EU AI Act Experts in Frankfurt

2nd LoD/Change the Bank (CtB)

• CtB: External consultant and workstream lead for rectifying findings by BaFin following a special IT audit in the 2nd LoD, management of the work package for revising the ICT Risk Management & ICT Asset Classification in accordance with DORA Chapter 2, the processes for structural analysis, protection requirements, and control assessments (4 FTEs).

• Presentation introducing generic A.I. and Large Language Models
• Explanation of legal frameworks (EU AI Act, US CLOUD Act, DSGVO)
• Systematic review of AI tools along the SDLC and holistic systems
• Comparison of on-prem LLMs vs. cloud-based solutions, as well as change management and works council considerations
• Moderation of the discussion and definition of next steps for introducing AI development tools

• In my current position, I have end-to-end responsibility for AI products: from identifying and prioritizing use cases, developing sound business cases, AI roadmaps, and capacity and resource allocation, through to scalable implementation across countries and business areas.

• I design operating models, delivery standards, and operational concepts that ensure AI product development runs reliably and scales sustainably – always aligned with strategy, goals, capacities, and business value.

• Leading and developing interdisciplinary teams of data science and product professionals in an agile working model is a core part of my role – I currently lead a team of three employees.

• I am confident in stakeholder management at senior management level and in international structures, and translate complex technical topics into clear, business-oriented recommendations for action.

• I consider governance from the outset: I consistently align AI initiatives with regulatory requirements (including the EU AI Act), risk management, and data protection requirements.

• Delivery of ICT / DORA management training under DORA Article 5(4) at various banking institutions

• Teaching the key content of DORA requirements with a focus on ICT risks, third-party risk management, incident and problem management, and the information register

• Deriving implementation measures and recommendations for management and business units

• Head of the group-wide, international, and cross-functional IT Governance & IAM department within the central IT division of a large French-German private banking group. Disciplinary management of around 30 employees at five different locations within the group (Frankfurt, Paris, Tunis, Saarbrücken, Düsseldorf). Head of IT committees and key role in direct communication with management, the supervisory board, external stakeholders, and regulators.
• Definition and establishment of a state-of-the-art IT strategy process and related IT governance structures for the group's IT department with more than 600 employees (testified by the German Federal Financial Supervisory Authority and the ACPR) and successful process run.
• Establishment of a new future-oriented process framework for IT and necessary governance structures (process squads) for the continuous improvement of IT processes with regard to new regulatory requirements (including DORA, EU AI Act, etc.).
• Establishment of stringent processes to close a historical backlog of findings (> 100 IT findings, 40 overdue findings in 2022) from internal and external auditors (WP, ACPR, BaFin). Successful reduction of stock of overdue findings to 0 at the end of 2025.
• Supporting more than 20 IT audits per year and establishment of regulatory monitoring processes. Introduction of ServiceNow to revolutionize regulatory change and IT compliance processes with advanced AI functionalities.
• Realignment of IT control processes in conjunction with the newly established ICT risk function under DORA and the three lines of defense concept using the TopEase GRC solution.
• Reduction of the application landscape, by systematically analysing the purpose with application and business owners, identifying duplicates while implementing a One-Tool Strategy throughout the group. Successful reduction of one third of the application landscape within the CMDB.
• Onboarding of all group applications into One Identity's group-wide IAM solution, as well as operation and further development of the solution in connection with segregation of duties (SoD), role-based access management (RBAC), etc.

• Business consulting, interim management, and coaching
• Independent acquisition and delivery of consulting projects in the areas of strategy & innovation, processes, organization, and business transformation

• General CTO responsibilities (architectural design, operational setup, external runtime product evaluation, investor buy-in, regulatory compliance).
• Software development oversight (implementation on deep-dive-in) plus workflow design.
• Product co-ownership.
• Tech/tools/frameworks: proprietary software (Java, JavaScript), Kubernetes, Postgres, MiniIO, Ollama (internal), several xAI API (external), OpenTofu (Terraform), Keycloak, Kafka, Prometheus, ELK Stack, GitHub, GitHub Workflows, Argo CD, ISO 27001, BSI-ISM, EU AI Act.

• The replacement of the existing archive system (document management system – DMS) on a host-based platform is well advanced.

• The internal audit is meant to ensure the company's quality standards.

• GDPR

• ISO 27001 ff.

• BSI

• DORA

• Patient data regulations

• Host / Cloud / S3 / Container / highly scalable / Nuxeo

• Budget: 50,000

• Team: 1

• Led cross-functional compliance and IT programs spanning infrastructure, security, legal, and executive stakeholders, ensuring audit readiness and regulatory alignment.

• Acted as single point of ownership for IT governance and CSR programs, defining scope, milestones, risks, and success metrics.

• Partnered directly with VP of IT as a governance and control counterpart, supporting security incidents, compliance posture (ISO 27001, GDPR, SOC 2), and executive reporting.

• Supported organizational readiness for emerging EU regulations, including the EU Cyber Resilience Act (CRA) and EU AI Act, by analyzing regulatory requirements, identifying governance and compliance impacts, and aligning internal policies and control processes.

• Designed and scaled data collection and reporting processes for CSR and regulatory reporting across group and subsidiary level.

• Drove process improvements and standardization, increasing transparency, predictability, and audit readiness.

• Technologies and tools: Office 365 Power BI, MS SharePoint, MS Word, MS Excel, MS Teams, Zendesk, Confluence, JIRA, Vanta.

• Design and global rollout of sensitivity labels (confidentiality labels) for automated classification and encryption of business-critical data.
• Definition and rollout of Data Loss Prevention (DLP) policies to protect IP and personal data across endpoints, Exchange, SharePoint, Teams, and non-Microsoft clouds.
• Setup of Insider Risk Management policies to detect and contain excessive data leaks and risky user behavior.
• Implementation of GDPR and retention requirements through automated retention policies and structured records management.
• Technical support for legal teams in internal and external investigations using eDiscovery (Standard/Premium) and Content Search.
• Continuous improvement of the security and compliance level by reviewing the Microsoft Compliance Manager and closing gaps (regulations such as ISO 27001, NIS-2)