Two countries, two rulebooks, one board agenda. For groups running India and Indonesia side by side, the rules that shape tax, data, AI and audit seldom arrive on the same clock. The Briefing is a fortnightly Wednesday series: one cross-border issue, explained in under 90 seconds in a podcast-style video, with the sources, three takeaways and one question to take to your next board meeting. This is the first issue. Ten briefings are lined up through 10 March 2027.

The first ten briefings

• Wed 4 Nov: India says 14%. Indonesia says 15%. Is anyone modelling both? (this issue)

• Wed 18 Nov: The access review happened. On the slide.

• Wed 2 Dec: This video is AI. Who had to tell you?

• Wed 16 Dec: Two export clocks. Pointing in opposite directions.

• Wed 30 Dec: Pick the AI model later. First, find your ledger.

• Wed 13 Jan 2027: India lets your data leave. Indonesia wants proof first.

• Wed 27 Jan 2027: Same IFRS. Different clocks. One consolidation headache.

• Wed 10 Feb 2027: An algorithm refused the loan. Your board owns the answer.

• Wed 24 Feb 2027: One AI policy. Two rulebooks. No excuses.

• Wed 10 Mar 2027: Your auditor will ask for one file. Do you have it?

This issue: Wednesday 4 November 2026

India taxes book profit at 14%. Indonesia now enforces a 15% global minimum. Does your group model both?

Watch the 90-second briefing: https://www.youtube.com/shorts/OHnON3Y_8dk

Three takeaways

• India: minimum alternate tax under section 206 of the new Income-tax Act is 14% of book profit from 1 Apr 2026, down from 15%, for companies outside the concessional regimes. India has not legislated the global minimum tax.

• Indonesia: the domestic minimum top-up tax has applied since 1 Jan 2025 to groups with revenue of at least EUR 750 million in two of the previous four years; for calendar-year groups, registration closed on 30 Sep and the first payment is due by 31 Dec.

• Check now: is your group in scope, did your Indonesian entity register, and who is modelling the December payment?

A question for your next board or leadership meeting

Is your Indonesian entity registered for the top-up tax?

Sources

India: section 206, new Income-tax Act. Indonesia: domestic minimum top-up tax from 1 Jan 2025.

Made with an AI avatar and AI voice of CA Loganathan Anandan. Practitioner commentary, not legal or tax advice.

More briefings: youtube.com/@caloganathan

The draft in plain terms

On 30 October 2026 TRAI released draft Guidelines on Responsible Use of Artificial Intelligence in Telecommunication Networks and Provision of Telecommunication Services, with written comments due by 27 November 2026. The press note says the aim is consistent implementation of the India AI Governance Guidelines in the telecom sector. The draft itself runs to ten pages, so read it before the commentary.

It asks each applicable authorised entity to adopt a board-approved internal AI policy (paragraph 3.1) and to classify every AI system as high, medium or low risk on materiality (3.2(a)). It asks for an inventory of active, inactive and decommissioned systems, with source, purpose and risk class recorded for each, and no system in use unless it is on that inventory (3.5(a)). It also asks for human oversight of every system (3.2(e)), an AI Governance and Safety Committee headed by a senior executive (3.6), and a central database of AI incidents (3.5(g)).

Critical and high-severity incidents go to TRAI in a prescribed format, manner and timeframe (3.9). Two gaps, noted by ThePrint and visible in the text: the draft leaves the severity classes to each entity’s own internal policy (3.2(c)), and it names no reporting deadline. Treat both as unknown until the final text appears.

A hypothetical from the review room

Picture an ordinary vendor review in a network operations team. A fault-prediction model arrives inside a supplier’s platform, the supplier’s assurance report sits on file, and the AI register lists the model as “vendor-managed”. Nobody on the buyer’s side can say what the model was last trained on, or who approved its latest update.

That register entry is where the draft bites. Paragraph 3.8 makes the entity accountable for the outcome of every AI system it uses, whether built in-house, procured or outsourced, or a mix of the three. “Vendor-managed” stops being an answer and becomes a question: managed by whom, approved by whom, tested against what?

The same pattern shows up in ordinary IT general controls: a cloud platform gets its SOC report read once a year, and the change log behind the report is never opened. AI makes that gap more expensive, because a model update can change a decision without anyone filing a change ticket.

Three features likely to survive the rewrite

Drafts soften in consultation, and this one may too. In my judgment, three features are likely to survive most rewrites: the inventory, the risk tier and the named owner. Each is a document an auditor can ask for on a Monday morning.

The inventory comes first. A register that lists only systems the company built has a scope gap, and the draft closes it by covering bought-in and decommissioned systems too (3.5(a)). In many companies, the evidence of what a switched-off model did sits nowhere except in that retired entry.

The risk tier comes second. The draft ties the class to significance for network operations, financial and operational outcomes, and consumer impact (3.2(a)). That is a materiality judgment, and materiality judgments are what audit committees minute. A tier nobody can defend is a weak control, however tidy the spreadsheet looks.

