bank; now advising across Africa and MENA from Cairo.
Selected work
No AI policy, no risk tiering, no named owners. I built an ISO/IEC 42001-aligned framework with Risk, Compliance and Internal Control gates at intake.
Answers from the bank's own procedures for 3,500+ frontline staff. Shipped on schedule in Nov 2025, with risky agentic features held back.
A governance maturity assessment I architected for five African regulatory environments, across People, Process and Technology. Try a sample.
Every section of the Bill, clause by clause, modelled on the EU AI Act Explorer. Built so compliance teams read the clause, not a summary of it.
How I work
The same three moves, whether it's a 4,000-person bank or an early-stage health AI lab.
Inventory every AI use, including vendor tools. Give each an owner and a risk tier before anyone writes policy.
Write each control once and map it to NIST AI RMF, the EU AI Act, ISO/IEC 42001 and your local regulator, so one policy answers several regimes.
Train the people who operate it, gate new use cases at intake, and keep the evidence an auditor will ask for.
Latest
What's in the AU's draft continental AI model law, and what I told them in the open consultation.
Consciousness, sentience and moral status — notes from a reading-group session.
Why a small yes/no model may do more for human oversight than another 40-page policy.
A Q&A on credit scoring, algorithmic bias and human oversight in African banking: oversight scaled to risk tier, recourse for the people affected, and why bias and drift thresholds belong at the design stage.
“You cannot govern what you do not own.”Read the feature ↗
Tell me what you're building. In 30 minutes you'll know which controls apply and what to do first.