Memo / 008AI governance · 31 Aug 2026
Scaling AI responsibly — governance that enables adoption
1 min read
Amsterdam · Herengracht 124
Transformation · AI governance · Cyber risk · Leadership
Navigatewhat’s next.
Board advisory on digital transformation, AI governance, cyber risk and technology leadership. Concretely: CISO as a Service, interactive crisis management exercises, EU AI Act readiness, a transformation office and standing counsel for technology leaders.
Arrange a callReply within 1 business day
CounselFixed scope · Fixed fee · One partner
02 · The practice
Four practices.One standard of counsel.
From strategy to board assurance. Engagements are scoped on intake and delivered as one defensible operating model — never as a deck.
Practices
- 01Digital transformationStrategy, operating model, execution.Strategy · execution
- 02AI governancePolicy, risk, responsible adoption.AI · governance
- 03CybersecuritySecurity that strengthens the business, not security that slows it down.Cyber · practice
- 04Technology leadershipCounsel for CIOs, CTOs and boards.Board · leadership
What we offer03
From CISO to crisis exercise.One standard of counsel.
Concrete propositions under each practice, from a standing CISO and interactive crisis management exercises to EU AI Act readiness and a transformation office. Fixed scope, fixed fee, one partner.
All offerings01 · Digital transformation
Transformation officeThe operating model and the office that runs it.
Transformation officeTransformation · operating model
6 weeks + 2 quarters
design, then a running transformation office
How it works
- 1DesignSix weeks: current state, ambition, constraints. We design the target operating model and test it with the people who will own it. The output is one document — not a deck — the executive team can run the programme from.
- 2The officeWe stand up the transformation office: mandate, team, cadence, tooling, reporting. A Pluor partner leads it for two quarters and chairs the monthly executive review.
- 3HandoverYour own transformation lead takes over with the reporting, the roadmap and the decision log in place. We remain available as standing counsel per quarter if wanted.
- You receive
- Target operating model · sequenced roadmap · monthly executive report
- For
- CEO · COO · CIO · executive team
- Terms
- Engagement letter, fixed fee per phase
02 · AI governance
EU AI Act readinessEvery AI system classified, every obligation owned.
EU AI Act readinessAI · regulation
4–6 weeks
every AI system classified and owned
How it works
- 1DiscoveryWe find the AI systems: procurement and licence records, IT inventories, vendor contracts, data protection records and a short survey of the teams. Shadow AI counts. The register typically doubles between the first estimate and the final list.
- 2ClassificationEach system is classified — prohibited, high-risk, transparency obligations, minimal risk — and your role is determined per system. The rationale is written down so it survives a change of staff and a supervisor’s question.
- 3Obligations and programmePer system we map the obligations to existing controls: risk management, data governance, documentation, human oversight, logging, transparency. The gaps become a programme sequenced against the application dates, with owners and cost.
- You receive
- AI system register · classification memo · obligation map · programme
- For
- CIO · data protection officer · general counsel · product leads
- Terms
- Engagement letter, fixed scope, fixed fee
03 · Cybersecurity
Crisis management tabletop exercisesInteractive crisis simulations for your crisis team, on our own exercise platform.
Crisis management tabletop exercisesFeatured
Half a day
exercise with the board and the crisis team
How it works
- 1Intake and scenario designA short intake maps your organisation, critical processes, existing plans (BCP, DRP, playbooks) and current risks. We design a recognisable scenario, such as a ransomware attack, a large-scale data breach or disruption of critical IT or OT systems, and build it into our exercise software.
- 2The exercise sessionAn experienced Pluor facilitator leads the scenario across three to four rounds, from the first signals to a full-blown crisis and media pressure. News alerts, ransom notes and media coverage reach the room in real time. At every critical moment the team faces a concrete decision, while observers track dynamics, decision-making and communication.
- 3Structured decision-makingDuring the exercise we train the BOB method: situational awareness (what do we actually know), judgment (what are we trying to achieve and which options do we have) and decision (what will we do, by whom and when). It prevents jumping to decisions under time pressure without weighing risks and consequences.
