When AI writes the code, who keeps an eye on quality?
I've been building test automation for fifteen years, mostly at insurers, banks and government. These days AI writes a lot of the code. So I help teams set up their agents, put a review step on what those agents produce, and keep the paper trail your auditor still wants to see.
Four things I work on to keep quality under control.
Every job touches all four. Some need more of one, some more of another. I keep it practical: what works for your team, and what keeps working after I'm gone.
A test setup that survives when people leave.
Every test traces back to an acceptance criterion. Every feature gets a coverage matrix, so you see at a glance what's tested and what isn't. I call this Language-First: specs, scenarios and tests all read like plain language. It works the same in Cypress and Playwright. And because it's written down this clearly, AI agents can follow the same rules. That's how quality stays up, even when the original team has long moved on.
AI coding agents in your release pipeline.
Claude Code, Cursor or Copilot. I set up the agents, the AGENTS.md, the slash commands and the review gates inside your own repo. They run in your repo and your CI. Your code doesn't go anywhere else.
An audit trail from day one.
DORA, GDPR, NIS2, ISO/IEC 25010, TMMi. Every change links back to an acceptance criterion, and every gate is written down. So when an inspector or internal audit asks why something went live, you can simply show them.
Quality in euros.
What does a bug in production actually cost you? And what does a green pipeline save? I make those costs visible in one report that your CFO and your auditor can both read. From a recent job: regression research went from 40 hours per release to 6. The first green pipeline on the agent flow was there in week 3. Want to dig into the money side? Have a look at QualityProfit →
Where I've done this work.
A selection. Same approach, very different places: from a worldwide government rollout to a SaaS product I'm building on my own.
Solo SaaS, four agents.
Founder · Full-stack with Claude Code
A dashboard customers host themselves. It pulls signals from Jira, Azure DevOps, GitHub and GitLab and works out what QA is worth to you in money. Four agents live in the repo: release-reviewer, deploy-monitor, onboarding-smoke-tester and requirements-guard.
Their AI test stack, ready to reuse.
Architecture · Framework · Claude Code skill
For a Dutch digital agency I built a Playwright architecture, a framework and a Claude Code skill. It's meant for every client they have now or will have later, so it fits into any project. The skill knows their conventions: project structure, Page Objects, traceability from AC to test, and a coverage matrix per feature. Now any developer on the team can deliver a solid test suite through that one skill.
Rolling out a quality framework.
Quality Assurance Manager
A Quality Framework based on TMMi and ISO/IEC 25010, built into the release pipelines of a national utility. We express quality maturity in money, and the traceability is ready for when a regulator asks.
Language-First in government.
Cypress + Playwright architecture
A test architecture across several government departments. Different tools, specs, scenarios and tests, all sharing one layer that people can actually read. I talked about it at CypressConf 2024 in "Beyond the Battle: Empowering Test Automation with a Language-First Approach". I now use that same approach when teams deliver with AI.
Built to last.
Test Automation Architect
A test architecture with Cypress, Lit Elements and Cucumber, plugged into Azure DevOps. Every change is tied to a spec, and every spec to an acceptance criterion. With solid Page Objects on top, the team kept the suite running themselves after I left. That was the whole idea.
A worldwide rollout, audited.
QA Architect & Test Manager
Test management for a rollout across the world, under ISO 25010 and TMap. Every change traceable, every gate written down, every decision something you could explain to an inspector. Before that, I worked there with Cypress, Angular and Docker in Azure DevOps.
What I share for free.
Most of my client work stays with the client. This doesn't: two orchestration templates for Playwright and Cypress, my Medium posts, and a playbook that's coming soon. Grab what you need. And if you make it better, I'd love to hear about it.
orchestration-playwright-agents
A Claude Code template for Playwright E2E that you drop straight into your project. One master prompt as a skill, eight agents that each do one job, slash commands and a starter e2e/ folder. You can fit it to your repo in a day.
View on GitHub →orchestration-cypress-agents
The same idea, built for Cypress. Master prompt as a skill, eight agents, slash commands and a starter cypress/ folder, all done the Cypress way.
View on GitHub →Notes from working with AI
Longer pieces on Language-First test design, agents in your repo, and what it's really like to ship with LLMs. I'm going to write more often, see the writing roadmap.
Read on Medium →The AI-Augmented E2E Playbook
A 15-page PDF with the Language-First architecture, AGENTS.md examples, the Page Object pattern with AC/TS traceability, and the coverage matrix per feature. Three of my Medium posts put together in one document you can print.
Get notified →What actually works in a CI pipeline.
Four review gates that grew out of two years of client work. They run in my own codebase and at a handful of teams. Want to try one? Just let me know.
release-reviewer
Checks every push for risky changes: secrets in the diff, coverage dropping below the threshold, migrations that throw away data, edits to the login code. It posts a verdict on the PR with the rules that failed. It runs on every commit in my own codebase.
Email me about it →deploy-monitor
Compares the container digest in production with the image you released. That catches the sneaky gap between "CI was green" and "what's actually live".
Email me about it →onboarding-smoke-tester
Goes through the whole sign-up flow against the real API on every release. So you find out registration is broken before a customer does. It runs on its own and opens an issue when something fails.
