Independent expertise. Informed decisions.

A wider view. A clear way forward.

ICT, cyber security and AI expertise that connects strategic priorities, technical evidence and practical action.

A track record of delivering reliable systems and lasting business value in complex, regulated environments.

A personal commitment

Build trust. Innovate with heart.

Explore the expertise

Domen Verdnik · Phi Savjetovanje, Zagreb

30+years of professional experience
50+expert engagements concerning cybercrime, security incidents and ISMS
80+EU projects evaluated
How I work

A clear route from question to action.

Start with the decision that needs to be made. Build the evidence needed to make it well.

  1. Define the question

    Clarify the objective, context, stakeholders and decision criteria.

  2. Examine the evidence

    Review the facts, test assumptions and identify material gaps and risks.

  3. Form a position

    Set out the options, trade-offs and a reasoned recommendation.

  4. Make it actionable

    Agree priorities, responsibilities and the conditions for progress.

Areas of expertise

From the strategic question to the evidence.

Specialist expertise for decisions that need both a broad view and a detailed understanding of technology, risk and accountability.

ICT strategy & enterprise architecture

Align technology with business priorities. Clarify stalled implementations.TOGAF · enterprise architecture · EIRA · public-service interoperability

Assess the current environment, define a coherent target architecture and establish a realistic path for change. Connect investment, governance and delivery to the organisation’s objectives. When implementation stalls, clarify responsibilities, risks and acceptance criteria.

Explore this service
Possible outputs
  • ICT strategy with clear priorities
  • Target architecture and transformation roadmap
  • Options assessment and reasoned recommendation
  • Implementation and acceptance review with proposed actions

Cyber security & operational resilience

Understand exposure. Strengthen the ability to respond.NIS2 · national cyber security requirements · ISO/IEC 27001 · information security management · NIST CSF 2.0 · cyber risk · CER · critical-entity resilience, where applicable

Evaluate security governance, critical dependencies and operational readiness. Turn findings into prioritised measures with clear ownership and practical acceptance criteria.

Explore this service
Possible outputs
  • Security and risk assessment with prioritised findings
  • Resilience and continuity review
  • Remediation plan with responsibilities and verification criteria

AI & data governance

Make AI useful, accountable and fit for purpose.AI Act · AI roles, risk and oversight · GDPR · personal data · Data Act · data access and use, where applicable

Assess AI opportunities alongside data quality, architecture, security and governance requirements. Establish the conditions for responsible adoption and measurable business value.

Explore this service
Possible outputs
  • AI use-case assessment and adoption priorities
  • Data and AI governance recommendations
  • Adoption and oversight framework

Personal data protection & external DPO

Connect data protection with everyday decisions.

Provide external DPO services or focused data protection advisory. Review processing risks, documentation and oversight, connecting GDPR requirements with technical systems and operational practice.

Explore this service
Possible outputs
  • External DPO role with agreed working arrangements
  • Data protection review with prioritised recommendations
  • Oversight and reporting approach with clear responsibilities

IT procurement, contracts & suppliers

Translate requirements into workable obligations.DORA · financial-sector ICT risk and contracts, where applicable

Examine service scope, contractual responsibilities, service levels and supplier performance. Support decisions on procurement, acceptance, transition and exit with a clear view of delivery and operational risk.

Explore this service
Possible outputs
  • Requirements review and procurement recommendations
  • Contract and SLA risk review with proposed amendments
  • Supplier governance and service-performance recommendations

EU project & innovation evaluation

Assess innovation against explicit criteria and evidence.

Evaluate research and innovation proposals against the applicable call and programme criteria. Bring evaluator, rapporteur and jury experience to evidence-based assessment and clear reasoning.

Explore this service
Possible outputs
  • Criterion-by-criterion assessment and scoring
  • Reasoned evaluator or rapporteur report
  • Innovation and investment-readiness gap assessment

Expert opinions & digital forensics

Establish the facts behind a technical question.

