The distance between a demo and a Monday morning.

In the demo In production

Runs on ten hand-picked examples Runs on your real, messy data

Nobody asked legal AI Act, GDPR and your DPO signed off before launch

A licence nobody opens after week two Usage you can measure, by team and by role

Depends on the consultant who built it Your team runs it, fixes it and builds the next one

What I do

AI strategy and use-case triage

Find where AI pays for itself in your operations, and where it does not. You get a ranked list of use cases with cost, risk and data readiness for each one.

Build: agents, RAG and automation

From prototype to production: document generation, knowledge assistants that cite their sources, monitoring pipelines and workflow automation, built on your stack.

AI governance and compliance

An inventory of your AI systems, risk classification under the AI Act and a control matrix mapped to GDPR, ISO/IEC 42001 and ISO/IEC 27001, with evidence and an owner for every control.

Enablement and adoption

Hands-on training in which your people build their own agents, AI tool selection with vendor due diligence, and adoption measured from real usage data.

Training your teams can use the next day

From AI literacy for every employee to deep dives on each regulation in the governance matrix. Practical, and built around your sector and your own use cases.

AI literacy for the whole organisation

What AI can and cannot do, safe everyday use, protecting data, and when a person has to check and decide. Tailored by role, from the front line to the board.

All staffLeadershipAI Act

The EU AI Act in practice

Roles and responsibilities, risk classes, prohibited practices, transparency duties and what each team has to document, including harmonised standards such as EN 18286.

AI ActEN 18286ISO/IEC 42001

Cybersecurity and operational resilience

What NIS2, DORA and the Cyber Resilience Act require from management and teams: governance, incident reporting, third-party risk and secure products.

NIS2DORACyber Resilience Act

Data protection and data sharing

GDPR applied to AI projects, data protection impact assessments, and the new rules on access to and sharing of data under the Data Act.

GDPRData Act

Management systems and audits

How to build and evidence an AI, information-security and privacy management system that holds up in an audit.

ISO/IEC 42001ISO/IEC 27001ISO/IEC 27701

Building with AI

Hands-on workshops in which teams build their own agents and automations on the tools they already pay for.

AgentsAutomation

Formats: workshops, multi-session programmes and video modules presented by an AI avatar for large teams. Every programme comes with attendance records and materials you keep for your own compliance file. In English or Portuguese.

Get the AI governance risk matrix, free

The same Excel matrix used in this work: obligations from the AI Act, GDPR, NIS2, DORA, the Data Act, the Cyber Resilience Act and ISO/IEC 27001, 42001 and 27701, mapped to controls, evidence and owners. Leave your email and receive the latest version.

Ready to use in Excel
Updated as the rules change
Free of charge

How an engagement runs

Diagnose

An inventory of processes, data and risk, with no build cost. We decide together what is worth doing.
Pilot with a kill switch

One real use case, real users and success criteria agreed in advance, with a formal point at which we stop if it does not work.
Production

Access control, logging, human review where it matters and the governance file an auditor would ask for.
Handover

Your team learns to run it, extend it and build the next one without me.

Built, shipped and in progress

Client and employer names are left out on purpose. Open any project to see what it does, the impact it has and who it is for.

Side-by-side evaluation of two enterprise AI platformsDelivered

A parallel pilot with around 90 users: a survey, analytics on roughly 7,800 logged interactions, a feature-by-feature functional test and a recommendation the board could act on.

Impact: A platform decision backed by real usage data instead of vendor demos, and a licence budget aimed at the tool people actually use.
Who it is for: Any organisation choosing between AI platforms or deciding whether to renew licences.

Document-generation agentIn use

Assembles first drafts from 153 pre-written blocks across 15 document types, so professionals start from a reviewed structure instead of a blank page.

Impact: Faster first drafts built only from approved wording, so senior time goes into review and judgement rather than typing.
Who it is for: Teams that produce recurring documents: legal, HR, procurement, insurance and consulting.

Internal AI platform with single sign-onIn use

A multi-tenant platform where internal AI tools plug in, with Azure AD sign-on and a dual pipeline in which one model extracts the data and a second one validates it.

Impact: One secure home for every internal AI tool: a single login, a single access policy, and new tools launched without new infrastructure.
Who it is for: Organisations running several AI initiatives with no common place for them.