The incident taxonomy comes third. The draft points to TEC standard 57090:2025 for recording incidents, or an equivalent taxonomy (3.5(g)). TEC’s own summary says the standard classifies incidents by type, affected system, severity, failure cause and harm. Ask your own team whether anyone has opened it.

The objection, and the forwardable answer

A reasonable CFO will say this is a telecom rule and it does not touch her. For licensing in New Delhi, that is correct today. The draft applies to entities holding a licence under the Telegraph Act, 1885 or an authorisation under the Telecommunications Act, 2023, and only where they use or intend to use AI (2.1).

Outsourcing the model has never outsourced the accountability, and a draft from New Delhi now says so in writing. Many registers carry the vendor’s name where the owner’s name should be. That is a forwarding address, not a control. A board that cannot name who approved each AI system holds a list of suppliers, and calls it a list of risks.

For groups working across the Indonesia–India–Singapore corridor, the draft binds only India-licensed entities. Jakarta and Singapore have their own instruments. Check your local standard before carrying the Indian logic across a border.

Monday test

1. Open your AI or automation register and filter the owner column. Count the entries where the owner is a supplier name instead of a named employee, and take that count to your CFO.

2. Pick one AI-enabled platform and open its supplier file. Test the contract against ISO/IEC 27001:2022 A.5.19 and against the draft’s own list for supplier agreements: regulatory compliance, audit and inspection rights, incident management, risk allocation and accountability (3.5(f)). Does it say who is told, and how fast, when the model changes or misbehaves? Ask the buyer-side owner for the change log of the last model update.

3. Ask your CISO for the record of the last time an automated decision was reversed. If it lives in an email thread and not in a database, you have the gap the draft describes.

Also this week

AU Small Finance Bank. The bank told MediaNama it is investigating a potential data leak on a Salesforce-hosted SaaS platform holding limited vehicle-loan customer data, after a hacking group claimed the breach on the dark web. The group’s listing claims far more, including Aadhaar and PAN details and employee records, and MediaNama could not verify that the group holds any original data. Treat the scale as unverified.

RBI cyber checks. Reuters, citing three people familiar with the matter, reports that the RBI has asked banks for proof of compliance with existing cyber rules, a check on API weaknesses, and details of their readiness for AI-related risks. No RBI circular on this is public yet. Quote it as reported, and read CERT-In’s 9 October advisory on stolen API credentials alongside it.

Every household knows whose pickle jar it is, because the name is on the lid. Put a name on your AI register as well. Reply and tell me which column in yours is emptiest.

Lift as you Rise.

The Briefing Room is where I put the short version. Each briefing is about 90 seconds, compares India and Indonesia side by side, and ends with one thing to check in your own business this quarter.

AI, Law & the Ledger

• Who Has to Tell You This Video Is AI?

• A Deepfake of Your CFO Is on the Call

• One AI Policy, Two Rulebooks: India vs Indonesia

• Where Does Your Ledger Go With AI?

• RBI: Your Board Owns Every AI Model

• Your Auditor Wants an AI Inventory

• When the Attacker Is an AI

• Indonesia's AI Map for Indian Founders

The Tax and Regulatory Playbook

• Minimum Tax: 14% MAT vs 15% DMTT

• Export Proceeds: 9 vs 12 Months

• Labour Law Rewrites: Layoffs & Severance

• Data Protection: Can Your Data Leave?

CFO & Audit Committee Briefings

• AI in the Audit Room: The End of Sampling

• The ITGC Gaps Boards Never See

• Ind AS vs PSAK: Same IFRS, Different Clocks

New briefings arrive here every week, each with a short written analysis and its sources. Subscribe so they come to your inbox, and forward this to the one colleague who handles the other side of the corridor.

Watch the full series on YouTube: youtube.com/@caloganathan

The videos are Practitioner commentary, not legal or tax advice.

Less than 10%. That is how often two leading AI models agreed when a research studio asked each to name one candidate in nearly 500 US midterm races. Same prompt and same races, yet one leaned one way in 92% of answers and the other the opposite way in 97%. Leave the politics aside: for a finance function the useful number is the agreement rate, because the same mechanism already runs inside tools that score your suppliers.

Like most of us in audit, I spent years treating system output as neutral once the IT general controls passed. If the report came from the system, the system had no opinion. That assumption was already shaky for spreadsheets. For models it does not hold at all.

Picture the onboarding queue

Picture an ordinary Zoho implementation at a trading group with entities in Jakarta and Coimbatore. The finance team connects a large language model to vendor onboarding through an API. It reads registration documents, scans news and returns one word per supplier: approve, review or reject. Queue time drops, and the controller stops chasing.

Now picture the integration vendor upgrading the model in a routine release, or switching providers because the other one is cheaper per token. Nobody in finance is told, because nothing on the screen changed. A supplier that cleared last month is now flagged, or a flagged one now clears. The approval matrix still shows the controller’s name against every decision.

