About
A practitioner's path.
I started in state compliance work, then cybersecurity GRC, the discipline of proving an organization actually controls what it claims to control, not just documenting that it should. That grounding is what carried over when AI stopped being an experiment and became core infrastructure. The question didn't change who's accountable when the system acts. What changed is that I now build that accountability into AI systems directly, and use AI itself to make GRC work faster, evidence gathered quicker, findings structured cleaner, without ever letting it make the call.
That's the whole philosophy, really: AI drafts, scores, and structures. A named human owns what happens next. Not a slogan, the actual difference between governance that holds up under audit and governance that's just paperwork waiting to be tested.
Progression
Regulated operations to AI governance.
Each stage of the work made the next one legible. The sequence explains why GRC and AI implementation sit together in one practice.
- 01
State Compliance
Started in state-level regulatory compliance, operating inside a heavily codified framework, unclaimed property law, where getting a determination wrong carries real financial and legal consequence. That's where the instinct came from: compliance isn't a document, it's a standard the organization is actually held to.
- 02
Cybersecurity GRC
Moved into formal cybersecurity GRC work, building risk registers and compliance baselines from zero for organizations that had never had one, translating regulatory requirement (HIPAA, ISO 27001) into what a team does differently on a Tuesday.
- 03
Technology governance
As organizations layered more of their operations onto platforms and automated workflows, that same discipline extended to governing the systems themselves, not just the people following policy around them, building governance structure directly into how a technology platform actually ran.
- 04
AI focused GRC
When AI systems started making real operational decisions, the same question followed: who's accountable for what this system is allowed to do. Built AI Audit Control Matrices and governance blueprints defining exactly that, permissions, approval gates, and the evidence trail proving the system stayed inside its boundary.
- 05
AI implementation & governance
The clearest lesson came from the inside: leading an AI implementation that ultimately had to be scrapped when governance hadn't kept pace with what the technology was already doing. That's the exact failure this practice exists to prevent, implementing AI and governing it as one discipline, built together from day one, not bolted on after.
Coherence
Related disciplines. Not the same discipline.
GRC and AI implementation share a way of thinking about consequence, evidence and control\u00a0 but they are practiced differently and should not be conflated.
What they share
- Understanding how work actually gets done
- Designing for evidence and oversight
- Treating risk as a design input, not an afterthought
- Accountability that survives staff turnover
Where they differ
- GRC is grounded in obligation, assurance and control evidence
- AI work is grounded in workflow value, adoption and measurement
- Different stakeholders, different cadence, different success tests
- Either can be engaged entirely on its own
Have a consequential GRC or AI problem?
If the problem is significant, ambiguous, or carries governance and risk implications, a short conversation is usually the fastest way to establish whether there is a fit.