Provide structured technical analysis, expert opinions and digital forensic examination in ICT and cyber security matters. Explain the evidence, assumptions and limits in terms that support informed decisions.

Explore this service
Possible outputs
  • Expert opinion with evidence and reasoning
  • Analysis of digital evidence and its limitations
  • Responses to the defined technical questions
Selected experience

Experience put into practice.

Examples from Domen Verdnik’s professional experience, including earlier roles.

Case study

CIP4SI — connecting research and industrial delivery

Critical Infrastructure Protection for Smart Industries

EU co-funded portfolio · Selected experience at InfoDom · 2021–2023

Projects in the portfolio
4
Experts and researchers
50+

The challenge

Bring academic research and industrial development together across four projects for critical-infrastructure protection, while maintaining continuity through contracting delays.

My role

Portfolio Director and InfoDom Board Member for Technology and Data (CTDO), responsible for priorities, resources, risks and partner coordination.

The work

Established shared governance and clear responsibilities, aligned plans and resources, and introduced common data definitions, staged quality reviews and early interface testing.

The result

Maintained team and partner continuity. Communication between components was tested before final modules were ready, allowing integration issues to be identified earlier.

Portfolio delivery

CEKOM — eight projects

At InfoDom, I directed the EU-funded CEKOM portfolio of eight projects through final approval and production deployment, with board-level responsibility for risk, resources and partner coordination.

Data protection

Europlakat — part of the JCDecaux Group

For 10 years, I have served as external Data Protection Officer (DPO) for Europlakat.

Public-sector systems

From architecture to implementation

I developed IT strategies and enterprise architectures for Croatian ministries. In a government advisory role, I led implementation of the SCF management information system.

Security and expert assessment

Technical questions grounded in evidence

I have led more than 50 expert engagements concerning cybercrime, security incidents and information security management. I am a court-appointed expert in ICT and cyber security.

Professional references

Selected summaries of reference letters covering professional work, including earlier roles.

European Health and Digital Executive Agency (HaDEA)

Reference letter ·

HaDEA recognises professionalism, impartiality, reliability and expertise in external expert work for the European Commission. Assignments in 2023–2025 included proposal evaluation, consensus reporting and quality checks.

Nova Ljubljanska banka (NLB)

Reference from the Chairman of the Supervisory Board ·

The recommendation recognises leadership, ICT and information security expertise, clear communication and the ability to put strategy into practice. It draws on earlier collaboration at Eon and subsequent technology initiatives.

Research and Innovation Foundation (RIF), Cyprus

Reference letter ·

The reference recognises professionalism, impartiality and subject-matter expertise. I have worked continuously with RIF as an external expert and evaluator since 2024, on projects under RESEARCH IN ENTERPRISES 2023, DISRUPT and PRE-SEED.

Reference details and further recommendations

European Health and Digital Executive Agency (HaDEA) · 20.10.2025.

The letter confirms external expert assignments in 2023–2025, initially managed by the European Research Executive Agency (REA) and subsequently by HaDEA.

Nova Ljubljanska banka (NLB) · 12.12.2022.

The reference was provided by the Chairman of the Supervisory Board of NLB. It draws on direct collaboration at Eon in 2000–2002, when I was co-owner and Chief Technology Officer, and on subsequent technology initiatives and continued professional contact.

Family and Childcare Centre (KMOP) · engagement in October 2025

An undated reference concerns the proposal Systemic Tools for Detecting and Disrupting Youth Poly-Victimization Pathways (SAPPHIRE). The independent review was arranged through the Transnational Network of National Contact Points for Widening Participation and Strengthening the European Research Area (NCP_WIDERA.NET), before the official Horizon Europe evaluation.

Research and Innovation Foundation (RIF), Cyprus · 30.10.2025.