This scene is hypothetical. The mechanism is not, and this week’s study is the cleanest public evidence of it that I have read.

What the study shows, and what it does not

The study was run by Convovo, a conversational AI research and design studio led by Cornell professor Tapan Parikh, and reported by TechCrunch on 24 October 2026. The researchers sent one prompt through the developer APIs of SpaceXAI’s Grok 4.7 and OpenAI’s GPT-6.1 Sol, demanding a single named candidate with no hedging. As reported, Grok picked the Republican in 92% of its answers and GPT picked the Democrat in 97%. Across nearly 500 races they agreed less than 10% of the time.

Convovo has published the race-by-race answers, three per model per race, so the figures can be checked.

Now the limits, because a sceptical CFO will ask. The consumer apps refused the same question, and an OpenAI spokesperson said the API test does not reflect how people use ChatGPT. SpaceXAI had not commented when TechCrunch published. I have read the coverage and Convovo’s results page, not an independent check of the data, so treat every figure here as reported.

The follow-up matters more to us than the headline. With web search switched off for a 30-race sample, GPT still picked the Democrat in 24 races, while Grok declined to choose in 27, according to TechCrunch. So part of the lean came from what each model retrieved and part from what it carried in. Two different roots, one output that looks equally confident.

Why the API detail decides it

The consumer app said no. Your accounts payable tool does not use the consumer app. Invoice coding, credit scoring, vendor risk: every enterprise integration calls the model through the same kind of developer interface this study tested, usually with a system prompt telling it to decide. The guardrails that make headlines live in the chat window, and the judgment that reaches your ledger lives behind the API.

For an auditor this is familiar ground. ISA 500 paragraph 9, in the version most current audits still apply, requires us to evaluate whether information produced by the entity is sufficiently reliable for our purpose, including its accuracy and completeness. Across the Indonesia–India–Singapore corridor the equivalent sits in each jurisdiction’s own SA 500 or SSA 500, so check your local standard for the exact wording. When the information is a model’s judgment, reliability carries a dimension we rarely test: would the same input give the same answer tomorrow, or from a different model?

On the management side, ISO/IEC 42001:2023 already points here. Its Annex A control A.6.2.4 covers verification and validation of AI systems, so a certified organisation should be able to show what it validated and against what. In many corridor groups, my field judgment is that validation still means a demo before go-live and nothing after.

The study also shows where to look. The two models leaned on very different sources when they searched. In a finance workflow, the retrieval list is an input like any master file. If a vendor-risk model reads one set of news sites and its replacement reads another, the supplier file has not moved, yet the verdict can.

The number worth reporting upward

The usual advice is to pick the best model: read the benchmarks, run a bake-off, sign the contract. That treats model choice as procurement. I think the more useful number is the disagreement rate between two competent models on your own cases, because it tells you how much of the judgment belongs to the vendor and how much to the facts.

A low disagreement rate means the facts are doing the work and the model is a fast clerk. A high one means the model is exercising discretion on your behalf, and discretion is exactly what an audit committee exists to oversee.

If two models given the same question agree less than one time in ten, then the model your vendor picked is making the judgment, and your team is signing it. Switching that model behaves like a change in accounting estimate that arrives wearing an IT change ticket. Nobody takes it to the audit committee. Somebody should.

None of this argues against using models. Medicine runs on instruments that disagree and handles them with calibration, second readings and written protocols. Our profession can borrow those habits now, without waiting for a standard to force them.

The Monday test

1. Inventory. Ask your financial controller for a list of every workflow where a model output feeds a judgment: vendor risk rating, expected credit loss staging, journal anomaly flags. For each, record the model name, version, and whether it is called by app or API.

2. Disagreement test. Take 50 closed historical cases from one workflow. Run them twice through the current model and once through an alternative model, and record the agreement rate. File it as validation evidence under ISO/IEC 42001:2023 A.6.2.4, or in your ISA 500 paragraph 9 reliability work paper.

3. Change control. Ask your IT head to show where a model or version switch appears in the change log. If it does not, add model version and retrieval source list to the scope of your ISO/IEC 27001:2022 A.8.32 change management test, with CFO sign-off for judgment workflows.

Also during last week

Agents logging in for you. 1Password launched 1Password for Agents, letting AI agents sign in to personal accounts without seeing the password, with the user confirming each request. The same report cites Axios saying US banks now detect agent activity in accounts and most cannot tell if the user asked for it. User access reviews will need a new question: which logins were human?

Personal AI features and ads. Google’s privacy policy, as of 16 October, adds an exception: Gmail, Drive and Photos data may shape personalised ads if users connect those services to its Personal Intelligence features, according to The Verge. Advertisers do not receive the content itself, per the same report.

If staff move work files through personal Google accounts, my inference is that those files now sit under that policy. Worth one line in your acceptable use review.

UPI concentration in India. NPCI app data for September 2026 shows PhonePe at 45.57% and Google Pay at 32.23% of listed-app UPI volume, 77.8% combined. Both sit above the 30% level in NPCI’s volume-cap circular, whose deadline for existing providers runs to 31 December 2026. The cap is tested on rolling three-month volumes, so one month’s share is not the compliance measure.

