What does TaoQ AI specialise in?

Designing, building and securing AI systems for European tech companies, so they hold up in production and in an audit. The work covers the EU AI Act, ISO/IEC 42001 and NIST AI RMF.

Ziran is an open-source tool, maintained by Leone Perdigão, that tests AI agents for security flaws. It is used alongside NVIDIA Garak and Promptfoo.

Does TaoQ AI design and build AI systems, or only review them?

Both. Production AI architecture and hands-on delivery are a first-class engagement, with security, governance, and evaluation engineered in from the first commit. The sharper focus stays on security, governance, and evaluation, with EU AI Act conformity and ISO/IEC 42001-aligned management systems as the regulatory specialisms.

How do engagements work?

Four entry points: a threat model and security architecture review, an AI Risk Baseline before launch, an ongoing security and compliance partner after launch, and AI architecture and build. Details on the Engagement page.

Expertise

I design, build and secure AI systems. The work rests on production AI architecture and 15+ years in software engineering.

AI Security, Governance & Evaluation

The centre of my practice. Hands-on work on AI systems that need to hold up to a regulator, an auditor, a customer, or an attacker.

Agent Red-Teaming

Adversarial evaluation of AI agents in design and in production. Tool chain exploitation, multi-phase trust attacks, multi-agent coordination testing, prompt injection, data poisoning, exfiltration.

Practice tooling

Ziran (maintainer)

LLM-level coverage

NVIDIA GarakPromptfoo

Frameworks

OWASP LLM Top 10MITRE ATLAS

Security Architecture for AI

Threat modelling on the system being built. Data pipeline security, RAG and retrieval hardening, agent tool-chain design review, boundary controls, Annex IV scaffolding written alongside the code.

Methods

STRIDE for AIAttack trees

Pipeline

Data lineagePipeline controls

Vector stores

PineconeWeaviatepgvectorQdrant

Agentic Systems & Interoperability

Architecture for agents that wield tools, retain memory, and chain reasoning across protocols. Writing on tradeoffs between emerging standards.

Protocols

MCP (Model Context Protocol)A2A (Agent-to-Agent Protocol)

Frameworks

LangChainLangGraphLlamaIndex

Patterns

Multi-Agent SystemsAgent Orchestration

EU AI Act Conformity

Engineering-led interpretation of the regulation. Classification under Article 6, conformity assessment pathways, Annex IV technical file preparation. The specific articles that map to the specific controls in the system.

Regulation

EU AI Act (Regulation 2024/1689)

Management system

ISO/IEC 42001 (Senior Lead Implementer, PECB)

Risk frameworks

ISO/IEC 23894NIST AI RMF

Technical Foundation

The specialist work rests on years of shipping AI systems, cloud platforms and enterprise software. That lets me design and build AI systems end to end when that is the right path. It also makes the specialism defensible when it is not.

Production AI Architecture

Generative AI, agentic systems, retrieval over your own data (RAG), fine-tuning, evaluation, MLOps and LLMOps. I led the work on the AI reference architecture at PostNL (2024 to 2026). Before that, I architected enterprise AI systems at IBM.

Tools

PyTorchHugging FaceLangChainAWS BedrockWatsonXDatabricksMLflowLangfuseRagasDeepEval

Cloud & Platform Engineering

How AI systems actually deploy. Serverless architectures, Kubernetes, infrastructure as code, multi-cloud deployment patterns.

Tools

AWSAzureGCPKubernetesTerraformAWS CDKServerless patterns

Software Engineering Depth

15+ years across software engineering, including system design, API architecture, and enterprise software delivery. Knowing what secure code looks like is a precondition for advising on AI security.

Languages

PythonJavaTypeScriptGoRust

Tools and frameworks

Organised by role in the specialist work, not by category. Tools listed are in active use, not an exhaustive career inventory.

AI Security Stack

ZiranNVIDIA GarakPromptfooOWASP LLM Top 10MITRE ATLASThreat ModellingRed Teaming

AI Governance

EU AI ActISO/IEC 42001ISO/IEC 23894NIST AI RMFAnnex IV Conformity

AI & Agentic Systems

PyTorchHugging FaceLangChainLangGraphLlamaIndexMCPA2AAWS BedrockBedrock AgentCoreWatsonXRAGMulti-Agent SystemsFine-tuningRLHF

MLOps & Evaluation

MLflowLangfuseRagasDeepEvalWeights and BiasesLangSmithEvidently AI

Cloud & Infrastructure

AWSAzureGCPKubernetesTerraformAWS CDKServerless

Data & Vector Stores

PostgreSQLKafkaSnowflakeDatabricksGraph DatabasesPineconeWeaviatepgvectorQdrant

Backend & APIs

FastAPISpring BootNode.jsRESTGraphQLgRPCEvent-DrivenDDD

Languages

PythonJavaTypeScriptGoRust

Book a 30-minute call