Map it. Test it. Evidence it. Hand it over.
How an engagement actually runs, and what exists at the end of it.
Four phases, and a deliverable at each one.
No phase depends on you taking our word for it. Each ends in something your own people can inspect.
Map
We inventory what is actually deployed — systems, purpose, data, owners. Most organisations discover more AI in production than they expected.
Test
Adversarial testing against the live models: bias sweeps, prompt injection, leakage, failure modes under pressure.
Evidence
Findings written against named controls and standards, with the reproduction steps and the gap register.
Operate
The framework, the review points and the training that let your team carry it forward without us.
A control you cannot evidence is a control you do not have.
Most AI governance work produces documents. Ours produces proof — a test that ran, a failure that was reproduced, and a control that demonstrably closed it.
What we map your systems against.
Malaysian supervisors and instruments first, international standards alongside them — because your board, your regulator and your overseas customers ask different questions.
Bank Negara Malaysia
RMiT, model risk and validation, and outsourcing expectations — binding for banks and insurers.
Securities Commission Malaysia
Where capital-markets participants answer for the models behind advice and surveillance.
National Guidelines on AI Governance & Ethics
Malaysia's existing AI governance guidance (MOSTI, 2024).
National AI Office & AI Action Plan 2026–2030
The coordinating body and the national trajectory.
Personal Data Protection Act 2010
As amended in 2024 — DPO, breach notification and data portability duties.
ISO/IEC 42001
The international AI management-system standard.
NIST AI RMF
A risk-management function set widely used for AI assurance.
EU AI Act
Extraterritorial reach where outputs are used in the EU.
MITRE ATLAS
A catalogue of real adversarial techniques against AI systems.