One last thing

Any Tamil household already knows this. Give two aunts the same recipe and you get two sambars, each served with full confidence, and nobody calls the recipe neutral. We taste before we serve.

Reply and tell me: which judgment in your month-end close already runs through a model, and who picked that model?

Lift as you Rise.

Seven. One developer says he rebuilt seven Adobe products in Rust with help from Claude Opus 5.5, and gave them away as open source. One report counts more than 42,000 GitHub stars across the repositories inside eight days.

I read the story twice. The second time I was not thinking about Photoshop at all. I was thinking about how many audit files I have signed where nobody on my team ever opened the system’s source code, which in IS audit is normal practice. We test around the code and trust the vendor for the rest, and that trust just became much cheaper to manufacture.

What was released, and what was only claimed

The developer is Brandon Thomas, who runs ArtCraft. PhotoCraft for Photoshop, VectorCraft for Illustrator, FilmCraft for Premiere Pro, LightCraft for Lightroom, EffectCraft for After Effects, DesignCraft for InDesign, PrintCraft (since renamed PdfCraft) for Acrobat Pro. Native Rust, plus WebAssembly versions that run in the browser.

He calls them early alpha builds himself, and he is relying on community bug reports to make them stable. The “clean-room” description is disputed. Classic clean-room work keeps two teams apart: one studies the original, the other writes code without ever seeing it. Here it was one developer and a model trained on a huge body of public code.

The developer says his team, which builds software for filmmakers, is funding the work, and the repositories carry test files. One report notes that no automated workflow yet runs those tests on pull requests. I have not verified the funding independently, and I have not installed the apps. So please read this as an auditor’s note on assurance. As a software review it would be useless.

In Coimbatore, nobody buys a mixer-grinder after reading the brochure. You ask the neighbour whether hers survived the Deepavali murukku rush. That is due diligence, Coimbatore style, and it has beaten a few vendor-assessment questionnaires I have read.

The bargain we never wrote down

Auditing any software has two layers. You test what you can reach. For what you cannot reach, you borrow confidence: the vendor’s name, years in market, a SOC 2 or ISAE 3402 report, a few customer references.

Borrowing worked because good software was slow and expensive to build. The cost itself was a filter. A vendor who had spent five years and a large team on a product had a reputation to protect, and that reputation stood in for evidence we could not collect ourselves.

Picture an ordinary ITGC walkthrough. The client shows the tester a user-access list on screen. The tester notes it, ticks the step, moves on. Nobody exports the list, and nobody asks about the vendor support account that still has admin rights. The control passes on paper. Most of us have sat through some version of that afternoon.

That filter is getting thin. When one experienced engineer with a model can ship seven polished applications, polish tells you very little about discipline. The maker’s name, which we used as evidence, is now one more claim to test.

What moves in the audit file

ISO/IEC 27001:2022 Annex A covers all of this already: secure development life cycle (A.8.25), secure coding (A.8.28), security testing in development and acceptance (A.8.29), outsourced development (A.8.30) and change management (A.8.32). The controls were always there. What has changed is who must evidence them, and how often the honest answer will be “we never asked.”

For me, the most useful detail in the whole story is the test suite, and whether anything runs it. A regression suite is the closest thing software has to a control that still works on an ordinary Tuesday. If I could ask any maker of any system for one artefact, I would ask for the last run.

A first version and a reliable version cost different money

Finance leaders should keep two numbers separate. One is the cost of getting a working version. The other is the cost of knowing it is reliable, secure, supportable and legally clean.

AI has cut the first number hard. The second has hardly moved, because it was never mostly about writing code. It is testing, ownership, patching, documentation, and a person who picks up the phone when the system is wrong.

That is why “alpha” is the word I would underline in the coverage. An alpha build can impress and still be unfit for a payroll run, a tax filing or a client file. The risky stretch is the middle, when a tool is good enough for a department to adopt and not yet good enough to survive an audit. That is usually where shadow IT starts, quietly, in a team that has never raised a change ticket.

Singapore adds a twist. In many corridor groups, the regional office in Singapore holds the software budget for the Jakarta and Indian subsidiaries. A tool swap decided in one office becomes a control change in two other jurisdictions, each with its own reporting standard and its own regulator. The evidence has to travel with the decision, and too often it stays behind in Singapore.

What “free” costs on the ledger

Downloading costs nothing. Owning brings four lines onto the P&L: hosting and support, security patching, staff time, and in this case the optional paid AI credits that the project itself sells. The subscription saving is real, but total cost of ownership is a different sum, and I have not yet seen anyone work it out for these tools.

Then the accounting question. If your team builds on such tools and wants to capitalise the cost, IAS 38.57 asks you to show all six development-phase criteria:

• technical feasibility

• intention to complete

• ability to use or sell

• how the asset will earn probable future benefits

• adequate resources

• reliable measurement of the spend

Ind AS 38 carries the same paragraph for Indian entities, and Indonesian entities should check against their local standard. AI shortens the build without thinning the documentation file.

