I came to AI sideways. My first decade was spent inside cybersecurity — incident response, governance, the unglamorous controls work that keeps regulated industries from making the news. Around 2022 the tooling I was using to do that work started to change shape: language models began to be credible at the kind of structured analysis a junior analyst spends their first two years learning to do.

Two paths opened. The first was the consultant's path — write a deck, run a workshop, sell a roadmap. The second was the builder's — find one repetitive thing a team did badly and replace it with something that worked. I took the second. Most of what's on the homepage came from doing that repeatedly for different organisations.

I'm suspicious of work that doesn't end in something running in production. Strategy decks age out, frameworks calcify, but a piece of software either keeps doing its job on a Tuesday morning or it doesn't. So most engagements converge on the same arc:

• A week of listening. Sit with the team. Watch the actual process. Find the one workflow that's eating disproportionate time or risk.
• A small thing, shipped. A working slice that solves one slice of the problem. Real users, real data, real metrics, inside two or three weeks.
• Iterate or stop. If the slice earns its keep we expand it. If it doesn't we learn cheaply and try a different cut. No quarter-long proofs of value before the first deploy.

The hardest part of this work is rarely the model — it's the integration, the data hygiene, the ownership question, the change-management. I've learned to plan for those up-front rather than discover them in week six.

• The interesting bit isn't the model. Once the model is good enough — and it usually is — the work is in evaluation, integration, observability, and the human workflow around the system. That's where most projects fail.
• Governance is a feature, not a tax. Done well, the controls that satisfy ISO 42001 or the EU AI Act are the same controls that stop your system regressing in production. Don't bolt them on at the end.
• Small, owned, boring. Prefer a system the team can maintain themselves over a cleverer one that depends on me. The best outcome of an engagement is the team not needing me for the next one.
• No magic.If I can't explain why a system did what it did to a non-technical stakeholder, it's not finished.

Pragmatic and current — TypeScript end-to-end where possible. Next.js for product surfaces, Supabase or Postgres for state, Stripe for billing, frontier models (Anthropic, OpenAI, Google) via thin abstraction layers so swapping is cheap. Bunny or Cloudflare for media, Resend for transactional mail, Vercel for hosting. For agentic systems I lean on the Anthropic SDK and small, well-tested tool inventories rather than monster frameworks.

For governance work the stack is people, documents, and evidence — usually Notion or Confluence, occasionally a purpose-built compliance platform if one's already in place. I don't sell tooling.

I read more than is healthy. I'm a parent, which has quietly reshaped what I think makes work worth doing. I live in the UK. I cycle long distances slowly. I run the tomphillips.uk portfolio you're reading now as both a calling card and a working lab — most of the interactive pieces on the homepage started as experiments I wanted to understand from the inside.