Governance programs for organizations deploying AI.
Readiness assessments, risk and compliance frameworks aligned to NIST AI RMF and ISO/IEC 42001, and evaluation methods with measurable outcomes.
Principal: Joël McClurg. Former state compliance officer for a $1B+ regulated program across 64 jurisdictions; AI residency at a fintech serving 5M+ households.
MIT Sloan Executive Education, Artificial Intelligence: Implications for Business Strategy (April 2025) · IBM, AI for Everyone (via edX).
Available for long- and short-term engagements.
Capabilities
AI governance program design, risk and compliance frameworks, evaluation and benchmarking, and adoption strategy for organizations deploying AI in regulated or high-stakes environments.
AI Governance Program Design
- Model inventory, risk classification, and review-board design for organizations deploying AI
- Governance frameworks aligned to NIST AI RMF and ISO/IEC 42001
- Program operations background: quality control and corrective-action systems for a $1B+ regulated program across 64 jurisdictions
- Federal-regulator liaison experience, applied to audit-readiness and control documentation
AI Risk & Compliance Frameworks
- Risk and compliance frameworks scoped to an organization's actual deployment surface
- EU AI Act readiness assessments: obligation mapping, risk-tier classification, gap analysis against the framework's requirements
- Policy development and regulatory-strategy background: legislative drafting, coalition navigation, agency relationships
- Standards engagement and documentation built to survive external audit
Evaluation & Benchmarking Design
- Evaluation design for deployed AI systems: benchmark construction, golden-set methodology, error analysis
- Accuracy and reliability metrics tied to what the system is claimed to do
- Root-cause analysis when a system's outputs do not match its claims
- Translating evaluation results into decisions leadership can act on
AI Adoption Roadmaps
- Adoption roadmaps with named owners, sequencing, and success criteria
- AI residency experience: designed and shipped production AI tools and their evaluation frameworks at a fintech serving 5M+ households
- Assessment of where AI fits an organization's existing workflow and where it does not, done before procurement
- Technology evaluation and procurement support grounded in what the organization can actually operate
Framework readiness assessments
A fixed-scope engagement against a named framework: EU AI Act, NIST AI RMF, or ISO/IEC 42001. Two to four weeks, delivered as a written report.
- Obligation mapping against the framework's requirements
- Risk-tier classification of the organization's deployed and planned systems
- Current-state gap analysis
- Prioritized remediation plan with named owners
The output is a written gap analysis and roadmap. It is not a compliance certification; the three frameworks differ in whether third-party certification exists at all. These are offered services. Ex Machina Solutions has not delivered a prior EU AI Act engagement.
Selected work
Public examples. Client engagements are typically not published.
SNAP Payment Error Rates, FY2025
A state-by-state analysis of USDA's FY2025 payment error rates and the new cost-share penalty, showing what the error rate measures: administrative capacity and program access, not fraud.
H.R.1 SNAP Impact Estimator
A local impact estimator: households losing food assistance, benefit dollars leaving the local economy, and jobs at risk, measured against a fixed October 2025 pre-implementation baseline.
SNAP State Form Audit
An open catalogue of every application, recertification, change-reporting, and verification form published to SNAP applicants and recipients.
SNAP Restriction Waivers Tracker
A state-by-state map of all 23 approved purchase-restriction waivers, the five suspended by a June 2026 federal ruling, and pending requests, sourced to USDA approval letters.
Engagements
Ex Machina Solutions takes on long- and short-term engagements: diagnostics and assessments, embedded sprint-team roles, contributing-expert work, and standing advisory arrangements. A typical diagnostic starts with a conversation about something that isn't landing right and ends with a written analysis leadership can act on, with implementation support scoped case by case. Framework readiness assessments are scoped differently, as a fixed two-to-four-week engagement with a defined deliverable.
If your organization is facing something in these areas, the fastest way to find out whether this is a fit is a short conversation.