About

An engineer who ended up governing Ai

I spent a career making regulated engineering safe, reliable and auditable before I ever touched a language model. I bring that same governance discipline to Ai. It is the difference between adopting Ai and gambling on it, and it shapes everything I do.

Tommy Findlay at work

Where it started

I have been interested in how technology can be used for the good of people for as long as I can remember. I took on endurance races at the age of ten, and I have spent most of my life challenging what other people had decided was possible.

The people I looked up to, Richard Branson and the Virgin Unite work among them, all seemed to share one habit. They took on a hard problem, ran the experiment, and kept going past the point where most people stop. That is the instinct I have carried into every job since.

The engineering years

My first degree is in Materials Science and Engineering. Straight out of university I joined a specialist aerospace surface-coatings business, working on oxidation and hot-corrosion coatings for the superalloy parts inside a jet engine. After three years I was recognised as the expert in that niche and promoted into the research and development team in the United States, without a PhD, on the strength of what I could actually do. My wife and I moved to Indianapolis for two and a half years.

I am a co-inventor on two patents for aerospace coatings that help a jet engine run more efficiently. Back in the UK I held audit and non-conformance responsibility for a site through its turnaround from loss-making to more than fifteen percent profit, month on month, for thirty months. Later I built an integrated ISO 9001, 14001 and 45001 management system from scratch and passed ISO 45001 at the first attempt with zero non-conformances, one of the first businesses in the gas turbine maintenance niche to do it. I was granted Chartered Engineer status in 2020 on industry achievement rather than a masters. Those years taught me to prove what I did rather than just claim it, through traceability, controlled change and evidence. That habit is exactly what governed Ai needs now.

The lightbulb

The Manchester MBA changed how I thought about all of it. It is one of the world’s leading courses on sustainable development, and it introduced me to the triple bottom line and the seventeen UN sustainable development goals.

I had always believed that business and technology should be used for good. What the MBA showed me was that this is a whole movement, not just a private instinct, and that a business focused only on profit is leaving most of its potential on the table. I decided to challenge that on a different level.

Getting change to stick

Technology projects rarely fail on the technology. They fail because the people who have to live with the change were never really brought into it. I am a Change Management Practitioner and I run delivery with PRINCE2 Agile discipline, so an Ai rollout is designed around the people using it rather than dropped on top of them.

I have project managed everything from global turbine outages to a three-day leadership strategy workshop that became a live commercial product. The through-line is always the same: bring people in early, prove the value quickly, and make the new way of working the easy way to work.

What I do now

I founded iS3 to do Ai the way an engineer does anything in a regulated environment: governed, evidenced and built to last. Most Ai advice stops at a strategy document. iS3 designs the decision boundaries, where Ai can act and where a human has to approve, builds the system that runs them, and produces the audit evidence as part of the build. As an ISO 42001 lead implementer and ISO 27001 lead auditor, I treat governance as the operating spine of the work, not a compliance box ticked at the end. That is what separates governed Ai from the generic kind, and it is the whole reason iS3 exists.

Most of that work is building a business operating system: getting an organisation onto one governed source of truth, automating the repetitive workflows that sit between its systems, and only then putting Ai on top where it earns its place. I lead iS3 to deliver it, and the work is deliberately concrete. For a subscription retailer we built an Ai-governed recommendation engine that turned a ten-minute manual job into a single click and delivered a measured 200%+ uplift in productivity, which carried the business through its busiest ever quarter. For a rail engineering firm we ran an Ai readiness and ISO gap analysis and are now delivering the roadmap, including a governed quoting application that replaces manual quotes. For a franchise operation we replaced siloed spreadsheets with one custom app. Different sectors, same pattern: the operating system first, Ai second.

For organisations whose problem is the governance and ISO side rather than the Ai, iS3 runs a governance readiness assessment, sets out the blueprint for the operating system, and builds it on Certiqa, the platform I am building to turn ISO compliance into live, audit-ready evidence rather than a spreadsheet rebuilt in a panic before each audit. The Certiqa overview (PDF) sets out what it covers.

Alongside iS3 I co-founded TomCRM and act as its CTO, and I teach Ai through a partnership with Clear Quality and with universities. Running through all of it is something I was trained to do as a young engineer: make my own role redundant, by designing and improving a process until it runs without you. The point is not that people are surplus. It is that automating the mundane frees a person up for the work that actually matters next.

The human bit

Away from the work I am a dad, a triathlete, and a youth football coach, based in Lincolnshire. Endurance sport is where the challenge-what-is-possible habit still gets its exercise. Most of the rest of my time goes on my family and on reading widely enough to keep making unexpected connections.

How ready is your business for Ai?

Get your free readiness score in ten minutes.

Get Your Ai Readiness Score