On-device transcription with speaker separationIn use

A desktop app that transcribes long recordings word for word and separates the speakers without the audio ever leaving the computer, then exports to Word, SRT or plain text.

Impact: Hours of manual transcription become a review task, and confidential recordings never touch a cloud service.
Who it is for: Anyone working with sensitive recordings: legal teams, HR investigations, research and healthcare.

Regulatory monitoring pipelineIn use

Collects updates from about 56 regulatory sources through feeds and page monitors into one database, so teams review what changed instead of searching for it.

Impact: Regulatory changes surface automatically in one place, so nothing relevant is missed and nobody spends the morning checking websites.
Who it is for: Compliance, legal and public-affairs teams in regulated sectors.

Regulatory reporting platform for supervised financial entitiesIn progress

Prepares, validates and files mandatory anti-money-laundering reports, with three layers of validation against the official schemas and a seven-year archive sealed with SHA-256.

Impact: Mandatory reports filed with fewer errors, and a tamper-evident audit trail ready whenever the supervisor asks.
Who it is for: Investment funds, management companies and other entities under financial supervision.

Expert knowledge captureIn progress

A voice interview agent captures the unwritten judgement of a senior expert. Answers come from hybrid retrieval over a knowledge graph, always cite their source and flag gaps instead of inventing.

Impact: Senior expertise stays in the organisation when people retire or move on, and juniors get answers they can verify.
Who it is for: Organisations that depend on a few experienced people: professional services, engineering and industry.

AI governance risk matrixOpen source

Maps the AI Act as amended, GDPR, ISO/IEC 27001, 42001 and 27701, NIS2, DORA, the Data Act and the Cyber Resilience Act to controls, evidence and owners. A multi-agent flow keeps it current, with human approval at every gate.

Impact: One view of every AI and digital-regulation obligation, with the evidence that proves compliance and the person who owns it.
Who it is for: Compliance officers, DPOs, CISOs and risk teams preparing for audits under the AI Act, NIS2 or DORA.

Compliance automationIn use

Mailbox triage for know-your-customer requests, plus risk reports with traffic-light dashboards for enhanced due diligence and sanctions checks against OFAC, EU and UN lists.

Impact: Onboarding requests sorted automatically, and high-risk cases escalated with a clear, documented risk picture.
Who it is for: Banks, funds, real-estate, legal and accounting firms with anti-money-laundering duties.

Decision support from two decades of case filesDesigned

A proposal to turn about twenty years of complete files into outcome statistics and strategy calibration, starting with a zero-cost inventory and formal kill switches at every stage.

Impact: Strategy calibrated on the organisation’s own track record, with a cost-free first phase and a clear point to stop.
Who it is for: Organisations sitting on years of case or project files they have never analysed.

Seen something your team needs?

Send a message on WhatsApp. One short conversation is enough to tell whether it is worth a diagnosis.

Message me on WhatsApp

Behind the work

A lawyer by training who moved into compliance, and then into building AI.

Hands-on work in anti-money-laundering, KYC, sanctions screening and vendor due diligence inside a regulated firm means governance goes into the design from day one, not into a slide at the end. The same person who reads the regulation writes the code and trains the team.

Education: Master’s in Law and Management, University of Lisbon School of Law (FDUL) and ISEG. Law degree, OAB-registered (Brazil).
Compliance certifications: International Compliance Association (ICA): Certificate in Compliance, Certificate in Anti-Money Laundering, Certificate in Customer Due Diligence (KYC) and Specialist Certificate in Financial Crime Risk in Cryptocurrencies.
AI certifications: Rumos Expert AI Engineer (CRE: AI Expert), in progress. EU AI Act training.
Domains: AI governance, data protection, cybersecurity regulation, anti-money-laundering, KYC and sanctions, vendor due diligence
Languages: Portuguese and English

Where do you want to start?

Pick what your team needs most right now and send me a message on WhatsApp. If email suits you better, that works too.

AI literacy for your teamFrom the front line to the board Training on the AI Act, NIS2, DORA and GDPRWorkshops and programmes with attendance records Automations and AI agentsFor the tasks that eat up your team’s week A diagnosis of where AI pays offProcesses, data and risk, with no build cost

contacto@iaconsulting.me