# Davide Botto

> Davide Botto is an independent Italian engineer and technology advisor based in the Milan area. He advises companies and public administrations on AI strategy and governance (EU AI Act), cybersecurity (NIS2, ISO/IEC 27001), data protection (GDPR, DPO services) and the design of telecommunication networks (IP, WDM optical transport) and mission-critical digital infrastructure. He has co-founded engineering companies in different sectors.

## Profile
- Certified Data Protection Officer (DPO)
- ISO/IEC 27001:2022 Lead Auditor
- Member of AIRIA — Associazione per la Regolazione dell'Intelligenza Artificiale
- Engineering degree in optoelectronics and telecommunications, Politecnico di Torino
- 25+ years in ICT and telecommunications, with projects in Italy and abroad
- Co-founder of engineering companies in different sectors
- Areas: Artificial intelligence strategy, AI governance, EU AI Act, Agentic AI architectures, Cybersecurity, NIS2 Directive, ISO/IEC 27001, Information security risk management, GDPR, Data protection, Data Protection Officer services, Telecommunications engineering, WDM optical transport, IP/MPLS networks, Network synchronization, SDN, NFV, Intelligent transport systems, Weigh-in-motion systems, Structural health monitoring, Quantum-safe cryptography
- Serves: Italy, European Union · Languages: Italian, English
- Contact: davide@davidebotto.com · LinkedIn: https://www.linkedin.com/in/davidebotto/ · VAT IT: IT13773310969

## Services
- AI strategy and AI governance, EU AI Act compliance, agentic AI architectures
- Cybersecurity, NIS2 compliance, ISO/IEC 27001 audits and risk management
- GDPR compliance and Data Protection Officer (DPO) services
- Telecommunication network engineering: IP/MPLS, WDM optical transport, synchronization, SDN/NFV
- Digital and mission-critical infrastructure: ITS, smart mobility, monitoring

## Selected work
- [EU AI Act Consultancy](https://www.davidebotto.com/projects/eu-ai-act-consultancy): EU AI Act consultancy: risk-based AI governance, use-case classification, lifecycle controls and documentation, integrated with ISO 27001, GDPR and NIS2.
- [NIS2 Expert Consultancy](https://www.davidebotto.com/projects/nis2-expert-consultancy): NIS2 Directive consultancy: governance, technical and organisational controls, board accountability and incident reporting, aligned with ISO 27001.
- [Data Protection Officer – CSQA](https://www.davidebotto.com/projects/data-protection-officer-csqa): Data Protection Officer for CSQA: strategic GDPR guidance, compliance monitoring, DPIA support and liaison with the supervisory authority under Article 39 GDPR.
- [Smart Mobility & Enforcement: Designing a WIM System for ANAS in Valtellina](https://www.davidebotto.com/projects/wim-anas-valtellina): Design of a Kistler weigh-in-motion (WIM) system with ANPR for ANAS in Valtellina: continuous vehicle-load monitoring and groundwork for enforcement.
- [Empowering Structural Intelligence for the Ministry of Defence](https://www.davidebotto.com/projects/structural-intelligence-ministry-of-defence): Dynamic structural monitoring for Italian Ministry of Defence telecom towers: Dewesoft instrumentation, MEMS sensors, MQTT and modal analysis.
- [ISO/IEC 27001:2022 Lead Auditor – CSQA Qualification](https://www.davidebotto.com/projects/iso-27001-lead-auditor-csqa): ISO/IEC 27001:2022 Lead Auditor qualification issued by CSQA: planning, conducting and reporting ISMS audits in line with ISO/IEC 27001 and ISO 19011.
- [Encryption over WDM links](https://www.davidebotto.com/projects/encryption-over-wdm): Line-rate AES-256 encryption with MACsec between four data centres linked by multi-vendor WDM (ADTRAN, Infinera, Huawei) for a financial-sector customer.

## Free resources
- [NIS2 Operational Manual](https://www.davidebotto.com/resources/nis2-manual): free 139-page PDF (in Italian, June 2026) on the NIS2 Directive in Italy — Legislative Decree 138/2024, ACN framework, governance, security measures, incident notification and sector analysis. Download after a short registration.

## Podcast: Oltre il modello
- [All episodes](https://www.davidebotto.com/podcast) — new episode every Monday (in Italian)
- [Il modello non l’ha scritto nessuno. Il collaudo tocca a voi](https://www.davidebotto.com/podcast/2026-11-02-il-modello-non-l-ha-scritto-nessuno-il-collaudo-tocca-a-voi) — 2026-11-02
- [Cosa fa davvero un AI strategist](https://www.davidebotto.com/podcast/2026-10-26-cosa-fa-davvero-un-ai-strategist) — 2026-10-26

