Regulatory compliance delivered to legally binding dates — FDA and CE approvals, TUV assessments, norming frameworks, validated systems, data protection at global scale. Led by someone who treats compliance as daily practice, not paperwork — and as a task to solve together, not a verdict to hide from.
"The audit is announced. The regulation changes on a date that will not move. The assessor from the notified body is booked. Our teams build excellent products — but proving it to an authority that can reject us is another discipline entirely. And it is now on the critical path."
If that sounds familiar, you are in the right place. I have led compliance-driven programmes in medical technology, diagnostics, banking, media and rail technology — as programme owner and as Chief Compliance Officer — and I know the difference between being compliant on paper and being compliant in the audit. One is written in documents. The other is proven in traceable, validated, auditable reality.
Being compliant with an in-house process model is one thing — inconvenient at worst, negotiable at best. Being compliant with an external authority is a different game entirely: TÜV, FDA, CE, UL, notified bodies and national regulators do not negotiate, do not care why the schedule slipped, and can stop your business. That is the game I work in — where the requirement is binding, the assessment is adversarial by design, and "almost" means "not approved".
I lead regulatory programmes from the client side — independent of any vendor, consultancy or delivery firm, with the mandate to challenge them all. Engineering firms build compliant systems; I make sure what is built is what the regulator, and your business, actually require.
Too many compliance functions end their work at the finding: "that is not permitted," full stop — leaving the business alone with the problem. My view is different: identifying a gap is the beginning of the work, not the end of it. I always deliver findings together with implementable options — what alternative fulfils the requirement, what it costs, what it changes.
And this is not a matter of taste — the frameworks themselves expect it: GDPR Article 39 expressly obliges the data protection officer to inform and advise. ISO/IEC 27001 builds assessment and treatment into one continuous improvement cycle — findings without treatment plans simply close no loop. And banking compliance regulation assigns the compliance function an advising role towards management, not merely a policing one. What all of them do forbid is approving your own solution — segregation of duties, rightly so. Advise, yes. Decide, no. Propose, always.
"The project I hired Eric for succeeded because it respected both sides of its own name: a tool that life-insurance sales people would actually use, and a technical platform that could flex to each country's regulatory reality. Eric held both in one head — he could argue the salesperson's workflow in the morning and the modular architecture in the afternoon, and be the most demanding person in the room for both. That combination is rarer than this industry admits."
— Markus Ritter, former Head of IT Individual Life Switzerland, Zurich Financial Services
Compliance requirements are design drivers from day one — traceability, audit trails, validated interfaces and data protection are planned into the architecture, not documented around it afterwards. That is the difference between passing the audit and re-running the programme.
Programme leadership under the frameworks that govern medical software and diagnostics: IEC 62304 (software lifecycle), IEC 82304-1 (health software), IEC 81001-5-1 (health software safety), ISO 13485 (quality management) — through the full lifecycle: URS, design specifications, IQ/OQ/PQ qualification, traceability matrices, and the audit trails that make it all provable.
AI systems are entering exactly the domains where regulators watch hardest — and I work at that intersection daily: directing the business-process design for AI-based diagnostic support in medical imaging, from development to delivery into clinics, hospitals and laboratories. AI systems that influence medical decisions carry heavy regulatory expectations — lifecycle discipline, traceability, validated quality — and my medical-device compliance background (IEC 62304, EU MDR) is what keeps AI innovation from stalling in its own approval process.
Programme leadership under the European railtech norming framework: CENELEC EN 50126 (RAMS lifecycle), EN 50128 (software for control and protection systems) and EN 50129 (safety-related electronic signalling), combined with the EC Technical Specifications for Interoperability that govern cross-border rail operation — safety cases, hazard logs and independent assessment orchestrated into one programme that reaches the approval date.
Ensuring FDA and CE approvals for software-supported products: coordinating business, IT, legal, risk and QA stakeholders into one dossier-ready programme — with the daily executive reporting that keeps the submission date real.
ISMS leadership for certification and beyond: risk identification and minimisation, security governance, and the organisational embedding that survives after the certificate hangs on the wall. Controls selected, implemented and evidenced per ISO/IEC 27002 — the substance behind the 27001 certificate, not just the paper of it. Held executive IT-security ownership — with the reporting duties that go with it.
Global consent management implemented across 150+ web domains and legal entities in 20+ countries: vendor negotiation, multi-team coordination, technical integration, and compliance under both EU GDPR and the revised Swiss Federal Act on Data Protection — delivered in parallel with business as usual.
Validation strategy for IT systems, inspection leadership, and assessment of running programmes against regulatory reality: what will survive an inspector's question and what quietly will not — fixed before it is found, not after.
Not read about — delivered under.
I have held compliance ownership myself — CCO and Head of IT Security, with the accountability, the reporting duty and the regulator's phone number in my hand. I do not advise you what compliance costs; I tell you what it requires, because I have signed for it. Currently Chief Compliance Officer of Digital Advisory Group, a Swiss software-delivery firm for regulated industries — so the seat is not historical.
Audit trails, traceability matrices, validated interfaces, electronic records — these live in systems and code. As a former developer and system architect, I can verify that the compliance construct and the technical reality are the same thing. Auditors notice the difference immediately.
In most of my programmes, compliance was one dimension among many — a merger with a fixed legal date, a data centre under regulatory requirements, a global rollout with country-specific law. Compliance work that ignores the surrounding transformation fails it; I lead both together.
First conversation is free — you will know quickly whether I can help, and I will tell you honestly if a specialist serves you better.
Book a Consultation