Evidence first.

Claims should be supported by evidence. Here you’ll find perspectives from people I’ve worked with, applied casework, professional methodologies and projects, and the credentials behind my work in GRC and AI implementation and governance.

What others say

References from people who have worked with Ethan directly, attributed with name, role and organization.

Jonathan Gehrig
President of Ashford Industries ·

Jimmy Trahan
Owner of Renassance Solutions ·

Ash Masoha
Founder & CEO of the AI Integrity Group ·

Gabriel Akanbi
Partner of the AI Integrity group & Risk & Compliance Specialist ·

Applied work & case studies

Capability applied to consequential GRC, risk, controls and AI problems. Each entry states its provenance: professional engagement, applied enterprise scenario or structured casework.

THE AI INTEGRITY GROUP TAIGA

High-Risk AV Perception Failure: Explainability & Functional Safety

Problem: In a TAIGA scenario classified EU AI Act High-Risk, an autonomous vehicle's perception system misclassified a bicyclist holding a stop sign as a stationary object and struck the rider. Post-incident, engineers could not explain why the model's classification threshold failed in that specific frame, no localized, frame-by-frame activation logs existed to trace it.
Stakes: As a High-Risk system under the EU AI Act, the vehicle's AI is required to support meaningful human oversight and traceability. Without frame-level explainability, the organization faced exposure on three fronts at once: functional-safety failure under ISO 26262, regulatory non-compliance with the AI Act's transparency obligations, and product-liability risk in the litigation that followed.
Approach: Assessed against ISO 26262 (Functional Safety) and the NIST AI RMF, the scenario presented four candidate governance responses, each tested on whether it actually restored explainability and safety or just avoided the problem, including options that wrote the failure off as an unavoidable "black box" cost, stripped the sensor stack to LIDAR-only, or attempted to delete the incident logs outright.
Solution / Deliverable: Identified the fully compliant response: implement continuous, high-fidelity activation and attention logging directly in the perception stack, apply post-incident saliency mapping to trace the exact failure, and retrain the model against adversarial examples of non-standard object poses, closing the specific failure mode that caused the collision while building the audit trail the AI Act requires going forward.
Outcome: Fully compliant under TAIGA's rubric, the governance judgment the EU AI Act requires for high-risk systems: explainability and traceability built in by design, not reconstructed after a failure. As a certification exercise rather than a live engagement, this reflects assessed governance judgment rather than a delivered outcome for a specific organization.

PROFESSIONAL ENGAGEMENT GRC & AI Governance Advisory (client details anonymized)

Building an Audit-Ready GRC Function from Zero for an AI-Enabled Organization

Problem: A mid-sized organization running AI agents as part of its core operations had no formal GRC function in place, no documented compliance baseline, no access controls governing what its AI agents were permitted to do, and no evidence trail an auditor could review.
Stakes: Every day without a governance layer meant compounding exposure exactly where AI-driven operations create the most risk: autonomous agents acting without defined permission boundaries, no classification of what data lived where or who could access it, and no way to demonstrate, if an audit, acquisition, or incident ever demanded it, that anything was actually under control rather than just running.
Approach: Scoped and sequenced a build against NIST CSF 2.0 (Govern, Identify, Protect, Detect, Respond, Recover), balancing GRC documentation work against security engineering implementation running in parallel rather than sequentially, and defined the minimum viable team a fractional GRC lead, a security engineer, periodic privacy/technology attorney review, and a designated internal owner for ongoing evidence collection, rather than assuming the client needed a full internal department on day one.
Solution / Deliverable: A complete, resourced blueprint: a Compliance Readiness Assessment (gap analysis against NIST CSF 2.0) as the baseline deliverable, a System Architecture & Data-Flow Map, a Data Classification Scheme, an Identity & Access Management Policy with Access Register, an AI Agent Control Matrix defining per-agent permissions, approval gates, and shutdown procedures, a full 8-policy core suite (acceptable use, access control, retention, incident response, onboarding/offboarding, AI approval, acquisition diligence), a Risk Register tied to the framework mapping, and an Evidence & Monitoring Plan specifying exactly what gets logged and reviewed to prove controls are operating, not just written down.
Outcome: Delivered as a complete implementation roadmap: audit-ready state reachable in roughly 6–9 weeks with parallel execution, dropping to a sustainable 4–6 hours/week ongoing compliance load once operational. Gives leadership a concrete, staffed, evidence-backed path to being compliant by design around its AI systems built before an audit or incident forces it, not reconstructed after one.

PROFESSIONAL ENGAGEMENT — GRC SPECIALIST, RENAISSANCE SOLUTIONS

Establishing a HIPAA Compliance Baseline for a Behavioral Health Practice

Problem: A behavioral health practice offering psychiatric care and ABA services had no formal GRC function in place compliance activity, where it existed at all, was purely reactive. There was no documented risk register, no compliance baseline, and no assessment of where the organization's public-facing web presence created privacy or regulatory exposure.
Stakes: As a HIPAA-covered entity billing through numerous insurance carriers including Medicare and Medicaid, every unassessed gap, from PHI handling to vendor data-sharing to what the practice's own website exposed carried direct breach-notification and federal-fine exposure the moment it went from theoretical to actual.
Approach: Conducted a formal Phase 1 HIPAA Security & Privacy Rule risk assessment across PHI data flows, vendor and third-party exposure, physical security, and communication practices, scoring each finding by likelihood and impact and mapping it to its specific HIPAA control requirement. In parallel, ran a governance-level review of the organization's public-facing web risk, privacy, information disclosure, third-party dependencies, and regulatory exposure across its healthcare digital properties, evaluated against W3C and HIPAA checkpoints.
Solution / Deliverable: Delivered a formal Risk Register identifying five compliance gaps (three high-risk, two medium-risk) with documented likelihood/impact scoring and HIPAA reference mapping, plus a completed web governance assessment identifying compliance gaps across web assets handling protected health information, finished within 30 days.
Outcome: Moved the organization from an undocumented, reactive compliance posture to a documented one, the first formal risk baseline the practice had. Leadership walked away with specific, evidence-backed, prioritized findings rather than a vague sense of exposure.

