Services · Advisory & Strategy
AI Governance & Compliance Advisory
Professional AI consulting for organisations that operate under regulatory constraint. Regulatory analysis of the system you have — or the one you are about to buy — carried through to the architecture that has to satisfy it.
Dynamics Consulting is an independent AI consulting and engineering practice working on sovereign AI infrastructure, AI governance and regulated environments. Advisory and implementation come from the same practice: whoever writes the requirement is able to build the system that meets it.
Who this is for
Organisations introducing artificial intelligence where an output has consequences: hospitals and pharmaceutical distribution, banks, asset managers and insurers, energy, engineering practices working to technical norms, logistics and manufacturing. Typically the request comes from a CTO or CIO who has to answer for the architecture, from a compliance or risk function that has to answer for the obligation, or from a board that has discovered the two answers do not match.
It applies equally to a system bought from a supplier and to one built internally. The obligations of a deployer do not depend on who wrote the code.
The problems it addresses
An AI system enters production and nobody can say which regulatory regimes reach it, in which role, or with which deadlines already passed.
A policy exists, and the architecture does something else. The document says outputs are traceable; the system keeps no record of which document revision produced an answer.
Several regimes apply at once and are being handled as separate programmes, so the same control is built twice and the gap between them is where the omissions sit.
Liability is assumed to sit with the supplier, and the contract does not say so. The revised European product liability directive includes software among products, for products placed on the market or put into service from 9 December 2026 — which changes what a limitation clause is worth.
The work
What Dynamics Consulting actually does
Regulatory positioning of the system
Which regimes actually reach the system you have or intend to buy, in which role — provider, deployer, distributor — and which obligations follow from that role rather than from the vendor’s marketing classification.
Architecture review against the obligations
Retrieval boundaries, data residency, identity and access segregation, logging depth, retention, model supply chain, human approval points. Each obligation is traced to the component that carries it, or recorded as not carried by anything.
Crossing analysis
Where two regimes demand the same control — access management, audit logging, change management, incident response — the control is stated once and documented against each regime, rather than built twice. This is what CEPF is for.
Governance design
Who decides, who approves, who is told and within what time. Roles, escalation paths and reporting duties written as procedures an organisation can actually run, not as a policy document nobody opens.
Remediation sequence
What must be done, in what order, with what urgency, distinguishing what is already overdue from what has a future date — and what it costs in effort, by role.
Implementation
When the conclusion is that the architecture has to change, the same practice designs and builds it: retrieval, identity, audit and approval gates as engineering work, on your infrastructure or on Nexus MDS Core.
What you receive
Documents, not presentations. Every statement is classified: what is verified against the evidence provided, what is inferred, and what requires a finding beyond the agreed scope. The deliverable is signed, and whoever signs it answers professionally for what it says.
- Regulatory exposure report. Which regimes apply, in which role, with which obligations already due and which still ahead.
- Architecture accountability map. Each obligation traced to the component that carries it, or recorded as uncovered.
- Crossing register. Shared controls across regimes, stated once and documented against each.
- Governance model. Decision, approval, escalation and reporting paths, with named roles.
- Remediation plan. Sequenced actions with effort by role, separating overdue from scheduled.
Coverage
Regimes and frameworks in scope
The regimes below are the ones the methodology covers as operational obligations rather than as principles. Where an obligation belongs to a function outside this scope — network security, business continuity, data protection as a legal matter — the analysis flags the crossing point and names what to hand over, without pretending to assess it.
- EU AI Act — Regulation (EU) 2024/1689 — classification, deployer obligations, transparency, AI literacy
- GDPR — Regulation (EU) 2016/679 — lawful basis, data minimisation at ingestion, data subject rights
- PLD 2024 — Product liability directive — software among products, for products placed on the market from 9 December 2026
- NIS2 — Directive (EU) 2022/2555 — network and information security obligations
- DORA — Regulation (EU) 2022/2554 — operational resilience for financial entities
- Cyber Resilience Act — Regulation (EU) 2024/2847 — including the Article 14 reporting duty
- ISO/IEC 27001:2022 — Information security management system controls
- ISO 56001:2024 — Innovation management system
The position
Compliance is not documentation added at the end
A system that cannot show which document revision produced an answer does not become traceable because a policy says it is. Governance, traceability, data boundaries, access control, auditability and human approval are architectural constraints: they are decided when the system is designed, and retrofitting them costs more than building them.
That is the reason the advisory and the engineering sit in the same practice. The analysis stops being an opinion at the point where someone has to change a retrieval pipeline, and that is where most compliance work is abandoned.
- Traceability. Answers cite the source document and its revision, so what a system said can be reconstructed months later.
- Data boundaries. What is indexed, what is excluded at ingestion, and where each stage physically runs.
- Access control. Identity, role segregation and least privilege between the functions that must stay separated.
- Auditability. A tamper-evident record of calls, retrievals and decisions, retained for as long as the obligation lasts.
- Human approval. Explicit gates where an output has consequences, with the approver recorded.
