I review how your business uses AI, then turn the findings into staff rules, risk assessments and explicit decisions about human control. The review covers AI assistants, vendor features and agents, not just models your business has built itself.

This is my lead service for Singapore SMEs outside healthcare. You can book it on its own or alongside the PDPA programme. All work is remote.

My background is in AI governance, product and tech delivery in payments, fintech and healthtech. My services are for businesses outside the healthcare sector.

AI helps with the draft. I own the sign-off.

I personally review and sign off every deliverable.

• Which AI uses to approve, restrict or pause.
• What information staff may put into each tool.
• When a person must check an output or approve an action.
• What an agent may read, change or send, and what it must never do.
• Which supplier questions need answers before you proceed.
• Who owns each risk, control and follow-up action.

• AI use register. A record of each agreed use, its purpose, business owner, tool or vendor, information handled, permissions and review triggers.
• Practical risk tiering. An assessment of potential harm, personal data, autonomy and reversibility. The tiers are working categories for your business, not statutory classifications.
• AI-use policy. Staff rules covering approved tools, permitted inputs, output checks, prohibited uses and escalation.
• AI impact assessments. Written assessments for the uses agreed in scope, recording who may be affected, what could go wrong, proposed controls and unresolved decisions.
• Human oversight decision matrix. Where someone must approve before an action, monitor use or intervene, with named responsibilities.
• Vendor and model due diligence. Questions and findings on data use, training settings, data location, security, contract information and model documentation. Missing evidence stays visible.
• Agent governance checklist. Permissions, approval gates, write-action records, stop conditions and escalation routes for the agent uses in scope.
• Management report and action plan. The priority findings, decisions needed, owners and evidence to collect before closing an action.

An optional ISO/IEC 42001 readiness check can be added to the scope. It identifies documentation and control gaps; it does not provide certification.

I map the review to the Model AI Governance Framework, Second Edition, released in January 2020. Its four areas are internal governance structures and measures; human involvement in AI-augmented decisions; operations management; and stakeholder interaction and communication.

Its human-in-the-loop, human-over-the-loop and human-out-of-the-loop terms help describe the oversight arrangement. I consider the nature and reversibility of harm when deciding what to recommend, rather than treating one arrangement as right for every use.

For generative AI, I also use the Model AI Governance Framework for Generative AI, released by IMDA and the AI Verify Foundation in May 2024. Where personal data is involved, I use the PDPC's March 2024 Advisory Guidelines on Use of Personal Data in AI Recommendation and Decision Systems as a reference.

AI Verify combines technical tests with process checks across 11 principles. This review maps to its principles and process checks; running technical tests is not included unless separately scoped.

ISO/IEC 42001:2023 is the international standard for AI management systems. Certification is voluntary and carried out by independent certification bodies, not ISO; readiness work is not certification.

For agents that can take actions, I use IMDA's Model AI Governance Framework for Agentic AI (2026). It is voluntary guidance built around four points: assess and bound the risks upfront, make humans meaningfully accountable, put technical controls and processes in place, and enable end users to take responsibility.

• Legal advice, legal opinions on vendor terms or regulatory representation.
• AI Verify technical testing, model benchmarking, penetration testing or security engineering, unless the relevant work is separately scoped.
• Building an AI system, implementing integrations or changing live permissions and configurations.
• Certification, a compliance guarantee or an assurance that a model cannot fail.
• An organisation-wide ISO/IEC 42001 readiness engagement unless expressly included in the quote.
• Healthcare-sector work or on-site delivery.

I need a list of AI tools, vendor AI features and agent workflows, including informal uses you want brought into scope. For each, I need its purpose, owner, information categories, permissions and the decisions it influences.

Please provide relevant policies, vendor terms, settings and security or model documentation through the sharing arrangement we agree. I also need your team to confirm how the workflow actually works and approve the resulting decisions.

I work from descriptions, system lists and made-up or de-identified samples. I do not put client personal data into AI tools or need a copy of your customer database.

Allow about two weeks. The main drivers are the number and complexity of AI uses, agent permissions, supplier evidence, existing documentation, impact assessments in scope and your review process.

I confirm the scope, dependencies and fixed price after a free intro call or remote coffee chat. Any extra work is quoted before it starts.

Review rounds: a set number agreed in the quote.