We check whether the risk management you already run can see the AI you already use: the models, keys, agents, vendors and AI features behind your business processes. Then we help you write what is missing into the registers, business impact analysis (BIA) and business continuity plan (BCP) you already keep. No new framework. No new committee.
Name the business processes that would stop if your main AI provider were unavailable tomorrow. Then show us the register rows that say so.
Most organisations cannot answer either straight from their records. AI arrives through doors that registers do not watch: staff using public generative AI, AI features switched on inside software you already license, and AI keys and payments that nobody recorded. Until the registers, the BIA and the BCP show these dependencies, nobody can say which process stops when an AI provider fails or changes its model.
Every regulated organisation already keeps the records this work needs. Banks, state enterprises, government agencies and listed companies all run risk management, keep continuity plans, and answer to someone who checks them: a regulator, an oversight body or an audit committee. The PDPA applies to all of them. What is new is AI inside those records, not the records themselves. Thai banking shows how close the hooks already are: BOT's IT risk rules require a complete IT asset register and continuity for third-party services, and its AI guideline asks for AI risk to be identified and monitored. For financial supervision, Singapore's MAS shows where the rules are heading, with dates.
This engagement is the assessment. Building fixes and running them are separate choices. They are quoted only after you accept the assessment, and you can take the findings to anyone.
Five steps, two lanes: what we do and what your team does. Nothing leaves your premises until you approve the report.
In short, you provide: a named sponsor, a written scope, the documents on our list ("none" is a valid answer), a risk-function delegate for the workshop, staff to run the spot checks, and time for the readout.
The first check needs no access to your systems. We view documents on your premises or through your screen share, and we take no copies. In deeper discovery, every script runs inside your environment, under your accounts, and your CISO reviews it first. Only the agreed deliverables leave, after your approval.
Our consultants do the reading and the judgement. If AI helps them search a large document set, you decide which documents it may see and where it runs, and that choice is written into the engagement letter.