Instruments
What the work runs on
CEPF — the methodology
The Compliance-Epistemic Project Framework is a regulatory crossing catalogue: regimes broken down into the deliverables they require, the roles that produce them, the effort each carries, and the points where two regimes demand the same control. Version 7, snapshot July 2026 — 19 frameworks, 247 requirements, 24 cross-framework overlap groups, 695 document templates.
CEPF in detail →Calibra — the software
Calibra implements CEPF. Beyond the regulatory catalogue it carries risk, scheduling, operational flow, Gantt and milestones, which is what turns a remediation plan into a programme with dates and owners. A reduced demo runs on the CEPF page.
What Calibra is →Nexus MDS Core — the platform
Sixteen orchestrated services for regulated environments: local indexing, retrieval and audit, Zero-Trust identity, workflow engine, replaceable external generation. It is the implementation route when the analysis concludes that the architecture itself has to change — not a precondition for the advice.
Nexus MDS Core →Engagement models
How an engagement starts
Exposure assessment. The productised entry point, and one engagement within this service rather than the service itself: three days of work on contracts, architecture and supply chain, EUR 4,500 plus VAT, delivered within fifteen working days as a signed document. If an implementation or ongoing advisory engagement opens within ninety days of delivery, the fee is credited in full. Scope and terms.
Continuing advisory. Governance design and architectural review over the life of a programme, including the fractional AI CTO arrangement where the organisation needs the decision to be made inside, not recommended from outside.
Implementation. Design and delivery of the systems the analysis calls for — retrieval, identity, audit, approval gates — on your infrastructure or on Nexus MDS Core. The engineering underneath is listed under technical capabilities.
How this differs from legal and compliance consulting
A legal opinion tells you what the regulation says. It does not open the retrieval pipeline to check whether the answer your system produced can still be reconstructed in eighteen months. This work does, and reports which component carries each obligation.
What is not delivered is a certificate of conformity — and no consultant can deliver one. Conformity is established by the assessment procedure the regulation prescribes, not by an opinion and not by a deployment topology. A signed document stating what you have and what you are missing is worth something in an inspection; a self-declaration of compliance is not.
Legal representation, contractual negotiation and regulatory filings stay with your lawyers. The deliverable is written to be read by a board and used by counsel.
Evidence
Production experience, not a practice area
Federfarma Lombarda. A regulatory assistant for over a thousand pharmacies across the provinces of Milan, Lodi and Monza Brianza, around two thousand queries a day. Explicit document version chains, so answers cite what is in force rather than what is merely relevant; personal data excluded at ingestion; a tamper-evident audit log. Read the case study.
HumanIA Care. An AI companion architecture for elderly patients, built for privacy-first deployment in regulated care environments. Read the case study.
IATP. AI-assisted reverse engineering of a legacy platform, where the governing question was what the existing system actually does before anything is rewritten. Read the case study.
Engagements are led directly by Corrado Patierno — twenty-five years of enterprise systems architecture in regulated and business-critical environments, Innovation Manager certified by the Italian Ministry of Enterprise, board member of ENTD from 2020 to 2025. Background.
FAQ
Frequently asked questions
- Is this legal advice?
- No. The work is technical and organisational: what the regulation requires of your systems and your processes, what your architecture does today, and where the two diverge. Legal opinions, contractual representation and regulatory filings stay with your lawyers — the deliverable is written to be handed to them.
- Do you certify compliance?
- Nobody can. Conformity is established by the assessment procedure the regulation itself prescribes, not by a consultant and not by a deployment topology. What you receive is a signed document stating what you have, what you are missing and in what order to close the gap — the kind of evidence that is worth something in an inspection. A self-declaration of compliance is not.
- Where does an engagement usually start?
- With the exposure assessment: three days of work on your contracts, architecture and supply chain, producing a signed document. It is a fixed-scope engagement, not the whole practice. If the picture is already clear, an engagement can start directly at design or implementation level.
- Do we have to adopt Nexus MDS Core?
- No. Most advisory work is carried out on systems built by other suppliers, and stays there. Nexus MDS Core is the option when the conclusion of the analysis is that the architecture itself has to change — it is a platform we build and run, not a precondition for the advice.
- What is CEPF, and what is Calibra?
- CEPF — the Compliance-Epistemic Project Framework — is the methodology: a catalogue mapping regulatory regimes onto the operational obligations each one produces, and onto their overlaps. Calibra is the software built on CEPF, adding risk, scheduling, operational flow, Gantt and milestones. Both are proprietary to Dynamics Consulting and both are used inside engagements.
- Which sectors do you work in?
- Healthcare and pharmaceutical distribution, finance and insurance, energy, engineering, logistics and manufacturing — organisations where an AI output can produce a regulatory or liability consequence. Production references are in the case studies.
Where does your supplier’s liability stop, and yours begin?
The exposure assessment establishes, for your organisation, where the boundary sits — and it is where most governance engagements start.
Exposure assessment →