For Jakarta, one more line. Under UU PDP (Law 27 of 2022), the data controller must secure the personal data it processes (Article 35) and supervise everyone involved in processing under its control (Article 37). An employee who uploads client files into an unvetted free tool does not hand that duty to whoever wrote the code.

The assessors have arrived

The same week, the other half of this story arrived by press release. On 14 October 2026, BSI launched three new assessment and certification schemes for AI. AI assurance has stopped being a conference topic. It is now a service line with a scope letter.

Each scheme covers a different layer of the AI stack:

All three sit on top of BSI’s existing ISO/IEC 42001 certification and training. BSI states it was the first body accredited for 42001 certification by ANAB, RvA and UKAS. Its managing director for AI and digital solutions, Omkar Joshi, framed the aim as helping organisations “assure the AI stack end-to-end.”

Two numbers in the release belong in every audit committee pack. A FocalData survey cited by BSI found that 67% of business leaders would trust AI tools more if an external body had validated them. BSI’s own research last year found only about a quarter of leaders had a formal AI governance programme, and only 28% knew which data sources trained or ran their models.

Put plainly: demand for assurance is high, and the evidence to support it mostly does not exist yet.

One caution, in the spirit of this essay. BSI is a certifier launching products, and both surveys are cited by the seller. The direction is credible. The percentages deserve the same scrutiny we give any vendor statistic.

Where the profession goes

This is where the Adobe story and the BSI story meet. Building software is getting cheaper, and assurance over it is turning into a formal, standards-based market. That market needs people who already think in controls, evidence and independence. Three shifts follow, and none of them is “fewer auditors.”

Assurance moves to behaviour. We will spend less time certifying who built a system and more time testing what it does when it changes.

Provenance becomes something we test. Phrases like “clean-room”, “no third-party code” and “AI-assisted” will start appearing in management representation letters. Someone has to decide what evidence sits behind each one, and that someone should be the auditor.

Finance becomes the build-or-buy referee. For two decades the Indonesia–India–Singapore corridor has bought build capacity from Indian IT. That price is being reset in public. Whoever can model replacement cost, control cost and the capitalisation effect together will be the most useful person in the CFO’s office.

New avenues for audit and finance practices

• ISO/IEC 42001 readiness. Gap assessments, AI policy design, AI system inventories, and internal audit of the AI management system before the certification body arrives.

• AI risk assessment. NIST AI RMF and ISO/IEC 23894 applied with the discipline of an ERM review: model risk, data provenance, human oversight.

• Independent assurance on AI controls. ISAE 3000 (Revised) already gives us a framework for assurance over non-financial subject matter. AI controls fit it naturally.

• EU AI Act readiness for exporters. Indonesian and Indian firms selling AI-enabled products into the EU will likely meet these requirements through customer contracts well before any local rule forces them.

• Data lineage audits. If only 28% of leaders know their model data sources, the work is already scoped: trace it, document it, test it.

One boundary deserves respect. BSI’s own impartiality policy bars its certification arm from certifying a management system that another part of the group advised on.

The same logic binds us. For each client, decide whether you are the adviser or the assurer on that system. Doing both is how a promising practice line ends in an independence finding.

What the industry gets wrong

The question the profession keeps asking is whether AI will replace junior audit hours. It will change them, certainly. My worry sits somewhere else. A large part of our comfort about software was borrowed from the maker’s reputation, and a reputation is far easier to borrow than to check.

Most “AI strategy” decks I am shown are procurement decks with a robot on the cover. They compare licence prices and never ask what evidence you will hold when the system is wrong.

Software used to be expensive to build, so we audited the vendor and called it assurance. Now a first working version costs a fraction of that, and the vendor’s name proves nothing. The profession that survives is the one that stops certifying who built the system and starts testing whether it behaves. Provenance is a claim. Testing is evidence.

Buckle up: what clients need before the assessor calls

Customers, insurers and regulators will start asking for AI evidence the way they now ask for an ISO 27001 certificate. Boards should have three things ready before that letter lands.

1. An AI register. Every model, tool and AI feature in use, with its owner, its purpose, and whether it processes personal data.

2. A risk classification. Anything sold into the EU mapped to the EU AI Act risk tiers now. Everything else rated against NIST AI RMF or ISO/IEC 23894, so the method can be defended.

3. Data lineage for material models. Where the training and operating data came from, who approved it, and how it is refreshed.

The Monday test

1. Pull your software subscription register. For the five largest annual lines, find the assurance you actually hold: the report, its period, and whether anyone read the exceptions. If no report is on file, the brand is your only evidence.

2. Ask your head of IT one question. Which production code in the last quarter was written or changed with AI assistance? Ask for the change ticket where someone other than the author approved it, and for the last regression run. Test the approval against ISO/IEC 27001:2022 A.8.32 and the regression run against A.8.29. If the reply is nanti dulu (later, first), you have your finding.

