Compliance
What an AI governance readiness check actually looks at
A readiness check shows where your current practice stands against the expectations that apply to you. It is a gap analysis. It is not an audit, and it does not certify anything.
Why the wording matters
People often use “audit”, “assessment” and “certification” as if they were interchangeable. They are not, and the difference is not cosmetic. An audit or a certification is a formal outcome from an independent party against defined criteria. A readiness check is something you commission for yourself, to learn where the gaps are before anyone else asks.
That is also its limit. A readiness check does not tell you that you comply. It tells you what to work on and in what order.
What gets examined
The details depend on the organisation, but a gap report normally covers the same handful of areas.
- Where AI is used. An inventory of tools and uses, including ones teams adopted informally.
- Policy and accountability. Whether there is a written position on AI use, and a named person who owns each use.
- Data handling. What data goes into which system, where it is processed, and who can see it.
- Human oversight. Where a person reviews an AI output before it is acted on, and how that is recorded.
- Monitoring and incidents. How you would notice a problem, and what you would do about it.
- Third parties. Which vendors and models you depend on, and what you know about them.
How frameworks are used
A readiness check is measured against reference points. For organisations in Singapore and Malaysia, these are typically expectations from MAS and BNM, alongside international frameworks such as the NIST AI Risk Management Framework.
These documents are not all the same kind of thing. Some are binding requirements, some are supervisory expectations and some, like the NIST framework, are voluntary guidance. A useful report is clear about which is which, so that you can decide what is mandatory for you and what is good practice.
The documents also change. For that reason the report should name the version of each reference it used.
What you receive
- A written gap report that sets current practice against the references used.
- A prioritised list of actions, so you know what to do first.
- A walkthrough with your team, so the findings are understood and not only delivered.
A check of this kind usually takes about three weeks and needs your AI policies, an inventory of AI use, and a few short interviews. Confirm duration and inputs before publishing.
What to do with it
The report is an input to your own governance process. It can support a conversation with your board, your risk committee or your regulator, but it does not replace that conversation or your own judgement.
If you want to see what a report would cover for your organisation, you can read about the readiness check or book a short call.
James Ma runs Maandoh, which deploys private and air-gapped AI for regulated organisations in Singapore and Malaysia. He has more than 15 years of experience in fintech and secure software engineering and is the author of three books.