RIF confirms external expert and evaluator assignments, including DISRUPT programme jury membership and on-site scientific evaluations. The letter recognises professionalism, impartiality and subject-matter expertise. My continuous work with RIF since 2024 includes projects under RESEARCH IN ENTERPRISES 2023, DISRUPT and PRE-SEED — Creation and Initial Development of STARTUPs with International Orientation.

PECB · 2025 examiner assessment

The assessment for 08.01.2025.–31.12.2025. records expectations met in all six categories. The overall commentary describes performance as exceeding expectations, highlighting availability and useful feedback in the grading process. A recommendation dated 14.06.2022. also records examiner work since November 2017.

These references concern personal professional work in the roles and periods stated.

Selected publication

Razvoj konkurentske prednosti u Digital & AI eri

A co-authored professional article connecting business priorities, AI and data governance, and human oversight.

InfoDom · Kontroling Financije Menadžment, December 2025, pp. 42–48.

The way we work together

Balance in collaboration.

Every engagement starts with listening: understanding your context, priorities and constraints. Independent expertise brings evidence and a wider perspective. Through open dialogue, we make the options and trade-offs explicit and agree a proportionate way forward.

Your context

Priorities, constraints and ambition.

Independent expertise

Evidence, options and judgement.

A clear decision. A practical next step.

Domen Verdnik

Domen Verdnik

Technology & Innovation Leader | Strategic Adviser

LinkedIn
About me

Technical depth. Executive perspective.

A physicist by education, with more than 30 years of experience in ICT, cyber security, management and digital transformation. Experience as an IT director and board member informs an approach grounded in both technical detail and organisational responsibility.

My work spans strategic advisory, expert analysis, audit and the evaluation of research and innovation. The aim is consistent: establish what the evidence supports and make the next decision clear.

The digital golden ratio

Balance functionality and security to enable innovation, build trust and create lasting business value.

  • EU project evaluator and rapporteur · EIC jury member · RIF evaluator
  • ISO/IEC auditor and examiner
  • Court-appointed expert in ICT and cyber security
Professional qualifications

Experience supported by specialist qualifications.

A selection spanning governance, architecture, security and portfolio leadership.

Portfolio leadership

IPMA Level A – Certified Portfolio Director

IT governance

ISO/IEC 38500 Senior Lead IT Corporate Governance Manager

Information security

ISO/IEC 27001 Master (Senior Lead Auditor & Implementer)

Cyber security

ISO/IEC 27032 Senior Lead Cybersecurity Manager

Professional membership

ISACA · Gold level

Member since

Start a conversation

What problem are you facing?

Describe the problem, its context and what you would like to achieve. Together, we can define the scope and a useful next step.

A clear starting point
The first conversation clarifies your problem, the intended outcome, the available evidence and the possible scope of work. We agree the next step together.

Email
Based in
Zagreb, Croatia

Based in Zagreb. Working in English, Slovenian and Croatian.

Direct enquiry

Tell me what you are working on.

A short outline is enough to start the conversation.

Keep confidential case details and other people’s personal data for an agreed direct exchange.

Your enquiry is received here and forwarded to Phi. Your email is needed so Domen can reply.

Experience supported by specialist qualifications.

Qualifications listed in the professional profile

Certifications

IPMA Level A – Certified Portfolio Director
Portfolio leadership
IPMA official register

Search by certificate number, or enter Domen Verdnik and select Certified Portfolio Director.

Certificate number: A-25

ISO/IEC 38500 Senior Lead IT Corporate Governance Manager
IT governance
PECB certificate verification

Enter first name Domen, last name Verdnik and the certificate number below.

Certificate number: ITCGSLM1005812-2025-04

ISO/IEC 27001 Master (Senior Lead Auditor & Implementer)
Information security
PECB certificate verification

Enter first name Domen, last name Verdnik and the certificate number below.