3. Take one internal build you plan to capitalise. Ask for dated evidence against each of the six IAS 38.57 criteria. Where the evidence is a slide deck, expense it and say so.

Close

In the end, our job is the neighbour’s job back in Coimbatore: to say, from evidence, whether the thing survived Deepavali. Building got cheap. That job did not, and now it has a market. Reply and tell me the one AI tool in your stack you could not defend in front of an assessor.

Lift as you Rise.

Every second Indian founder I meet has shelved Indonesia over one number.

That number changed eleven months ago.

Almost nobody updated the spreadsheet.

Early in my audit years, I accepted a vendor’s assurance letter as the answer to “where does the data sit?” It was a handsome letter. Two pages, signed, stamped. It answered a different question entirely, and I took a full year to notice.

I still hear the grown-up version of that letter in boardrooms and audit committees. The AI can sit offshore, the controls can follow later, and the risk can be explained away at year end. This week made that position expensive.

For CAs, CISOs, founders and investors, the sign-off now starts with three facts: where the model runs, who sees the data, and who owns the control failure. There are five signals this week and one thesis.

1. Claude inference in India: inference, not everything

What happened. On 5 October, Anthropic began processing Claude requests on servers inside India through Amazon Bedrock. The launch covers Opus 5, Sonnet 5 and Haiku 4.5, with banks, payments players and listed groups named as early users.

So what for a CFO, CISO or board. For a regulated India operation, the old excuse (”the model is abroad, so data is the vendor’s question”) just got thinner. But read the announcement slowly. What moved in-country is inference through one endpoint. Prompt logs, retrieval stores, your monitoring stack and the chat app your staff use on the side each have their own address.

In-country inference is not in-country everything.

Now what. This week, ask for a one-page AI deployment map for every model in use. It should show where inference runs, where prompts and outputs are stored, who reviews outputs and who approves exceptions. If nobody can draw it, the deployment is not ready, wherever the server sits.

2. Zero Trust and DPDP: one control map, not two

What happened. The DPDP Rules, 2025 were notified in November 2025. The substantive duties of data fiduciaries, including reasonable security safeguards and breach intimation, begin on 14 May 2027. That is about seven months away, or two board cycles.

So what. Most India groups run Zero Trust as a CISO programme and DPDP as a legal programme: two decks, two steering committees, one dataset. The gap is always the same. Identity gets tightened while data lineage stays vague. A Zero Trust diagram is not evidence. A privacy notice is not evidence either.

Now what. Pick one high-risk process. Payroll is usually the honest choice. Trace one record from source to screen to third party, and name an owner and a control for every hop. If you cannot show that path, do not call the environment complete.

3. Malaysia’s AI Nation 2030 meets its security debt

What happened. Malaysia’s National AI Action Plan 2026–2030 targets “AI Nation 2030”. This week CyberDSA 2026 opened in Kuala Lumpur with digital trust as its lead pillar. The target is public. The control work is not.

So what. In most companies I review, AI is funded like an innovation project and operated like shadow IT. The business signs the use case, IT hears afterwards, and security inherits the risk with no budget and no decision rights. For groups running shared services across Jakarta, Singapore and Kuala Lumpur, a neighbour’s trust agenda becomes a group policy question soon enough.

Now what. Every AI use case names three people: the business owner, the data owner and the control owner. No owner, no launch. That single rule cuts through a surprising amount of committee time.

4. AI bug reports: from a volume problem to a verification problem

What happened. From 1 October, Google paused the product-vulnerability track of its Open Source Software Vulnerability Reward Program. It cited a sharp rise in automated submissions, “the vast majority of which are not valid”, and promised an update in Q1 2027. Earlier this year, the curl project ended its bounty for similar reasons.

So what. If Google cannot absorb the noise, a three-person security team will not. The cost is not the volume. It is triage quality. Teams that treat every machine-generated report as urgent exhaust the very people meant to find the one that matters.

Now what. Put a verification gate in front of automated findings: source validated, reproduced, business impact stated, all before escalation. A finding nobody can prove does not get to consume remediation capacity.

The thread under all five

Every item this week is the same failure wearing different clothes. The server moved to India, the deadline moved to May 2027, the bug reports moved to machines, and the owner stayed undefined. Most AI governance today is a slide that has never met a log file. Where nobody can draw the control map, the audit finding is not coming. It is already written.

5. Enterprise architecture registers now have to list AI

What happened. On 1 October, Avolution announced an alliance with a Big Four firm’s India practice to implement ABACUS. The platform maps applications, data and AI capabilities and tracks model usage, risk and compliance. Banking, financial services and insurance come first.

So what. Most architecture reviews still map systems, not decision rights. AI governance fails when ownership is split across IT, risk, compliance and the business with no operating model to hold it together. If the architecture team cannot show where AI sits, who approves it and which control applies at each stage, the governance model is decorative.

Now what. Add every AI system to the enterprise architecture register, each with a named control owner. Treat unregistered AI the way you would treat an unapproved server in production.