## Latest newsletter issues (LinkedIn)
- [Il modello non l'ha scritto nessuno. Il collaudo, però, tocca a voi (Week 45/2026)](https://it.linkedin.com/pulse/il-modello-non-lha-scritto-nessuno-collaudo-per%C3%B2-tocca-davide-botto-z2eff) — 2026-11-02 (in Italian)
- [Cosa faccio come AI strategist. E perché non sono io che scelgo il modello (Week 44/2026)](https://it.linkedin.com/pulse/cosa-faccio-come-ai-strategist-e-perch%C3%A9-non-sono-io-che-davide-botto-fnipe) — 2026-10-26 (in Italian)
- [Decidere costa quasi zero ... o no? (Week 43/2026)](https://it.linkedin.com/pulse/decidere-costa-quasi-zero-o-week-432026-davide-botto-mxs5e) — 2026-10-19
- [Agents that work in private don't make a team. And the company learns nothing (Week 42/2026)](https://it.linkedin.com/pulse/gli-agenti-che-lavorano-privato-non-fanno-squadra-e-lazienda-botto-wd57e) — 2026-10-12 (in Italian)
- [Ten thousand agents, 88 hours and a technicality from 2000 (Week 41/2026)](https://it.linkedin.com/pulse/diecimila-agenti-88-ore-e-un-cavillo-del-2000-week-412026-botto-nqise) — 2026-10-05 (in Italian)
- [Your software (Week 40/2026)](https://it.linkedin.com/pulse/il-tuo-software-week-402026-davide-botto-73hze) — 2026-09-28 (in Italian)
- [Every paid tool should pay for itself: in time saved, work brought in-house and errors avoided (Week 39/2026)](https://it.linkedin.com/pulse/ogni-strumento-pagamento-dovrebbe-ripagarsi-da-solo-tempo-botto-opyle) — 2026-09-21 (in Italian)
- [The bottleneck has shifted from production to verification (Week 38/2026)](https://it.linkedin.com/pulse/il-collo-di-bottiglia-si-%C3%A8-spostato-dalla-produzione-alla-botto-lytce) — 2026-09-14 (in Italian)
- [Disagreement is an asset, and you are not budgeting for it (Week 37/2026)](https://it.linkedin.com/pulse/il-disaccordo-%C3%A8-un-asset-e-non-lo-state-mettendo-budget-davide-botto-jwzae) — 2026-09-07 (in Italian)
- ["Chinese models" is not a procurement category (Week 36/2026)](https://it.linkedin.com/pulse/modelli-cinesi-non-%C3%A8-una-categoria-dacquisto-week-36-2026-botto-o4thf) — 2026-08-31 (in Italian)
- [The competitive advantage is not in the model but in what you write (Week 35/2026)](https://it.linkedin.com/pulse/il-vantaggio-competitivo-non-%C3%A8-nel-modello-quello-che-davide-botto-simsf) — 2026-08-24 (in Italian)
- [The invisible lever in AI contracts (Week 34/2026)](https://it.linkedin.com/pulse/la-leva-invisibile-nei-contratti-di-ia-week-342026-davide-botto-deycf) — 2026-08-17 (in Italian)

## Latest posts (LinkedIn)
- [Agenti AI, il rischio è nel perimetro: cosa insegnano gli ultimi incidenti](https://it.linkedin.com/posts/davidebotto_agenti-ai-il-rischio-%C3%A8-nel-perimetro-cosa-activity-7522946363677016064-I5AF) — 2026-11-02 (in Italian)
- [Il modello non l'ha scritto nessuno. Il collaudo, però, tocca a voi (Week 45/2026)](https://it.linkedin.com/posts/davidebotto_il-modello-non-lha-scritto-nessuno-il-collaudo-activity-7522935637256253440-XT_r) — 2026-11-02 (in Italian)
- [Oxygen Forensics, il caso USA riapre il rischio supply chain nel software critico](https://it.linkedin.com/posts/davidebotto_oxygen-forensics-il-caso-usa-riapre-il-rischio-activity-7521858945007718400-s3Tf) — 2026-10-30 (in Italian)
- [Cari amici e colleghi, oggi, nella seconda pillola, parliamo di RAG. Commenti sempre ben accetti. Buona giornata a tutti!](https://it.linkedin.com/posts/davidebotto_cari-amici-e-colleghi-oggi-nella-seconda-activity-7521480460544188416-Jxyj) — 2026-10-29 (in Italian)
- [Sicurezza per agentic AI: la gestione dei dati cloud](https://it.linkedin.com/posts/davidebotto_sicurezza-per-agentic-ai-la-gestione-dei-activity-7521133917786021888-FXJ-) — 2026-10-28 (in Italian)
- [Trattamenti per finalità di Polizia: come governare la circolazione dei dati](https://it.linkedin.com/posts/davidebotto_trattamenti-per-finalit%C3%A0-di-polizia-come-activity-7520771280321818624-Ovxm) — 2026-10-27 (in Italian)
- [Microsoft Digital Defense Report 2026: l’AI accelera gli attacchi e amplia il perimetro](https://it.linkedin.com/posts/davidebotto_microsoft-digital-defense-report-2026-l-activity-7520408896260435968-Eoxf) — 2026-10-26 (in Italian)
- [Cosa faccio come AI strategist. E perché non sono io che scelgo il modello (Week 44/2026)](https://it.linkedin.com/posts/davidebotto_cosa-faccio-come-ai-strategist-e-perch%C3%A9-activity-7520397485400522752-46jX) — 2026-10-26 (in Italian)
- [Cosa fa davvero un AI strategist](https://it.linkedin.com/posts/davidebotto_cosa-fa-davvero-un-ai-strategist-activity-7520476292501204992-Lb_P) — 2026-10-26 (in Italian)
- [Agenti di OpenAI: nascoste le attività di hacking nelle violazioni governative USA](https://it.linkedin.com/posts/davidebotto_agenti-di-openai-nascoste-le-attivit%C3%A0-di-activity-7519306376108634112-h_Qg) — 2026-10-23 (in Italian)
- [Cari amici e colleghi, voglio inaugurare un modo diverso con](https://it.linkedin.com/posts/davidebotto_cari-amici-e-colleghi-voglio-inaugurare-activity-7518934682080796674-S3Ge) — 2026-10-22 (in Italian)
- [Scaling satellite connectivity: why interoperability matters for NTN’s next phase](https://it.linkedin.com/posts/davidebotto_scaling-satellite-connectivity-why-interoperability-activity-7518581352057999360-QN-p) — 2026-10-21

## Optional
- [Privacy notice (IT)](https://www.davidebotto.com/privacy) · [Privacy notice (EN)](https://www.davidebotto.com/privacy/en)
- [Full text version](https://www.davidebotto.com/llms-full.txt)