Where you enter
Most people start with the briefing.
The half-day board briefing and the governance workshop both produce the score, so either one doubles as the diagnostic. Deeper engagements assume it already exists.
Work with me
The toolkit is the method. This is the method with me in the room.
Twenty-five years running technology businesses, now spent on the risk class most boards have not yet learned to oversee. I take on a small number of engagements at a time, which is the only honest way to do this work well. Every shape below starts with the same twenty-minute call.
The engagements
-
Board and executive briefing
Half a dayWhat should this board be asking, and of whom?
A working session that leaves a board able to ask the questions that surface real exposure — not a state-of-AI deck. Usually where a first conversation starts, and often enough on its own.
You leave with Your readiness score, and the three rows that fail first under scrutiny.
-
Governance workshop
One to two daysWhat does this look like on our actual estate?
The framework applied to what you are really running. We fill the instruments in the room against your systems, your owners and your gaps, rather than handing you blank worksheets and wishing you luck.
You leave with Thirteen rows scored against your own systems, with a named owner on each.
-
Programme engagement
Weeks to monthsWho runs this once the workshop is over?
Standing up the governance operating model and staying until it holds without me — named owners, a cadence that actually convenes, and evidence that accumulates as a by-product rather than a fire drill.
You leave with A governance operating model that convenes without me, and evidence that accumulates on a cadence instead of the week before an audit.
-
Fractional CIO, CISO or CAIO
Three-month minimumWho holds the seat while you work out what it should be?
A part-time executive seat, not a recommendation about one. I have held CIO and CISO roles mid-transition. The CAIO seat is newer, and most organisations standing one up are really asking for both of the others plus AI fluency. Three months is the floor because anything shorter is an assessment wearing an operator’s title.
You leave with The seat covered, decisions made on the record, and a specification for the permanent hire that reflects what the job turned out to be.
-
Board advisory
Six-month minimumWho prepares a board for the questions it has not thought to ask?
Standing counsel to a board or audit committee. Papers read before they land, the chair briefed before the meeting, and the AI items on the agenda given the same rigour as the financial ones. Six months is the floor because boards run on quarterly cycles — fewer than two of them and you have observed a company rather than advised one.
You leave with Papers read before they land, and AI items minuted to the standard the financial ones already meet.
No prices here on purpose. The shape of the work varies enough that a number without a conversation would be a guess, and the four steps below set out what happens before anyone quotes anything. Tell me the situation and I will tell you what it takes.
How we work
Four steps. The first one takes twenty minutes.
Most governance engagements start with a proposal and end with a binder nobody opens. This one starts with a number you can argue with, and the gap between that number and the one your obligations require is the whole of the work.
- 01 Twenty minutes
The call
You tell me what you are running and what is worrying you. I tell you whether I am the right person, which some weeks I am not. Nobody presents anything. If the answer is that you need a data engineer rather than a governance advisor, you will get that answer on the call rather than three invoices later.
- 02 Half a day
The readiness score
Thirteen rows, taken from the crosswalk: the AI-literacy prerequisite under Article 4, plus the twelve cells where the four layers meet the three cross-cutting columns. Each row scored against evidence you can put on the table today, not against what the policy says you do. The output is a number and a map of which rows produced it.
- 03 One page
The delta becomes the scope
Say you score 31, and the obligations that actually attach to your systems need you at 70. That gap of 39 points is the statement of work. Named rows, named owners, sequenced by which one fails first under scrutiny. You can hand that page to a CFO and it survives the meeting, which is the only test that matters.
- 04 Weeks to months
Delivery
We work the rows. Fortnightly cadence, evidence accumulating as a by-product of the work rather than as a fire drill before an audit, and a board-ready position at every quarter boundary. I stay until it holds without me, then I leave.
The score
Where the number comes from.
I verified the crosswalk against primary sources in July 2026: every cell of the columns grid mapped to the EU AI Act articles that actually apply, with the NIST AI RMF subcategories and ISO/IEC 42001 Annex A controls alongside them, and the confidence level stated per framework. Thirteen rows. That published work is what the score is scored against, which means you can check my arithmetic before you pay me anything.
Scoring a room on a number is an old consulting trick and it is usually a fiction. This one is auditable, and that is the entire difference. A readiness figure that cannot survive your own counsel asking how it was derived is worse than no figure at all, because it travels into board minutes and stays there.
Asked often enough to answer here.
Is the score a compliance certification?
No, and be wary of anyone who says theirs is. Conformity assessment under the EU AI Act runs through a notified body or an internal-control route defined in Article 43. What the score does is tell you where you stand before that process starts, and what it will cost you to be ready for it. Those are different jobs.
How quickly can you start?
I take on a small number of engagements at a time, which is the only honest way to do this work. The call happens within a week. Whether the work starts in two weeks or eight depends on what is already running.
What do you need from us upfront?
For the score, nothing prepared. I would rather see what exists than what you assembled for me. An hour each with whoever owns the systems, the data and the vendor relationships covers most of it.
We have no AI in production yet. Too early?
That is the cheapest point at which to do this. Governance debt behaves like technical debt. It does not go away and it gets more expensive, and retrofitting oversight onto a system already in front of customers costs several times what building it in cost.
Do you work outside the EU?
Yes. Most of my operating career was in the United States. The crosswalk carries NIST AI RMF and ISO/IEC 42001 alongside the EU articles precisely because the obligation you are working to depends on where you sell, not where you sit.
Start here
Twenty minutes, and you will know whether I am useful to you.
No deck, no discovery questionnaire, nothing to prepare. Tell me what you are running and what is keeping the audit committee awake. I read every message and reply within a few days. Fill this in and it opens a ready-written email in your own mail client — you send it, so my reply lands in your normal thread. If you are asking about the Practitioner Toolkit rather than an engagement, say so below.
Your email app should be opening.
The message is written and addressed — press send in your mail client and it reaches me. Nothing has left this page on its own. If nothing opened, email fredrik@fredriklindstrom.info directly. In the meantime the Column Test takes a minute, and the framework is the thinking behind all of it.
Prefer email? fredrik@fredriklindstrom.info
Elsewhere
/in/fredriklindstrom
Best for ongoing conversation.
YouTube
@Promise-and-Risk-AI
New episodes every Tuesday.
Bluesky
@fredriklindstromai.bsky.social
Shorter form, real-time.
Advisory and board engagements are taken on a selective basis — typically no more than a handful of organisations at any time, so each gets the attention the role requires. If your timing is tight, say so and I will respond accordingly.