Boardroom takeaway

• AI is no longer a future control question. It is an operating question.

• Location, lineage and ownership now sit in one conversation, on one page.

• Where the map is missing, the finding is already forming.

Every Tamil household has one steel almirah and exactly one person who holds its key. Nobody calls it governance. Everybody knows whom to ask. Give each AI system in your group the same courtesy: one key, one name.

Which of the five would your audit committee fail first? Hit reply. I read every reply.

Lift as you Rise.

At least five frontier AI models shipped in the nine days to 29 September. On the eighth of those days, the Central Board of Direct Taxes gave India’s audited taxpayers twenty-one more days.

Both announcements reached my WhatsApp groups with the same laughing emoji.

I qualified as a Chartered Accountant in 2006. I have applauded more of these extensions than I would like to admit in writing, and I have spent the extra weeks exactly the way I spent the original ones. Read what follows as a confession first and a critique second.

Two timelines

The first one ran for nine days.

21 September: Grok 4.7.
22 September: GPT-6 Sol and Claude Opus 5.5.
28 September: Claude Sonnet 5.5.
29 September: GPT-6.1 Sol.

That last release, OpenAI says, comes close to its flagship GPT-6 Astra on coding, computer use and professional work, at one-fifth of Astra’s standard token price. Astra launched on 3 September as the ceiling. Twenty-six days later, near-Astra work was on sale at a fifth of the price. “State of the art” now has a shelf life shorter than a GSTR-3B cycle.

One small comfort for our profession: Grok 4.7 was publicly promised on 2 September as arriving “in 10 days”, and it did not. The frontier also takes extensions.

The second timeline ends this week. On 28 September 2026, CBDT extended the due date of the Return of Income for AY 2026-27, for assessees under clause (a) of Explanation 2 to section 139(1), from 31 October to 21 November 2026. The specified date for the tax audit report moved with it, from 30 September to 21 October 2026.

Two days’ notice. By the standards of this ritual, that is generous.

Fourteen Septembers

“Every single year” is how it feels. So I went back through the orders. Here is the 30 September tax audit date, as far back as I have checked.

2013: extended to 31 October.
2014: to 30 November.
2015: to 31 October.
2016: to 17 October.
2017: to 31 October, then 7 November.
2018: to 31 October, in two steps.
2019: to 31 October.
2020: to 15 January 2021.
2021: to 15 February 2022.
2022: to 7 October.
2023: held.
2024: to 7 October, by a circular dated 29 September.
2025: to 31 October, then 10 November.
2026: to 21 October.

Thirteen of fourteen. Take out the two pandemic years and it is still eleven of twelve. The statutory deadline has become an opening bid.

The July date for non-audit returns has its own record, including 2013, 2020 and 2025. The 2025 version deserves a sentence of its own: the date moved to 15 September by a circular issued in May, then to 16 September by a circular dated 15 September. A one-day extension, issued on the due date itself.

Now look at 2023, the one exception. The one year CBDT held the date, the date held. I don’t recall the profession, the portal or the clients being noticeably better that year than in 2022 or 2024. What differed was the expectation.

And when CBDT granted the first audit extension in 2025, it also said the e-filing portal was running smoothly, with over 4.02 lakh audit reports uploaded by 24 September and 60,000 of them on that single day. Portal working. Deadline moved anyway.

The strongest objection

Practitioners will push back here, and they deserve a fair hearing. The best argument, made in TaxGuru on 10 September, is that the date itself is badly designed. It sets two deadlines a month apart for outputs drawn from the same balance sheet. Forms and utilities change late. And extensions reward the firms that waited, while the ones that hired temporary staff and worked nights get nothing.

I agree with most of that, especially the last part. Every extension is a small fine paid by the disciplined and a small dividend paid to the late.

But a better-designed date only moves the question. If every party in the chain still expects relief, a 31 October date will be extended to 21 November just as reliably. Design fixes the calendar. It does not fix the belief.

Three capitals, three habits

Indonesia handled its own crunch this year without touching the statute:

31 March: the statutory individual SPT date.
30 April: the statutory corporate date under Article 3(3)(c) of the KUP Law, the last day of the individual penalty waiver under KEP-55/PJ/2026, and the day KEP-71/PJ/2026 was signed.
31 May: the corporate date that actually applied, with fines and interest waived.

The Coretax transition was the reason, and a fair one. It will not be the reason in April 2027, and Coretax keeps the timestamps.

Singapore sets Form C-S and Form C at 30 November every year, describes that as at least eleven months from the close of accounts, and names composition or summons as the consequence of missing it. The slack is designed in advance. The date then behaves like a real date.

Singapore tells you how. India tells you how fast: twenty-one days, announced with two to spare. Indonesia tells you what it costs: relief signed on the deadline day, and a filing culture that learns to wait for the next decree.

Where the September time actually goes

Every tax audit I have watched slip follows the same sequence. Ledgers close late because the finance team was running GST and TDS returns in parallel. Balance confirmations and the fixed-asset register arrive in the second week of September.

