Twelve weeks to a working pilot. Twelve months to an answer for the regulator.
I lead AI governance at a Victorian water utility, which means I sit at the point where an exciting demo meets a privacy commissioner, a procurement panel, a legal team, and a board that has to sign something. The interesting work is not getting the model to answer. It is being able to show, months later, who approved it, on what evidence, and what happens when it is wrong.
My route here ran through the build side. Data science degrees, a Master of Data Science at Melbourne, twelve granted patents in AI and cybersecurity, and years shipping models before governance was a job title anyone wanted. That matters, because governance written by people who have never deployed anything becomes paperwork, and paperwork gets routed around.
Alongside the utility work I run Novareck AI, an independent consultancy taking the same audit-ready approach to SMEs and regulated industries, and I teach and speak on AI governance to people who have to make these calls next quarter, not in theory.
A vendor claim is not a control. Every risk assessment I sign is grounded in the vendor's own published documentation, cited and dated, so the finding survives the vendor changing their marketing page.
Retrofitting governance onto a live system means choosing between switching it off and accepting the risk. Constraints belong in the architecture review, not the incident review.
Most organisations have an application register and a shadow estate that ignores it. A register nobody can see into is a comfort object. Discovery has to be automatic or it is fiction.
Consulting, banking, insurance, legal, and now water. The regulated end of every one of them.
Hover any cell for where the number comes from.
Context, approach, control, outcome. The four questions an auditor asks in that order.
Filed across AI and cybersecurity in India and the United States, alongside published research and national awards.
Governance instruments on the left, the things being governed on the right.
Governance questions, AI risk reviews, speaking, or consultancy work.
If you are standing up AI governance from nothing, trying to get a Copilot rollout past legal, or holding a vendor claim you cannot verify, that is the conversation I want.
I also take speaking and teaching work on AI governance for audiences who have to make real decisions, and consultancy engagements through Novareck AI.
Questions about data science, AI, ML, or guidance on research papers and patents are welcome too.