AI governance for a Berlin deep-tech manufacturer

This is a client engagement, not an employed role, and it is the only case study on this site that is. The client is anonymised at their discretion. The shape of the work is accurate; the identifying details are not here.

Why this one is here despite being the shortest

Every other case study on this site describes something I did as an employee, with a permanent mandate, a full-time week, and years of tenure. A sceptical buyer should discount those accordingly, and the honest response to “you have never done this as a consultant” is not an argument, it is a different engagement.

This is that engagement. It is ongoing, so the results section is thinner than I would like. I would rather publish it thin and current than wait until it is comfortable.

The situation

A deep-tech manufacturer in Berlin, engineering-led, with real technical depth in its own domain and the AI question arriving from outside it. Teams had started using large language models in their work faster than anyone had decided what the rules were. That is the normal 2026 situation and it is not a failure of governance so much as governance not having been asked for yet.

The specific risk in a company like this is not the obvious one. It is that engineering organisations are good at building things and the AI tooling arrives already built, so it spreads through informal adoption rather than procurement. By the time anyone asks what is in use, the answer is distributed across teams and nobody has the full list.

The constraint

Two days a week from an outsider, against an engineering culture that has earned the right to be sceptical of governance. Any framework that reads as an approval queue would be routed around within a month, correctly, because approval queues are how engineering organisations get slower without getting safer.

What I did

Inventory before policy. What is actually in use, by whom, touching what data. This is the unglamorous first move and it is where every surprise lives. You cannot govern a list you do not have.

Article 28 posture and the processing agreements that go with a European company putting data through third-party model providers. This is the part that becomes a due diligence question later, and it is much cheaper to answer before it is asked.

Risk tiering against the EU AI Act categories, so the compliance effort lands on the handful of systems that genuinely warrant it rather than being spread evenly across everything and therefore resented everywhere.

Controls where the work happens. The design principle throughout: governance that runs in the pipeline and in the tooling, not as a review gate a person has to pass through. An engineer should be able to do the right thing without asking permission, and the wrong thing should be the one that requires a conversation.

Enablement alongside it. The rules only hold if people understand why they exist. This is the same lesson as the Data Academy, applied at a tenth of the scale and much faster.

The result

The engagement is ongoing and I will publish outcomes when there are outcomes worth publishing, with a measurement basis attached like everything else on this site.

What I can say now: the inventory found more in production use than anyone in the building expected, which is the normal finding and the reason the inventory comes first.

What this proves and what it does not

It proves I can deliver this shape of work from outside, on a part-time mandate, without the authority that came with every other engagement on this site.

It does not yet prove a twelve-month outcome, because it has not been twelve months. Anyone evaluating me for an interim mandate should weigh this accordingly, and I would rather say that here than have you work it out on the call.