- 4Evaluation and reportingYou receive a clear report with the key observations on collaboration, role perception, decision-making and communication, plus concrete recommendations ranked by urgency and matched to your organisation’s maturity. We present the results and take your feedback.
- You receive
- Exercise report · prioritised recommendations · results presentation
- For
- Crisis team (CMT) · IT/OT recovery team · or both combined
- Terms
- Per exercise, or a progressive exercise programme
- 3.1Crisis management tabletop exercisesInteractive crisis simulations for your crisis team, on our own exercise platform.
- 3.2CISO as a ServiceExecutive cybersecurity leadership, when you need it.
- 3.3Cyber risk managementKnow what matters. Know what to do next.
- 3.4Cybersecurity complianceMake compliance a source of confidence, not a scramble before the audit.
- 3.5ISMS & security managementBuild a security management system people can actually run.
- 3.6Security architectureMake the secure choice part of the design.
- 3.7Cyber resilienceWhen prevention fails, performance under pressure matters.
04 · Technology leadership
Fractional CTO / CIOExecutive technology leadership, one or two days a week.
Fractional CTO / CIOLeadership · fractional
1–2 days
a week: an executive at your table
How it works
- 1The first quarterAssessment of the technology estate, the team, the vendors and the commitments already made. A technology strategy on one page for the executive team, with the three decisions of the year.
- 2Running the functionOne or two days a week: the executive meetings, the architecture decisions, the vendor negotiations, the team. A monthly written note to the CEO on progress, risks and decisions required.
- 3SuccessionWe define the permanent role, help select the candidate and hand over with the strategy, the decision log and the team in place. Standing counsel per quarter remains available afterwards.
- You receive
- Technology strategy · architecture direction · team and vendor leadership
- For
- CEO · CFO · executive team · supervisory board
- Terms
- Quarterly, renewable · handover to permanent appointment
04 · The firm
Quietly authoritative.Precise by default.
Pluor is a boutique advisory in Amsterdam. We help organisations navigate digital transformation, AI governance, cybersecurity risk and technology leadership — from strategy to board assurance.
- Founded
- 2021 · Amsterdam
- Practice
- Transformation · AI · Cyber · Leadership
- Engagements
- 184 briefings issued · YTD
- Format
- Engagement letter · matter file
Amsterdam / The firmFig. 04
In numbersPluor · 2026 YTD
- Briefings issued · YTD
- 184
- Pluor · 04 / 2026
- Engagements renewed
- 96
- Pluor · 2025
- Boards advised
- 40
- Since 2021
08 · Questions
What boardsask us first.
Short answers to the questions that open most intake conversations.
08 · Questions
- 01What does Pluor do?
- Pluor is a boutique advisory in Amsterdam. We advise boards, executive teams and technology leaders on digital transformation, AI governance, cybersecurity risk and technology leadership, and we deliver the advice as an operating model the organisation can run rather than as a slide deck.
- 02Who do you work with?
- Boards, CEOs, CIOs, CTOs, CISOs and general counsel of regulated and mid-to-large organisations in the Netherlands and the wider EU: financial services, healthcare, energy, public bodies and technology companies.
- 03What is a briefing?
- A single A4 of evidence, written by the partner for the board. It frames the ambition, the risk and the decision at hand. Every engagement starts with one, and many board questions need no more than one.
- 04How are engagements scoped and priced?
- Every engagement is confirmed in an engagement letter with a fixed scope and a fixed fee, agreed at intake. Most engagements run four to eight weeks; standing counsel for technology leaders is renewable per quarter.
- 05Which regulations do you cover?
- The EU AI Act, NIS2, DORA, ISO/IEC 27001 and 42001, and the sector rules that apply to you. We map obligations onto the controls you already operate rather than building a parallel framework.
- 06Where are you based and in which languages do you work?
- Herengracht 124, Amsterdam. We work in Dutch and English, on site and remote, across the EU.
Put your questionto a partner.
A thirty-minute call, directly with the partner who will run the engagement. We reply within one business day; after the call you receive a proposal with a fixed scope and a fixed fee.
Contact
- briefings@pluor.eu
- +31 20 760 8400
- Herengracht 124, 1015 BT Amsterdam
Introduction07