Built for security, AI and regulation
NOETIX is a specialist European cybersecurity, digital risk and AI governance advisory and technology firm.
We work with organisations across Europe on cyber resilience, governance, artificial intelligence, privacy and regulated financial infrastructure. Every engagement is senior led by experienced practitioners, supported by our own technology, and extended by a small dedicated network of specialists and technology partners when the work calls for it. The firm is kept deliberately small so that senior attention is real rather than nominal.
A gap between advice and accountability
Regulated organisations rarely lack material. They have reports, frameworks, dashboards and remediation plans. What is often missing is someone senior who owns the position end to end and can defend it in front of a board, an auditor or a supervisor.
NOETIX was set up to close that gap. The firm is structured so that experienced practitioners stay on the work rather than moving to the next proposal, and so that the same people can move between board reporting, regulatory interpretation and control detail without a handover in the middle.
That is also why we build our own technology. Judgement is the scarce part of this work. Evidence collection, control tracking and reporting should be carried by tooling so that senior time is spent on decisions.
Our operating philosophy
Three principles shape how we take on work and how we deliver it.
Practitioners, not presenters
The people who scope the work are the people who deliver it. We write the policies, run the tests, sit in the audit meetings and prepare the board papers.
Regulation as a working constraint
We treat DORA, NIS2, GDPR, ISO 27001 and the EU AI Act as design inputs rather than paperwork. Controls should fit the way the business already runs.
Capability that stays behind
An engagement should leave your team more capable than it found them. We document, hand over and train as part of the work, not as an extra.
Accountability with a name on it
Founder led means someone senior is answerable for the work. It does not mean one person carries it alone.
Each mandate combines direct senior leadership with dedicated delivery support, our own technology and vetted specialist capacity. The named principal owns scope, quality and the client relationship. Delivery support and specialist partners carry depth and volume where that is the right answer.
The arrangement is set out at the start of an engagement, so you know who leads, who delivers each part and how continuity is maintained. Working papers, evidence and documentation stay with the client, which keeps the firm useful rather than indispensable.
Where we concentrate expertise
Six connected domains in which we advise, build technology and work with specialist partners. Each is defined by regulation, dependent on trust and resistant to generic software.
Cybersecurity & Digital Trust
Defensive and offensive capability, assurance and trust infrastructure for organisations that cannot afford to be wrong.
AI Governance & Responsible AI
Controls, assurance and oversight for automated and generative systems operating under the EU AI Act and existing privacy law.
Regulated Financial Infrastructure
Payments, electronic money and market infrastructure, where resilience and supervisory expectation set the pace.
Privacy & Data Protection
Accountability, records and decision making that hold up across jurisdictions and under supervisory review.
Operational Resilience
ICT risk, continuity, testing and third party dependency management under DORA and NIS2.
Regulatory Technology
Tooling that turns governance judgement into maintained evidence, reporting and repeatable process.
Senior led delivery, specialist capacity when needed
How partnerships work
Client work is senior led. Where an engagement needs specialist capacity, such as deep technical testing, forensics or a particular platform, we bring in a small dedicated network of vetted specialists and technology partners. They bring the depth, we bring regulatory and security judgement, and we keep ownership of scope, quality and the client relationship. We are always explicit about which parts of a delivery are partner led.
A small secondary activity
Separately from client work, and on a much smaller scale, we occasionally support early stage builders in cybersecurity, responsible AI and regulatory technology with product and go to market guidance for regulated buyers. This is a minor activity and not what NOETIX is. We are not a venture capital fund and do not operate an investment programme.
Experience brought into NOETIX engagements
The senior people who lead our work have run these programmes before. The domains below describe practitioner experience they bring with them. They are stated in general terms and are not presented as engagements contracted under the NOETIX legal entity.
We do not publish client names, counts or values. What we can do is walk you through the approach in detail in a conversation.
DORA governance and ICT risk
ICT risk management frameworks, governance uplift and regulatory readiness work, including Register of Information remediation and submission programmes.
PCI DSS Level 1 readiness
Payment security programmes, scope reduction, control design and evidence preparation ahead of assessment by independent qualified assessors.
Resilience in regulated finance
Cybersecurity and operational resilience programmes in regulated financial services, electronic money and payments environments.
Multi jurisdiction privacy
Privacy and data protection governance across multiple jurisdictions, covering accountability records, assessments and supervisory expectations.
ISO 27001 readiness
Information security management system design, readiness and improvement programmes ahead of certification by independent accredited bodies.
Third party and ICT supplier risk
Supplier risk programmes, assurance models, contractual control expectations and ongoing monitoring of critical ICT dependencies.
AI governance operating models
AI governance frameworks, readiness assessment and control design for organisations adopting automated and generative systems.
Payment, fraud and digital risk
Fraud, merchant and digital risk programmes across payment ecosystems, including control design and executive reporting.
A note on how we describe this. Frameworks and regulations such as DORA, NIS2, GDPR, ISO 27001, PCI DSS and the EU AI Act are listed on this site to describe the regimes we work with and advise on. They are not claims of certification, accreditation or assessor status, and NOETIX is neither a regulator nor an audit firm. Where a mandate needs formal certification or an accredited assessment, we prepare you for it and coordinate the parties who are entitled to perform it.
Briefings and practitioner notes
We are preparing regulatory briefings and anonymised practitioner notes across regulatory change, cyber and digital risk, AI governance and payments. The categories are set out on the Insights page, and we will publish only when a note is worth reading.