Enterprise AI · Governance · Security · Nairobi
Scipio Consulting helps boards and executive teams turn artificial intelligence into measured gains in cost, revenue and risk. Each use case gets a baseline, a named owner and a control before it goes live. No hype. No orphan pilots.
The problem
of organisations report any EBIT impact from AI, while 88% use it in at least one function.
McKinsey, State of AI 2025 ↗of generative AI pilots stall before they reach scaled adoption with measurable returns.
MIT NANDA, GenAI Divide 2025 ↗of agentic AI projects will be cancelled by the end of 2027, because of cost and unclear value.
Gartner prediction, 2025 ↗of organisations with an AI-related breach did not have AI access controls in place.
IBM, Cost of a Data Breach 2025 ↗AI value comes from redesigned workflows, clean data, clear ownership and controls that let you scale with confidence. High performers are nearly three times more likely to redesign workflows than to bolt AI onto old ones.
I have spent two decades building digital infrastructure across Africa: networks, data centres, cloud platforms, policy and regulation. Scipio applies that same engineering and governance discipline to AI.
The Scipio method
We sequence productivity, data, agents and operational AI so that each step funds and de-risks the next. You can start at any phase. The diagnostic below tells you where.
Core services
Each service ends with something you can measure. We agree the measure with you before work starts.
For boards and executives
We find where AI will move your numbers, rank the opportunities by value and risk, and build a funded roadmap your board can approve.
For product and operations leaders
We design and build AI assistants, agents and apps that use your own data, with security, evaluation and cost controls built in from the first sprint.
For finance, HR, service and IT teams
We redesign a process end to end, then automate the steps that repeat. Agents propose. People approve high-impact actions. Every action leaves an audit trail.
For investors, lenders and acquirers
We test whether a target's technology, data and AI claims will hold up. You get a clear view of risk, scalability and the cost to fix gaps, in time for your investment decision.
The controls that make the four services safe to scale. Available as part of a programme or on their own.
AI policy, acceptable-use rules, risk registers, model approval and retirement procedures your staff can follow.
Threat models for LLM apps and agents, prompt-injection and data-leak testing, and red teaming before go-live.
Classification, sensitivity labels, DLP, retention and data-protection impact assessments for AI use.
Board briefings and role-based training, from the trainer who teaches African ICT regulators about AI.
Every step to the right adds engineering effort, operating responsibility and lifecycle cost. We move right only when integration, control, reliability or scale requires it.
Copilot, Copilot Studio, Foundry, Fabric and OneLake, with Entra, Purview and Defender for trust.
Bedrock, SageMaker and Well-Architected reviews, led by a certified Solutions Architect Professional.
Open-weight models and Model Context Protocol tools where cost, sovereignty or control demand it.
ERP, CRM, PMS, POS and ITSM, including Dynamics 365, Zoho, Odoo and hospitality platforms.
Case studies and proof
These engagements were delivered by Thomas Makau, the founder of Scipio Consulting. Each one shows a skill that AI programmes need: governance, investment logic, due diligence, operations and capacity building.
AI lens: the same policy-to-control model we now deliver as AI Governance and SOPs.
AI lens: investment cases with outcome logic is how we build AI portfolios that boards can fund.
AI lens: the base of our Technical Due Diligence service for AI-enabled targets.
AI lens: sovereign compute and data residency now decide where African AI workloads can run.
AI lens: workflow redesign comes first. That is where AI automation earns its return.
AI lens: clean processes and governed data are the ground that automation stands on.
AI lens: we know where African AI regulation is going because we help the regulators prepare for it.
AI lens: we think like operators who must make the numbers work, not only advisers.
Client names appear only where the engagement is public. Metrics come from engagement records. For AI programmes, we report value in the same way: baseline, measured result and the control that protects it.
Interactive tools
Take the readiness diagnostic, model the return on one use case, then book time to discuss the result.
Model: hours released = staff × hours per week × time saved × adoption × working weeks. Benefits start at go-live. Build cost spreads over the months before go-live. Real results depend on your baseline, data and adoption, which we measure in the first phase.
Discuss this model with us1. Choose a session
2. Pick a time
Trust and governance
We design permissions, security, data protection and human accountability into every layer of the AI stack. Select a layer to see what we control there.
The international standard for an AI management system. We build policies and controls that can be certified.
Govern, map, measure and manage. A practical structure for the AI risk register.
Lawful basis, impact assessments, data-subject rights and ODPC registration for AI processing.
Launched March 2025. We align use cases with its skills, infrastructure and ethics pillars. Source ↗
Proposes an AI Commissioner, risk classes and impact assessments. We prepare clients now. Source ↗
The African Union's 2024 framework for people-centred, development-focused AI.
High-risk duties now phase in from December 2027 under the 2026 Digital Omnibus agreement. Source ↗
Information-security controls plus the OWASP Top 10 for LLM applications.
Our experience
Founder and Principal Consultant
"I have spent my career turning new technology into infrastructure that people rely on. AI is the same job with higher stakes. It must be useful, safe and paid for by the value it creates."
Thomas started as a network engineer in the early days of the Kenyan internet. He went on to lead operations for East Africa's largest data carrier, build a satellite ISP's technology function as founding CTO, and advise governments, regulators, multilaterals and enterprises across the continent.
Today he leads IT security and governance projects for a pan-African hotel group, trains national regulators on AI for the ITU, and teaches cloud and digital transformation on LinkedIn Learning.
Founded to deliver enterprise AI strategy, governance, security and architecture.
ICT, AI-governance and cybersecurity policy, data protection and network security.
AI, IoT, 5G/6G and cloud for regulators in Kenya, Ethiopia, Malawi and Zimbabwe.
World Bank KDEAP, AfDB due diligence, Konza data centre, Kenya–Ethiopia 4.2 Tbps backbone, 10 MW data-centre design.
Led support and service integration for tier-1 operators across six countries.
Founding CTO. Built the technology function and took the company to profit.
Service operations across 11 countries. Systems integration for Airtel Africa.
Service delivery engineer at one of Kenya's first ISPs.
Scipio Africanus won by studying the ground and the opponent before he committed his forces. We bring that discipline to AI: understand the terrain, set a clear objective, then move with control.
Ways to work with us
Two to three weeks. We assess your readiness, rank your use cases and give you a costed first-phase plan.
We take one to three use cases from baseline to production, with governance in place and benefits tracked.
A part-time Chief AI Officer to lead your portfolio, chair your AI risk committee and brief the board.
Book a free 30-minute strategy call. You will leave with a clear first step, whether or not you work with us.