Europe's data leaders are being asked to do three hard things at once: keep GDPR controls audit-ready, stand up governance for the EU AI Act as it comes into force, and meet DORA's operational-resilience expectations in financial services. The common thread is that policy is no longer enough — regulators and auditors want evidence the controls actually ran.
Why I can lead this — GDPR controls I have delivered vendor-side
Many know GDPR from an exam. I have delivered GDPR-aligned controls in regulated production for global financial-services clients — vendor-side, not as an EU controller. At FICO I owned data-technology control governance across metadata, quality, privacy and reliability for 50+ regulated financial-services clients — protecting 232M+ records per cycle with classification, masking, access control and audit-ready evidence. GDPR is not a framework I am learning for this market; it is the regulation I have operated under.
The EU regimes, against controls I have already built:
- GDPR — lawful basis, data-subject rights, classification, masking, retention and breach evidence — delivered vendor-side for global financial-services clients.
- EU AI Act — data governance for high-risk systems, record-keeping/logging, human oversight and model controls — the exact control families I built into governed AI.
- DORA — incident management, RCA, control testing and audit evidence: the operational-resilience discipline behind my 95% incident-reduction and worst-case resolution cut from 20–100 hours to under 4 at FICO.
- DAMA-DMBOK — the ownership, metadata, lineage and quality backbone, held as a CDMP credential (Governance 83%, Data Quality 88%).
The EU AI Act, as working software — not a policy deck
The AI Act's obligations for high-risk systems map cleanly onto controls I have built and can demonstrate live, rather than describe:
- Data and data governance (Art. 10): privacy classification, survivorship and lineage — see Golden Record RAG resolving 89,198 source records into trusted golden records.
- Record-keeping & logging (Art. 12): an immutable audit packet for every answer — see MediGovern RAG's cited, audit-logged responses.
- Human oversight (Art. 14): review gates and explicit abstention when evidence conflicts — built into MediGovern's six-rule quality gate.
- Transparency & control plane: ingestion, DQ, lineage and governance as operable screens — see Pipeline Pulse, DMBOK as working software.
Where I fit, and how I will move
On language: I am learning German — currently beginner (A1) and progressing. That supports the Opportunity Card route and signals a genuine commitment to the move; for now I am targeting English-first employers where German is not a day-one requirement, and I will keep building toward working proficiency.
See the controls working
The EU AI Act and GDPR both demand defensible classification, lineage and audit evidence. Rather than describe it, here are governed systems you can open and click right now:
Working proof. Three governed-AI systems you can open now — Golden Record RAG, MediGovern RAG and Pipeline Pulse — plus the Enterprise Data Platform hub with runbooks and templates. See the working systems →