Services · Advisory & Strategy
Fractional AI CTO
A fractional AI CTO is a Chief Technology Officer engaged part-time, holding the same decision rights as a permanent one over architecture, technology selection and the AI programme. For organisations under regulatory constraint the mandate covers what an AI system is allowed to do, where its data goes, and what evidence it has to be able to produce afterwards.
Typically 2–4 days a month for strategic advisory, 8–12 where the mandate includes running the programme. Held personally by Corrado Patierno, with implementation available from the same practice rather than handed to a third party.
Who this is for
Mid-market and enterprise organisations that have reached the point where technology decisions carry regulatory and commercial consequence, but cannot yet justify — or cannot find — a permanent CTO of the required seniority. In practice: hospitals and healthcare groups, pharmaceutical distribution, banks, asset managers and insurers, energy, engineering practices working to technical norms, logistics and manufacturing.
The request usually arrives from a CEO or general manager with an AI initiative and nobody internal able to arbitrate it, from a CIO carrying more programme than the organisation has architectural capacity for, or from a board asked to approve a budget it has no way to evaluate.
The problem it solves
An organisation without architectural authority does not stop making architectural decisions. It makes them anyway — through vendor selection, through a proof of concept that quietly becomes production, through an integration nobody documented. The decisions still get taken; what is missing is anyone able to refuse the wrong one, and anyone answerable for the right one.
With AI the cost of that gap has changed shape. A badly chosen CRM is expensive. A badly governed AI system in a regulated environment is expensive and then has to be explained: what it was grounded on, what it answered on a given date, who approved the output, and whether personal data ever left the perimeter. Those questions are answerable only if the architecture was built to answer them — retrofitting an audit trail onto a system that was not designed to keep one is, in most cases, a rebuild.
A fractional mandate closes the gap without the fixed cost of a permanent executive: a full-time CTO at this level of seniority carries a six-figure salary plus benefits, onboarding and the risk of a mis-hire, against a commitment measured in days a month.
When you need one — and when you do not
The signals that a mandate is the right instrument: an AI initiative has been approved and nobody can specify it; a supplier proposal cannot be evaluated internally; several AI pilots are running and none has reached production; an audit, a customer security questionnaire or a tender has asked a question about the AI stack that the organisation cannot answer; a legacy platform has become the constraint on everything else; the technical function reports facts to the board but not decisions.
It is the wrong instrument when the need is execution capacity rather than judgement — more developers, a delivery partner, an implementation team — or when a competent internal CTO already holds the mandate and the gap is one specific technical answer. In that second case a fixed-scope exposure assessment or an advisory engagement on governance and compliance is the cheaper and more honest answer, and we will say so.
Fractional CTO, consultant, system integrator, interim CTO
A consultant analyses a question and delivers a recommendation. Accountability ends with the document, and the organisation still has to decide.
A system integrator builds what it has been told to build. It is the right partner for delivery and the wrong one for deciding what should be delivered: the party specifying the work should not be the party invoicing it.
An interim CTO occupies a vacant seat full-time until it is permanently filled. The arrangement is temporary by design.
A fractional CTO holds the decision rights permanently, at partial intensity, and is measured on what the architecture does in production — including two or three years later, when today's choices are either still standing or being paid for.
What the mandate covers
Six areas of responsibility, held together rather than split across suppliers — in an AI programme they are the same decision seen from different angles.
AI architecture
Retrieval, model selection, inference topology, data boundaries, integration with the systems of record. What runs where, what leaves the perimeter, and what an answer is made of.
AI governance
Classification of AI systems, the controls the architecture has to carry, audit and reconstructability requirements, human approval gates, and the record that makes them demonstrable.
Vendor assessment
Technical due diligence on AI suppliers and platforms: what the product actually does, where the data goes, what the contract makes them answerable for, and what the organisation is left holding.
Security and data protection posture
Identity and access separation, secrets handling, network boundaries, retention, and how GDPR obligations and sector security requirements map onto the platform rather than onto a policy document.
Deployment model
On-premise, hybrid or EU-hosted — decided against the threat model and the regulatory exposure, not against a preference. The taxonomy below is the one used across this practice.
Programme leadership
Roadmap, sequencing, budget defensibility, supplier coordination, and reporting a board can act on. Stopping initiatives that will not pay for themselves is part of the mandate.
Deployment models, named precisely
“Sovereign” is used loosely enough in the market to be worthless as a specification. One of the first things a mandate settles is which of these three the organisation actually needs, and what it trades away in each case.
- Fully local AI
- Indexing, retrieval, identity, audit and generation all execute on infrastructure the organisation controls. Highest sovereignty, highest hardware cost, model choice constrained to what can be self-hosted.
- Sovereign hybrid AI
- Data, retrieval, reconciliation, identity and audit stay local; only final answer generation runs on an external inference endpoint, under policy and replaceable without redesigning the system. This is the model in production at Federfarma Lombarda.