Certificate number: ISMA1005812-2024-04

ISO/IEC 27032 Senior Lead Cybersecurity Manager
Cyber security
PECB certificate verification

Enter first name Domen, last name Verdnik and the certificate number below.

Certificate number: CSSLM1005812-2024-09

Open CA Distinguished Architect
Enterprise architecture
Certified DPO
Data protection
PECB certificate verification

Enter first name Domen, last name Verdnik and the certificate number below.

Certificate number: DPCDPO1005812-2023-11

Professional appointments

Professional membership

ISACA · Gold level

Member since

Privacy

Updated: 01.11.2026.

Controller and contact. Phi Savjetovanje, Zagreb (registered as PHI SAVJETOVANJE, obrt za poslovne usluge, vl. Domen Verdnik), Ilica 47, 10000 Zagreb, Croatia, is responsible for the business enquiries it receives. For privacy questions or requests, write to domen@phi.com.hr.

Submitting an enquiry. All enquiry buttons open the same editable form. When you choose Send enquiry, this website receives your email address and message, together with any optional name and topic, and stores an encrypted copy while awaiting forwarding. A private Google Workspace service forwards it to Phi and uses your address for replies. If you select “Send me a copy”, the same enquiry is also sent to your entered email address as a Cc copy. The confirmation on this page means the enquiry has been received by the website. You can also copy your enquiry. Message contents are not written to application logs.

AI assistance. Phi Assistant uses OpenAI to explain the published services and experience, discuss your initial question and help prepare an enquiry. Opening the written conversation does not send a question. Written questions and the recent conversation are sent through this website’s server to OpenAI when you choose Ask Phi. The assistant is AI, not Domen, and its replies may be inaccurate. Selected references link to approved public website content. The visible conversation and drafts stay in page memory; this website does not save a conversation history. Resetting the conversation or reloading the page clears that local history.

Briefs and AI-adoption orientation. Choosing Prepare a brief sends the recent conversation and any current question draft to OpenAI to create an editable outline. The separate AI-adoption exercise sends your five answers to OpenAI only when you request the orientation result. The output distinguishes your stated situation from open questions, a proposed agenda and an optional additional suggestion. It is preparation for a first discussion, not a professional assessment. You can review and edit the text, copy it or download it as a text file. You can also reveal the conversation transcript and review, edit, copy or download it locally; it includes AI replies and may contain mistakes. Preparing or downloading a result does not send an email. To contact Phi, you choose to use it in the separate enquiry form, review that form and explicitly send it.

Voice choices, spoken replies and dictation. Opening Phi Assistant shows a small, silent choice of writing or voice; it does not start the microphone or play a greeting. Only choosing Talk by voice plays the prepared AI-generated welcome and requests browser permission for the microphone. The microphone track stays muted during the welcome. You can choose Continue by typing, or make a recognised spoken request to switch, at any time. This stops voice and the microphone before opening the written panel; the draft and transcript remain in page memory. These choices are remembered only on the current page. Reading written replies aloud is optional and starts only when you enable it or choose a reply’s playback control. The alternative turn-based mode sends each recording to OpenAI for transcription and sends the resulting text to the assistant. It stops the microphone while preparing and playing the reply and allows eight questions of up to 45 seconds each. Separate dictation transcribes a recording for your review; you choose Ask Phi to submit the resulting text.

Realtime voice conversation. After permission, the connection can be prepared during the introduction. Your speech is streamed from the browser to OpenAI over WebRTC only after the introduction ends and the connection is ready. The listening indicator shows when you can speak. The microphone remains active during replies so you can interrupt them. If no first spoken input is detected after 30 seconds of active listening, the microphone stops and the written conversation opens so you can continue by typing. This initial check pauses during blocked playback and ends on the first detected speech; later pauses do not switch modes. Without microphone permission or a usable connection, voice also stops and the written conversation opens. The browser ends the call after three minutes from the start of listening or twelve replies. End, close, hiding or leaving the page also stops the microphone and playback. Ending the call does not delete data already processed by OpenAI.

