My contribution to a board
A board that relies on data or AI is relying on claims it usually cannot test: that customer data is kept apart, that a model does what the vendor says, that a supplier's cloud keeps data where the contract says. My contribution would be to help directors test those claims with ordinary questions and to recognise evasive answers. I have given those answers myself, as a consultant and as an operator, and I know where they tend to be thin.
I would bring specific experience of the places data promises fail: access groups nobody removed, backups outside a deletion procedure, subprocessors added without review and contract clauses stretched to cover uses their authors never imagined. I would also bring a register statistician's training in how aggregates identify people, which is directly relevant to any company that sells or shares data products.
I would be clear about my limits. I am not a financial expert for audit committee purposes. I have not chaired a listed company committee, and I would want to serve as a member before chairing anything. My knowledge of other sectors' operations is limited, and I would need a full year to understand a business well enough to judge its data risks rather than recite mine.
Judgement in practice
01Asking a board to pay for a promise the company had already made
When we found one access group reaching all 138 client analytics environments, the cheaper option was to fix the group and add monitoring. I put both options to the board through the chief executive and argued for full separation, knowing it would cost €9.4 million and reduce the service margin. One director asked whether I was recommending the expensive option because it was the safer one for me personally. It was a fair question, and I answered by setting out what each option would allow us to say to clients in writing, and which statements would be untrue. The board chose separation. As a non-executive I would expect management to show the board what each option lets the company honestly promise, not only what each costs.
02Holding a senior researcher to the institute's disclosure rules
In 2023 the research data committee I chair at Kallbacka received a request from one of the institute's most senior researchers to publish municipal-level tables of benefit receipt by country of birth. The analysis was important and the researcher was respected. Several cells fell below our minimum size in small municipalities. I recommended against publication in that form and proposed regional tables instead, which the researcher thought would hide the variation he wanted to show. The committee agreed with me, and the study was published with regional figures and a note on the method. On a board I would hold senior people to the same rules as everyone else, and say so in the minutes.
03Reporting a worse figure to the audit and risk committee
In 2022 I proposed changing how we reported cross-client access to our audit and risk committee, from the number of access groups with cross-client reach, which had fallen sharply, to the number of privileged sessions into client environments without a linked ticket. The new measure was worse and harder to improve. The committee chair asked why I would replace a good number with a bad one. I explained that the old figure measured our tidiness and the new one measured our clients' risk. The committee adopted it, and it has fallen by four-fifths since. I would encourage management on any board to bring forward the measure that is uncomfortable, and I would try to make doing so safe.
My first year on a board
I would treat my first year as a period of listening, with a small number of deliberate questions.
Before my first meeting I would read the last two years of board and audit committee papers on technology, data protection, cyber security and any AI programme, together with the most recent internal audit reports in those areas. I would ask the chair which data or AI decision the board found hardest to judge, and why.
In the first two quarters I would meet the chief executive, the chief financial officer, the head of internal audit, the data protection officer and whoever owns the company's largest data or AI programme, separately. I would ask each the same question: which promise about data does this company make to customers, regulators or partners that would be hardest to prove tomorrow? The differences between their answers usually show where the board's view is incomplete.
In the second half of the year I would ask to see one thing in detail: a list of who can reach the company's most sensitive data, including suppliers, or the register of AI systems in use. I would not propose changes in my first year unless I found a risk that could not wait.
At the end of the year I would ask the chair whether my questions had been useful or merely technical.
Conflicts and their management
Lumivara has about 2,300 clients across the Nordic and Baltic countries, so conflicts are the first thing I would examine, before any interest in the seat itself.
I would not join the board of an IT services firm, cloud or hosting provider, or software company competing with any Lumivara service line. I would also decline any company that is a material Lumivara client, a supplier on whom our services depend or a bidder against us in public tenders. Where a company has a small contract with Lumivara, I would disclose it to the nomination board and let the company's board decide whether it affects my independence.