Email me about it →requirements-guard
On every PR it holds the written spec up against the code. When what was promised and what was built drift apart, you hear it before an auditor or a customer does. Works well with spec tools like openSpec. The other three agents lean on this one.
Email me about it →Three sectors, one question that keeps coming back.
I've worked in insurance, financial services and government for fifteen years. Whether it's an auditor, a regulator or internal audit, they all ask the same thing: how do you explain AI-assisted delivery to someone who doesn't read code?
DORA is here. So is DNB.
Insurers, banks, payment platforms, asset managers. You deal with DORA, GDPR, NIS2, internal audit and third-party ICT risk, plus the regulators behind them. Dutch insurers also have DNB and AFM oversight, the Wft, Solvency II reporting and IFRS 17 reconciliation. Regulators have stopped asking whether you use AI. Soon they'll ask how you keep it under control.
Auditable from the start.
Ministries, agencies that carry out policy, government IT. Algoritmeregister, AVG, BIO, NPR 5326, the EU AI Act. You need AI-assisted delivery that holds up in front of an inspector and survives a new cabinet. Privacy and where your data lives are sorted out in the architecture itself. I learned this at RvO and the Ministry of Foreign Affairs.
More speed, and the proof to go with it.
CTOs, VPs of Engineering and Heads of QA in regulated organisations. Claude Code, Cursor and Copilot make your team faster. Your audit committee wants to see the evidence. I build the bridge between the two: a release pipeline you can defend.
Better to say it now than in week six.
Looking for a general AI vendor with no answer for the regulator, a one-off Cypress audit with no architecture behind it, or do you work in a consumer setting where "move fast and break things" is still the rule? Then I'm probably not the right person. Someone else will do that better.
The three questions your CISO, DPO and auditor ask first.
Straight answers, and I name the risks. Before the first POC, your procurement team, DPO and internal audit get the Trust & Data pack: sub-processor list, DPA, regional data-flow diagram, continuity arrangements and a security questionnaire.
Inside your repo. Inside your CI.
The agents run inside your own repository and on your own CI runners. No outside cloud holds on to your source code. You reach the AI models through your own Claude Code, Cursor or Copilot enterprise account, so your region, your DPA and your training opt-out all still apply. The sub-processor list, the flow diagram and the DPA highlights come with the engagement pack.
One architect, with a plan B.
I'm one person, so I hear you thinking: what if he drops out? That's covered. Runbooks, a named backup contractor and source-code escrow, agreed per job and signed before we start. The Trust & Data pack has the details for your type of contract.
DORA / GDPR / Wft — on one page.
A company registered with the KvK, a standard DPA, a sub-processor list and a security questionnaire (CAIQ-lite). On request there's also a one-page note in Dutch on what DORA, GDPR and the Wft mean for this work. For procurement, your DPO and internal audit.
What I bring into your repo.
Practical and a bit opinionated. I pick tools because they work well with AI, not because they're new.
15+ years across enterprise & government.
A selection. Before this I worked at ING, SBB, the Ministry of Foreign Affairs, ZLM and KPN, and I taught at The Hague University of Applied Sciences.
Practical guides on Cypress, testing and automation.
I've been writing on Medium since 2020. More than ten deep-dives on Cypress patterns, the ROI of testing and test strategy. New pieces on working with AI will show up on this site through 2026.
Pro tip: stub the window object. A hands-on walkthrough of the multi-tab problem every Cypress user runs into sooner or later.
Cross-origin testing is finally here. What changed, what to watch out for, and how to move your login flows over.
And why you should care. Where one ends and the other begins, why teams mix them up, and how to pick the right tool for the job.
On stage, on a podcast, or in your team's Slack.
Cypress.io Ambassador, conference speaker and certified trainer.
Cypress Ambassador
Active community work
Conference Speaker
CypressConf 2024 + 2025 workshops
Certified Trainer
Software testing & QA · Post-HBO didactical
Talks on YouTube
Recorded talks and workshops.
Cypress: The Bad Practices Workshop
A hands-on tour of the Cypress bad practices we keep finding in real codebases, and how to get rid of them. Together with Frits van der Sloot.
Watch on YouTube →Beyond the Battle: Empowering Test Automation with a Language-First Approach
How specs, scenarios and tests can share one layer that everyone can read, and why that makes it a lot easier to bring AI in.
Watch on YouTube →Effective Test Automation Design
The architecture choices that keep a test suite alive long after the team that wrote it has moved on. Page Objects, traceability, and the discipline to keep your test pyramid in shape.
Watch on YouTube →Hidden costs, made visible.
QualityProfit is the SaaS product I'm building on my own. It gives QA its financial language back. It's really pillar 04 turned into a product: signals from Jira, Azure DevOps, GitHub and GitLab become numbers your CFO and your auditor can both work with. The four agents above already run inside it today.
- One report for your CFO and your auditor.
- A correlation engine that links each bug to the release it came from.
- You host it yourself: your data, your servers.
Open on GitHub.
Three orchestration templates for test automation with AI. Clone one and fit it to your repo in a day.
View all repos →One hour, your release pipeline, and honest questions.
This isn't a sales call. Send me a few lines about your team, that's enough. I'll send you a short agenda back. If it's a fit, we'll take it from there. If it isn't, I'll tell you.