When complexity outpaces control.
Brittle integrations, unclear ownership, and architecture no one fully controls eventually become business risk. We impose structure, restore accountability, and make the system defensible.
Free · 4 minutes
How ready are you for DORA, NIS2, the EU AI Act and MiCA?
Fourteen questions against what a supervisor would actually ask you to produce. Banded finding on screen, full sheet with article references by email.
Run the ScorecardWhat We Do
Technical Leadership
Embedded Fractional CTO and senior technical direction for complex programmes. We own the decisions others avoid — architecture, vendor selection, team structure, and delivery accountability.
Architecture
Architecture that survives the people who built it. Every decision is documented, defensible, and auditable — not held in one person’s head, not buried in a slide deck. Blueprints that survive vendor changes, team turnover, and growth.
Governance
Frameworks that enforce standards across teams, vendors, and delivery cycles. Not policy documents — operational controls with measurable outcomes and clear accountability.
How We Work
Every engagement follows the same disciplined sequence. No shortcuts. No skipped phases. Structure imposed from the first day. Where a build is required, we field the team to deliver it.
Phase 1: Assess
We map the current state before touching anything. Architecture, integrations, team ownership, delivery risks, and governance gaps are documented and prioritised. The output is a clear picture of what exists, what is broken, and what needs to change — without assumptions.
Phase 2: Design
We define the target state in detail. Target architecture, integration contracts, governance model, ownership structures, and operating controls are documented before implementation begins. Every decision is defensible and traceable to a business or technical requirement.
Phase 3: Implement
Structure is put in place with discipline. Scope is controlled. Decisions are owned. Work is sequenced to reduce risk, not accelerate exposure. We do not start implementation until the design is complete and the constraints are understood.
Phase 4: Build
Where the engagement requires it, we field a delivery team. Developers, architects, and specialists operate under direct technical leadership — same standards, same governance, same accountability model. No handoff friction. No loss of control.
Phase 5: Operate
Standards, ownership, and oversight are embedded into day-to-day delivery so they outlast the engagement. Teams know what good looks like. Vendors operate within defined boundaries. Leadership has the visibility to make informed decisions without us in the room.
Free interactive tool
Interactive deadline calculator
Check which regulations apply to you and when
Regulation across the EU, UK, US and Asia-Pacific has moved considerably in the past eighteen months, and several headline dates have shifted more than once. Twelve questions, about three minutes.
Results are shown on screen — no email required. A dated summary is available to download, and can be sent on if that's more useful. What we do with your answers.
Where We Fit
We are brought in when complexity has outpaced control. Not to rebuild from scratch — but to impose structure, restore accountability, and make the system governable.
-
Systems have grown beyond their original design.
Architectural decisions made under pressure have accumulated. The codebase is difficult to reason about, onboard to, or extend without risk.
-
Integrations are brittle, fragmented, or ungoverned.
Point-to-point connections, undocumented dependencies, and no clear ownership. Changes in one place break things in five others.
-
Governance and architectural control are absent.
Teams are building without standards. Vendors are operating without oversight. Leadership lacks the visibility to make informed technical decisions.
-
Compliance obligations are unmet or undocumented.
Cookie consent is cosmetic. Accessibility is untested. Data governance frameworks are absent or unenforced. Legal exposure is accumulating quietly across the estate.
Selected Engagements
-
Public Sector — United Kingdom
Re-platformed the UK’s largest product information estate — 6M+ SKUs, 20+ user types — from a legacy CMS onto purpose-built role-specific views for clinical, procurement, logistics, and legal audiences. Zero-downtime migration on Windows infrastructure. Architectural ownership from assessment through to production.
-
Industrial Distribution — Europe
Embedded technical lead for a 100,000+ product weekly import pipeline. Consolidated fragmented search and filtering layers across four downstream systems, built MDM and taxonomy governance structures, and delivered an architecture that survived two subsequent platform changes without structural rework.
-
Professional Services — Cyprus
End-to-end client intake and matter portal: encrypted document handling, self-serve engagement letters, integrated signing, and a secure lawyer-facing document viewer. GDPR-compliant at rest and in transit. Fully owned stack — no vendor lock-in, no recurring licence dependency.
About the Practice
Sixteen Pillars exists because most complex systems are not failing for technical reasons. They are failing because no one senior enough to enforce architectural discipline is in the room when it matters.
The practice is led by Richard King, who has been accountable for enterprise systems at national scale — including ownership of the product and web estate at NHS/DHL Supply Chain — across regulated sectors in the UK, US, EU, and Cyprus. Engagements are taken personally and held to the same standard regardless of size.
Work with us.
We engage with a small number of clients at any one time. If you have a complex system, a governance gap, or a programme that needs senior technical leadership — let’s talk.
We respond to every enquiry within two business days.
richardking@sixteenpillars.com
Richard KingCTO, Sixteen Pillars
Technical Leadership · Architecture · Governance · Active since 2012
Thinking & writing
This fixes: restic ‘repository is already locked’ after a killed backup
October 16, 2026
A killed restic run leaves a lock that blocks every backup. How to confirm no live process holds it, clear the stale lock safely, and prevent overlap with flock.
The State of Post-Quantum Readiness in Financial Services: Who Is Migrating and Who Is Stalled
October 16, 2026
A realistic maturity baseline for post-quantum migration in financial services, mapping NIST, EU, UK and Canadian regulatory signals against what firms have actually built.
Automating OS Patch Windows: unattended-upgrades on Linux and PSWindowsUpdate on Windows
October 16, 2026
Apply security updates on a schedule with reboots gated to a maintenance window and reporting that tells you what happened: unattended-upgrades on Linux, PSWindowsUpdate on Windows.
Becoming a Consolidated-Tape Data Contributor: The Input Data Quality Standards
October 16, 2026
Venues and APAs feeding the EU consolidated tape must meet strict input standards. This maps the contributor requirements to concrete timestamp, reference-data and validation controls.
Long-Running API Requests Done Right: The 202 Accepted + Polling (or Callback) Pattern
October 16, 2026
Requests that take 30 seconds don’t belong on the request path. Convert a slow export endpoint into an async job: 202 Accepted, a status resource, polling, TTLs.
The State of Agentic AI in Regulated Firms: Where the Frontier Actually Sits in 2026
October 15, 2026
A sober read on agentic AI inside regulated firms in 2026: what is genuinely in production, the governance patterns supervisors now expect, and where the frontier actually sits.
The full archive. Compliance, architecture, governance, delivery.