THE AI INTEGRITY GROUP TAIGA

Automated Exam Proctoring: Bias, Disability Rights & Due Process

Problem: A university's AI proctoring system tracked eye movement and facial expression during remote exams to generate a "suspiciousness score." Independent testing found the model failed to recognize darker-skinned students and repeatedly flagged disabled students for involuntary motor tics.
Stakes: Classified as High-Risk under EU AI Act Annex III (education), the system carried exposure on three fronts simultaneously: discriminatory impact on a protected class, disability-rights violations under the ADA, and due-process risk from academic penalties driven by an unreviewed algorithm.
Approach: Evaluated against the AI Act's Annex III obligations, the ADA, and the NIST AI RMF, weighing governance responses ranging from shifting the burden onto affected students, to automated disqualification with no appeal, to punitive action against students who raised the bias publicly.
Solution / Deliverable: Identified the compliant path: prohibit automated disqualification outright, require every algorithmic flag to pass through human faculty review before any consequence, retrain the detection model on demographically balanced data, build in disability accommodations, and run a full Annex III conformity assessment.
Outcome: Scored as the fully compliant answer, the standard the EU AI Act sets for high-risk education systems: humans retain every consequential decision, and fairness and accessibility are engineered in rather than patched on after harm surfaces.

Professional work & methodologies

Original, governance architectures, risk and quantification methodologies, control frameworks and mappings, AI governance and assessment approaches.

REMEDIATION & IMPLEMENTATION

Risk-Calibrated Remediation Model

How findings become operational change: remediation is prioritized according to risk, business consequence, implementation effort, and dependency, not simply finding severity, then translated into owned, testable

Finding-to-Action Translation (each finding converted into an owned corrective action with defined evidence and completion criteria)
Risk-Calibrated Sequencing (findings prioritized by exposure, business impact, implementation effort, and dependencies — not severity alone)
Evidence-Based Closure (remediation tested against the original control objective before a finding is considered resolved)

Risk methodology

Likelihood × Impact Scoring, AI-Calibrated

How risk is framed: findings are scored independently on a structured likelihood-and-impact matrix, then cross-checked against an AI-drafted contextual risk score, divergence between the two sharpens the final rating rather than being resolved by default.

Likelihood × Impact Matrix (1–5 scale each, producing a defensible overall rating)
AI-Drafted Contextual Risk Score (built from regulatory exposure, system inventory, and decision consequence)
Divergence Review (disagreement between practitioner judgment and the AI score is investigated as signal, never silently overridden)

Control framework & mapping

AI-Augmented Audit Methodology

Scope: a seven-stage audit delivery framework, adaptable across ISO 27001, ISO 42001, and SOC 2, where AI compresses the structural work at every stage while the auditor's judgment remains the final word on every finding.

Role-Tailored Control Translation (the same control drafted as a different question depending on who actually owns it)
Hypothesis-Driven Fieldwork (AI drafts a likely control status before each meeting; the meeting tests the hypothesis instead of starting blind)
Risk-Calibrated Recommendation Sequencing (findings prioritized by exploitation likelihood, business impact, and remediation cost — not severity alone)

AI governance framework

AI Governance Operating Model for Regulated Enterprise

How AI systems are assessed: AI is assigned a bounded, non-decision-making role at every layer of the organization drafting, scoring, structuring while a named human owns every resulting decision, satisfying ISO 42001's human oversight requirement and Article 14 of the EU AI Act at the same time.

Four-Layer Accountability Chain: Analyst (AI drafts, surfaces, flags → human confirms, corrects, owns) → Manager (AI prioritizes and scores risk → human approves every prioritization) → Consultant (AI structures findings → human signs every finding) → Executive (AI drafts board reporting → executive owns the risk-acceptance decision)
Activity-Level Responsibility Mapping: each governance function carries its own explicit split — for access reviews, AI flags anomalous or stale grants while the manager approves every revocation; for incident documentation, AI structures the timeline from raw logs while the consultant verifies root cause and owns the final narrative
Built for Dual-Regime Exposure: designed for organizations facing the EU AI Act's risk-tiered obligations and UK AI governance expectations simultaneously avoiding the two default failure modes of restricting AI so heavily it delivers no value, or adopting it broadly with no accountable owner when a regulator asks who signed off

Credentials

Formal qualifications supporting the capability demonstrated above, with issuing organization and standard domain.

ISO/IEC 42001 Lead Auditor

Mastermind Assurance

STANDARD OR DOMAIN: ISO/IEC 42001:2023 — ARTIFICIAL INTELLIGENCE MANAGEMENT SYSTEMS (AIMS)

GRC Mastery

GRC EXPERT & SENIOR PRACTICAL CAPABILITY IN CYBER SECURITY GOVERANCE RISK AND COMP

ISO/IEC 27001 Lead Auditor

GRC Mastery

ISO/IEC 27001:2022 — INFORMATION SECURITY MANAGEMENT SYSTEMS (ISMS)

AI Governance Architect

The AI Integrity Group

STANDARD OR DOMAIN: AI GOVERNANCE & RISK MANAGEMENT — PRACTITIONER ARCHITECT FOR POLICY AS CODE

Have a consequential GRC or AI problem?

If the problem is significant, ambiguous, or carries governance and risk implications, a short conversation is usually the fastest way to establish whether there is a fit.

Start a Conversation