Three Ways to Work Together
Attolloo works with a small number of AI companies, and is led by Nils Johan Brede. Most start with the first of these.
READINESS ASSESSMENT
A fixed-price review of how your company looks to the people who have to say yes: a regulated buyer, a regulator, a partner or an investor. You get a written report: the 6Sense screening, an AI Compass baseline, and a 90-day plan in priority order. The report is yours to use whether or not we work together afterwards.
BOARD, ADVISORY AND MENTORING
A board seat, a standing advisory role or a mentoring agreement, for a fee agreed in advance. For companies that want governance experience in the room when the funding round, the audit or the large contract comes up.
EXECUTIVE PARTNERSHIP
Hands-on executive support in a critical period: a funding round, a licence application, an audit or a first large institutional customer. Offered by agreement, and only after an assessment. Scope, start and terms are agreed case by case.
Terms are agreed in writing before the work starts: what Attolloo contributes, what it costs, and how the engagement ends.
AI companies in regulated markets do not die from lack of technology. They die from lack of governance.
Early-stage AI companies in Fintech, Regtech, and Compliance Automation face a specific, structural problem in the 12-36 months after first product launch. They have technology that works. What they lack is the governance architecture that makes banks, insurers and other institutional buyers willing to buy it, partner with it, and fund it.
The same holds for companies that set out to compete with the established players rather than sell to them. They become the regulated party themselves, and the regulator, the partner bank and the investor ask the same questions.
Why this is urgent now
The EU AI Act applies in stages. Prohibited practices have been banned since February 2025, transparency duties apply from August 2026, and the requirements for stand-alone high-risk systems now apply from December 2027. DORA has been applicable since January 2025. Institutional buyers are not waiting for the last date: they already ask for documented AI governance in procurement and due diligence. A founder who cannot document AI governance to a procurement committee loses the contract. A founder who cannot demonstrate regulatory readiness to an institutional investor does not close the round.
A lawyer can tell you what the regulation says, and a CTO can build the controls. What is usually missing is someone who has run a security company and advised regulated companies through the first years of GDPR and MiFID II, and who knows what the people on the other side of the table will ask for.
Behind the Work
THE METHOD: four frameworks, used in the same order every time. See how they fit together
AN EXAMPLE: the method applied to two fictitious companies, with the numbers. Method in Practice
THE STANDARD: every company is first asked what happens if its technology ends up in the wrong hands, and red lines apply. Responsible AI
Led by Nils Johan Brede
Four decades in technology, security and leadership in regulated markets. CEO of Watchcom Security Group through its turnaround and sale. Director in PwC's cyber and risk practice during the first years of GDPR enforcement. Mentor to early-stage companies, among others through Innovasjon Gardermoen.
MBA with specialisation in Digital Business, certified by Universidad Isabel I and delivered by ENEB, 2026.
Contact Nils Johan · nils.johan@attolloogroup.com · Oslo, Norway