Session and retention. Audio cached for replay is held only in page memory and cleared on close, reset or page exit. Voice choices are kept only for the current page. The assistant uses an essential, signed session cookie for up to eight hours and limited usage counters to control API use. Counters contain no message text or audio. Separate daily totals of API calls and available provider-reported token counts contain no visitor identifiers. Aggregate records older than 90 days are removed on the next usage-processing run. Your explicit language choice is remembered in the functional phi_language cookie for up to one year. It contains only the language code and is not used for tracking. You can change the choice using the language selector or remove the cookie in your browser. OpenAI applies its own API processing and retention arrangements; the provider notices below provide further information.

Your information. Contact is voluntary. An email address and message are required for direct submission so we can consider your request and reply. Your name and the topic are optional. Keep confidential case material and other people’s personal data for an agreed direct exchange.

Purpose and legal basis. Contact details and messages are used to respond, clarify the request and consider an engagement. Where you seek a contract on your own behalf, processing is necessary for steps at your request before entering into a contract (GDPR Article 6(1)(b)). Other professional correspondence, including contact on behalf of an organisation, is based on the legitimate interest in responding to relevant business enquiries (Article 6(1)(f)). Records may also be kept to meet legal obligations (Article 6(1)(c)). Enquiries are not added to automated marketing lists or used for automated decision-making.

Providers and website access. Google Workspace processes the enquiry for email delivery, and the receiving email provider processes the delivered message. This site is hosted through OpenAI Sites using Cloudflare infrastructure. Hosting providers may process IP addresses, browser and request information and, where sign-in is required, account information for operation, security and access control. Limited usage counters and submission identifiers, payload digests, timestamps and sending states are used to prevent abuse and duplicate sending. These records contain no message text or contact details. No advertising or audience-tracking tools have been added to this website.

Retention. Queued content is cleared after Google confirms the sending hand-off. Content older than 24 hours is cleared on the next processing run, including content retained after an uncertain sending outcome. Technical submission records older than 72 hours are removed on the next submission or processing run. Correspondence received by email is kept while needed to handle the enquiry and any resulting engagement, and longer where necessary for legal record-keeping or legal claims. Hosting and email providers also apply their own disclosed retention arrangements.

Your rights. Subject to GDPR conditions, you may request access, correction, erasure, restriction or portability of your data and object to processing based on legitimate interests. For Phi’s handling of enquiries, contact domen@phi.com.hr. You may complain to the Croatian Personal Data Protection Agency (AZOP), azop@azop.hr, or another competent supervisory authority. Account and platform requests can also be addressed to the relevant provider.

International processing. Google Workspace, hosting and receiving email services may involve processing outside the European Economic Area. The sending service operates under Phi’s Google Workspace account and its applicable service arrangements. The provider notices below explain their processing and transfer arrangements. Further information about a Phi enquiry is available at domen@phi.com.hr.

Phi Assistant

An AI assistant for Phi’s services and approach. Messages and optional recordings are processed by OpenAI. AI-generated speech is optional. Keep confidential case details for a direct conversation with Domen.

What would you like to explore?

Describe the problem you are facing or ask a question. We can clarify the next step and prepare an editable enquiry. You review and send it separately.

    How would you like to talk?

    Choose writing or a voice conversation. Either way, we can clarify your needs.

    Voice uses your microphone. You can switch to writing at any time.

    AI assistant · Conversation processed by OpenAI

    Your question goes to the AI assistant. Up to 1,600 characters.

    Voice conversation or dictation
    Microphone mode

    Start and allow microphone access to talk directly with the AI. You can interrupt its reply. The microphone remains active during the conversation. Ends after three minutes; End stops it at any time. This does not send an email.

    Share Phi

    Scan the QR code to open this website on another device, or copy the link to share it.

    QR code for https://www.phi.com.hr/