On the board I would leave any discussion of IT outsourcing, cloud procurement or data platform suppliers in which Lumivara or its direct competitors could take part, and I would ask that my absence be minuted. I would not bring Lumivara's client information, pricing or benchmark data into another boardroom, even as an illustration. If the company later began buying from Lumivara at scale, or Lumivara began bidding for its work, I would raise it with the chair at once and expect to step down if the recusals became routine.
Any appointment would need the written consent of Lumivara's chief executive, and the 22 days a year I can offer would be agreed with him first.
My independence statement
I serve as an executive of a listed IT services company, and that position shapes every board I could join. I would set out for a nomination board, before any proposal, my employment and shareholding in Lumivara, my foundation directorship and any contract, tender or partnership between Lumivara and the company. The company's board would then assess my independence of the company and of its significant shareholders under the corporate governance code that applies to it. Whether I am independent is that board's judgement to make, not mine to announce.
Board and committee exposure
Served as a director
Kallbacka Research Institute
Board of the foundation; chair of the research data committee from 2022
March 2020–present
Non-executive director of the research foundation where I began my career; chairs the committee that approves researchers' access to linked register data and the disclosure rules for publications.
Reported to a committee
Lumivara Oyj
Audit and risk committee
February 2021–present
Quarterly report on data protection incidents, cross-client access, sovereign-tier exceptions, AI systems and data product disclosure risk; attends for that item.
Presented to the Board or a committee
Lumivara Oyj
Full board
2021–present
Presented the case for separating the managed analytics service into client tenancies, and an annual data and AI strategy paper since 2022.
Presented to the Board or a committee
Brantmark Cloud AB
Board of directors
2017–2019
Reported on the GDPR programme to a private-equity-controlled board and prepared data-handling evidence for the sale process.
Governance learning and readiness
IICA Independent Directors’ Databank: Not yet registered
The IICA Independent Directors' Databank is maintained in India for independent directors of Indian companies. It has no bearing on the Nordic board seats I am considering, so I have not registered and have no plans to. In Finland and Sweden, director candidates for listed companies are usually proposed by a shareholders' nomination board or committee, and independence is assessed under each country's corporate governance code.
- Board and audit committee programme of a Finnish directors' association, completed in 2024
- Foundation board service since 2020, including chairing a research data committee from 2022
- Quarterly attendance at Lumivara's audit and risk committee since 2021
- A part-time master's degree in information technology law, completed in 2013
Committee contribution
Chair and member readiness| Capacity | Committees |
|---|
| Ready to chair | A technology, data or digital committee, where the board has one |
|---|
| Ready to join | Audit and risk committee, contributing on data protection, cyber and AI risk rather than as the financial expert · Risk committee · Research or ethics committee of a public-interest organisation |
|---|
Capacity and preferences
- Time available
- 22 days per year
- Current directorships
- 1
- Sectors
- Nordic industrial and engineering companies digitising their service operations · Retail and consumer-services companies with large customer data estates · Research foundations and public-interest data bodies
- Company type
- Nordic listed mid-cap company whose shareholders' nomination board is looking for data and AI experience, or a research or public-interest foundation that holds sensitive data
- Company stage
- A company whose strategy now depends on data or AI faster than its board's ability to test management's claims about either
The seat I am pursuing
I am looking for one non-executive seat, on the board of a Nordic listed mid-cap company or a research or public-interest foundation, where data or AI has become central to the strategy and the board wants a member who can test management's account of it. Industrial companies building service businesses on equipment data, consumer businesses with large customer data estates and foundations that hold sensitive research data are where my experience would transfer most directly. I would hope to join the audit and risk committee, contributing on data protection, cyber and AI risk alongside its financial experts, and in time to chair a technology or data committee if the board has or wants one. I would not accept a seat whose purpose was to signal that the board had an AI expert, and I would decline any board where my Lumivara role created conflicts I could not manage through disclosure and occasional recusal.