Quillmarrow Supplies Pte. Ltd. (fictional), an office-supplies distributor and online store with about 80 staff, a Singapore head office and a Malaysia fulfilment partner.

AI and data governance from someone who builds the controls, not just the policies.

Why this review was commissioned

Staff were using ChatGPT and Microsoft 365 Copilot without clear rules. The helpdesk vendor switched on an AI reply-drafting feature. Purchasing was piloting an agent that can email purchase orders to suppliers. HR proposed a CV-screening service. A large enterprise customer sent a supplier AI questionnaire, and the company had just appointed its own Data Protection Officer. Management wanted to know what its AI may do, and who approves it.

Decisions this supports

• Which AI uses to approve, restrict or pause.
• What information staff may put into each tool.
• When a person must check an output or approve an action.
• What an agent may read, change or send, and what it must never do.
• Which supplier questions need answers before you proceed.
• Who owns each risk, control and follow-up action.

Where each decision is answered

The pack at a glance

These are counts of what the sample documents contain. They are not results, savings or outcomes.

What is in this pack

What this pack shows

• One register, owned. All 20 AI uses in one place, each with a named owner role, a working risk tier with its rationale, the human check that applies, the evidence still missing and the event that forces a re-review (A2, A3).
• Rules staff can follow. What information may go into which tool, what is restricted or not permitted, and how to report a problem (A4).
• People in control of agents. For the supplier reorder agent, which can email purchase orders, the pack sets who approves before it acts, what is monitored while it runs, the stop conditions and who can halt it, and the audit trail that proves each step (A6, A7, AIA-02).
• Missing evidence left visible. Vendor answers are recorded as Evidence provided, Partial or Not provided, and gaps become dated follow-up actions rather than assumptions (A8, A9).
• Decisions, not just findings. Five findings, decisions needed with a recommendation and owner, and a 30/60/90-day plan where each action names its closure evidence (A9).

How to read this pack

1. Start with the management report (A9): the executive summary, the five findings, the decisions needed and the 30/60/90-day plan.
2. Check the register (A2) for any use you care about, then the tiering method (A3) for why it sits in its tier.
3. For the agent that can email purchase orders, read AIA-02 (A5) with the oversight matrix (A6) and the permissions and audit-trail specification (A7).
4. For supplier gaps, read the vendor questionnaire (A8).
5. Give staff the AI-use policy (A4) once the Managing Director approves it.

Approvals and status

The reviewer signs off each deliverable before issue. Quillmarrow's management makes and records the decisions.

After the review

• Owner. The COO owns the register and the action plan; each use has an owner role in A2.
• Re-review triggers. A new tool or vendor feature, a change in permissions, a new data category, an incident, or a vendor change of terms puts a use back through A3.
• Cadence. Tier 3 uses are reviewed quarterly, Tier 2 every six months and Tier 1 annually.
• What is not included. Legal advice, certification or a compliance guarantee, AI Verify technical testing, penetration testing or security engineering, and changes to live systems, unless separately scoped. No healthcare-sector work or on-site delivery. The full list is at the end of every document.

What Quillmarrow supplied

• Role holders for interviews: the COO, the Head of Operations (the appointed DPO), the Head of Customer Service, the Purchasing Lead, the HR Manager, the Head of Marketing, the IT Manager and the Finance Director.
• System and licence lists, the helpdesk and reorder-agent settings screens (client-reported), vendor documents received to date, and the enterprise customer's supplier AI questionnaire.
• Workflow walk-throughs using descriptions and made-up or de-identified samples. No customer, staff or supplier records were provided or needed.

Limits of this pack

• Settings and usage are client-reported unless an evidence item is marked Complete in A2 or Evidence provided in A8.
• No AI Verify technical tests, model testing or security testing were run; the mapping covers principles and process checks only.
• Legal questions, such as vendor contract terms or the basis for using personal data, are flagged for a Singapore-qualified lawyer and are not answered here.
• Missing evidence is listed, owned and dated in A8 and the A9 action plan rather than assumed.

Reference frameworks used

• Model AI Governance Framework, Second Edition (PDPC and IMDA, January 2020).
• Model AI Governance Framework for Generative AI (IMDA and AI Verify Foundation, May 2024).
• PDPC Advisory Guidelines on Use of Personal Data in AI Recommendation and Decision Systems (March 2024).
• Model AI Governance Framework for Agentic AI (IMDA, January 2026), a voluntary framework.
• AI Verify testing framework, 11 principles. The pack maps to the principles and process checks only; no AI Verify technical tests were run.
• ISO/IEC 42001:2023, used only for the optional readiness excerpt (A10). Readiness is not certification.
• Personal Data Protection Act 2012, named where personal data is involved. Legal questions go to a Singapore-qualified lawyer.

How the pack was prepared

About two weeks, fully remote, working from descriptions, system lists and made-up or de-identified samples. No client personal data was put into AI tools. Review rounds are a set number agreed in the quote.

Prepared by Alex Lew (CFA, AIGP, CIPP/A, FIP), reviewer and sign-off. I personally review and sign off every deliverable.

Quillmarrow appoints its own Data Protection Officer. You appoint your own DPO. I support them.