- EU private inference
- Inference on private or EU-resident infrastructure with explicitly defined residency, retention and access characteristics. Appropriate where the constraint is jurisdiction and processing terms rather than physical custody.
The reference implementation of the second model is documented in the Federfarma Lombarda case study, and the platform underneath it in Nexus MDS Core.
How the engagement runs
Phase 1 — technology assessment, two to three weeks. Existing infrastructure, systems in production, data flows, integrations, supplier arrangements and the gaps that matter. The output is a map of what is actually there, which in most organisations does not exist in one place.
Phase 2 — strategic plan and roadmap, four to six weeks. Priorities, sequencing, quarterly milestones, and the decisions that have to be taken before anything is built. Where AI is in scope, this is where classification and governance requirements enter the plan instead of being retrofitted to it.
Phase 3 — the standing mandate. An agreed monthly commitment — typically 2–4 days for advisory, 8–12 for operational engagements. Participation in board meetings, architectural decisions and supplier reviews, with monthly reporting to the CEO. The commitment is reviewed quarterly and is not designed to grow by default.
What you get in writing
- —A technology and AI landscape map: what is in production, what it depends on, and where the risk concentrates.
- —An architectural decision record — the choices taken, the alternatives rejected and the reasoning — so a successor can audit the reasoning and not only the result.
- —A prioritised roadmap with quarterly milestones and the budget envelope each one implies.
- —Vendor and supplier assessments: technical due diligence written to be read by a board, not by an engineer.
- —Governance requirements expressed as architecture — controls, audit surface, approval gates — rather than as policy text nobody can implement.
- —Monthly reporting to the CEO or board on progress, decisions taken and what changed.
The evidence behind the mandate
Twenty-five years in enterprise systems, on both sides of the supplier contract: senior consulting roles at Capgemini and Avanade, then a client-side mandate at Banca Mediolanum governing the external suppliers on a programme, including supplier performance and contract renewal. CTO of Nexo/Sefitalia, responsible for the software factory and for the ERP, workforce and field platforms of an 1,800-person network. Programme lead on Nespresso Intervallo at ATOS: three delivery streams, around forty people. The full background is on the About page.
On the AI side the record is current and in production: a regulatory assistant serving 1,000+ pharmacies with explicit document version chains, personal data excluded at ingestion and a tamper-evident audit log; AI-assisted reverse engineering of a legacy platform; and Nexus MDS Core, the self-hosted platform they run on.
The governance side is not improvised either: the Compliance-Epistemic Project Framework is the regulatory crossing catalogue this practice maintains, and the reasoning behind the architectures is published as research rather than asserted in a pitch. MISE-certified Innovation Manager; author of Logistica Fluida.
FAQ
Questions we are actually asked
What is a fractional AI CTO?
A Chief Technology Officer engaged part-time, holding the same decision rights as a permanent one over architecture, technology selection and the AI programme, for a defined number of days a month. The distinction from consulting is accountability: a fractional CTO signs the architectural decisions and lives with them, rather than delivering a recommendation and leaving.
When does an organisation need one rather than a consultant?
When the open questions are decisions rather than analyses. If nobody in the organisation can say whether a vendor's AI claim is credible, whether an architecture will survive an audit, or which of three AI initiatives should be stopped, the gap is authority, not information. A consultant produces a document; a fractional CTO makes the call and owns the consequences.
How much time does the mandate take?
Typically 2–4 days a month for strategic advisory, and 8–12 days a month where the mandate includes running an AI or modernisation programme. The commitment is reviewed quarterly against what the programme actually needs, in both directions.
How does an engagement start?
With a technology assessment of two to three weeks: existing infrastructure, systems in production, data flows, supplier arrangements and the gaps that matter. It is followed by a strategic plan and roadmap over four to six weeks, with quarterly milestones. From there the mandate runs on an agreed monthly commitment, with reporting to the CEO or board.
Is this the same as an interim CTO?
No. An interim CTO fills a vacant seat full-time until it is permanently filled, and the assignment ends when it is. A fractional mandate is designed to be permanent at partial intensity: the organisation gets continuity of architectural judgement without carrying a full-time executive it cannot yet justify.
Does the role cover AI regulation?
It covers the technical and organisational side of it: how a system is classified under the EU AI Act, what evidence an architecture has to be able to produce, where supplier liability stops under the 2024 Product Liability Directive, and how NIS2, DORA or ISO/IEC 27001:2022 controls land on the same platform. Legal opinions and regulatory filings stay with your lawyers; the mandate produces the technical record they work from.
Can the same person also build the system?
Yes, and that is deliberate here. Advisory and implementation come from one practice: whoever writes the architectural requirement is able to build the system that meets it, and is therefore unable to write a requirement that cannot be built.
Does a fractional CTO replace an existing IT team?
No. The internal team keeps operations and delivery; the mandate adds architectural direction, technology selection, supplier governance and the AI programme. Where there is no internal seniority at all, the first months are typically spent building it rather than substituting for it.