advisory / 04
Strategy & Governance
A decision you can defend: the roadmap, the target architecture, the governance design — or the FRIA dossier.
Strategy documents are easy to produce and hard to defend. The test is not whether the deck looks right; it is whether an architect can file the decision, an auditor can accept the artifact, and a supervisor can read the dossier.
Phased work that ends in a decision you can defend — the roadmap, the target architecture, the governance design, or, for a public body, the FRIA dossier.
you receive
You receive: one fixed artifact per phase — the roadmap (use cases with effort, value and a twelve-month sequence), the target architecture (a diagram plus a decision record, bounded to interfaces and the local-versus-cloud posture), or the governance design (an AI register, an acceptable-use policy, a risk classification, a named owner, and a lightweight management layer aligned to ISO/IEC 42001 — a voluntary standard, not a legal requirement). Public-sector variant: the FRIA dossier.
what is fixed — three artifacts and the dossier
- 01
roadmap — the use cases that survive a cost and value comparison, sequenced into twelve months, with the reversible ones first. Governance keeps failing to keep up with deployment: three in four organisations plan to deploy agentic AI within two years, one in five has a mature governance model for it
- 02
target architecture — interfaces and the sovereignty posture, as a diagram plus a decision record; explicitly not an implementation. Model portability is a line in it, because a two-year architecture that hard-codes one provider is a procurement risk
- 03
governance design — the register, the acceptable-use policy, the risk classification, the named owner, and the vendor-review clauses. The voluntary baselines are named, and separated from the statutory ones
- 04
public-sector variant — the FRIA dossier: the seven elements of Art. 27, the bridge to the data-protection impact assessment, notification preparation, and the deployer procedures
- 05
no open-ended advisory relationship: every phase has a one-page scope and a named artifact. A phase that cannot name its artifact is not a phase
- 06
standards posture, stated plainly: the NIST AI Risk Management Framework is voluntary and the Generative AI Profile is its companion resource; ISO/IEC 42001 is the first certifiable AI management system standard and also voluntary. Neither is a legal requirement, and I will not present either as one
engagement shape
phases of 4–8 weeks, fixed price per phase, ending in a plan plus one pilot rather than an open programme. FRIA: 2–4 weeks.
phases of 4–8 weeks, fixed price per phase, ends in a plan plus one pilot · FRIA dossier (Art. 27) as one phase, 2–4 weeks
standing-role tierFractional AI Lead — fixed monthly days, documented architecture and governance decisions, owns the eval bar, reviews vendor claims, no commissions. Six-month minimum, quarterly review, defined days per cycle, written exit terms.
segment variants
- startups
- usually the wrong purchase at the wrong time; if you are here, it is because a funder or an enterprise customer is asking, and the answer is smaller than this page
- SMB
- the roadmap you actually act on next quarter, plus the register if you have more than a handful of uses
- enterprise
- a decision record your architecture board can file, and governance your auditors can accept
- non-tech
- a governance design you can explain in one page to a board, without a technical translator
- public administration
- the FRIA dossier and supervisory-ready documentation, on the 2 December 2027 clock
not for
not a slide deck and not an open-ended retainer.
the artifacts behind this format
the next step
public-sector variant: request the FRIA dossier scope, in German
public administration
the FRIA dossier (the seven elements of Art. 27, the data-protection bridge, notification preparation) plus the deployer procedures — supervisory-ready documentation, written in German.
last refreshed 2026-10-17 · reviewed quarterly
Sources: Deloitte, State of AI in the Enterprise 2026 (survey) · NIST AI 600-1, 2024 · ISO/IEC 42001 (voluntary; cited via a certification-body explainer) · Regulation (EU) 2026/1744.