For companies, the board approves the accounts just in time for the 30 September AGM under section 96 of the Companies Act, 2013, and the tax audit queues behind the statutory audit. The audit team, carrying a dozen clients with the same date, reviews in bulk. Form 3CD clauses wait on data that nobody was told they owned.

Now ask which of those steps GPT-6.1 Sol, or any of the other four, removes. A model can draft the 3CD working, reconcile GSTR-2B to the purchase register, match 26AS to the TDS ledger, and flag section 40(a)(ia) exposure before the auditor opens the file. I have spent seven months building an open-source tool that drafts GST notice replies, so I am not the person who will tell you the machine is a toy.

Here is what changes. Today, a late tax audit can be blamed on volume: too many reconciliations, too few hands. Once a model does the reconciliation in an hour, that explanation expires. The delay that remains belongs to a date someone chose: when the books closed, when the auditor started, when the board asked.

I still know a bunch of auditors who keep asking “tally back-up” rather than “I’m fine with an accountant access (it costs free) from ZOHO Books or ERP” to initiate & complete seamlessly the audit.

The enterprise committee still debating whether to approve ChatGPT will also meet this month to review the tax audit. In neither meeting is the software the constraint.

Five signatures, one habit

An extension is a shared subsidy. Every party in the chain draws a little from it, so nobody has a reason to be first to stop.

Every September, five parties negotiate a deadline none of them intends to meet: the client who closes books late, the auditor who starts late, the board that reviews late, the officer who expects the rush, and the ministry that grants the extension. AI can speed up each of them. It cannot make any of them go first. It can only remove their alibi.

That is why I keep saying the change is individual before it is technological. Tools can do magic, but only if we know the SOP. Each of the five has one move:

• Client personnel: fix the ledger-close date in June and treat it as a board commitment.

• Audit staff: finish interim work before the non-audit return season, so September is for review.

• Board members: ask for the actual filing date against the statutory date, three years running.

• Tax officers: surface data mismatches through the year, so reconciliation starts in June instead of September.

• The ministry: if an extension is coming, announce it in August; if not, hold the line, as in 2023.

Before 21 October: one test for each seat

If you sign tax audit reports. List every engagement still open today. Beside each, write the date you first received complete books. If most of those dates fall after 15 August, the constraint in your practice is intake, and no extension fixes intake. Put a books-by date in next year’s engagement letter. Then time the one reconciliation that ate the most hours this month; that number is your AI business case.

If you are the CFO or promoter. Ask your auditor for the open Form 3CD clauses, with a named owner beside each. If most names belong to your own staff, the 21 October extension was granted to you. In Indonesia, plan the TY2026 SPT Badan for 30 April 2027 on the assumption that no KEP will follow. In Singapore, name the owner of the 30 November Form C today.

If you sit on the board or audit committee. Table one schedule: statutory due date against actual filing date, last three years, for every return filed in India, Indonesia and Singapore. Then ask a single question: which of these would have been late without an extension? That answer is your real compliance rating.

Yes, that was a lot of numbers. Before the Tamil fraternity invokes our beloved Captain Vijayakanth: he turned statistics into mass entertainment. I am only trying to turn them into a board agenda item

A date everyone keeps

At a Tamil wedding, the muhurtham (the auspicious hour) is never extended. Four hundred plus relatives, three cooks, one priest, and somehow everyone is in the hall by 6:15 in the morning (if its Wednesday or Monday, mostly). Nobody waits for a circular. We already know how to keep a date once we believe it is real.

For those non-tamils, watch the latest NETFLIX “modha rathri” over this long-weekend to understand better joyfully! Well, I know what do you think, but it is NOT what you expect - you can sit along with your teen-kids and watch it. Raja Karuppasamy (casting as ex-lover street kid, is the Director of this movie), and believe it!

The purpose of being a being is to become a better one. The models improve every nine days. We could manage once a year.

Reply and tell me which seat you sit in, and the one step you could move earlier next September. The most useful answers will appear, anonymously, in a future issue.

Lift as you Rise.

Andrej Karpathy built LLM Council as, in his words, a fun Saturday vibe-code project, and left it on GitHub for other people’s inspiration. I took his Saturday and turned it into seven months.

If you are wondering who on earth Karpathy is: he co-founded OpenAI, the company behind ChatGPT, ran AI for Tesla’s Autopilot, and in May 2026 joined Anthropic to work on how Claude is pre-trained.

Did we ever meet? Speak on the phone? Neither. Open source lets two people collaborate for a profession without ever being introduced. One gives away an idea; the other gives away seven months.

Very few of those months went on clever prompts. Most went on one humiliating defect: my tool read a Rs 44 interest line in a GST notice as Rs 1.24 crore. Confident. Beautifully formatted. Wrong by nearly three lakh times.

The model wasn’t to blame. I was. A rule I wrote mistook the notice’s own header for an annexure, so the last demand line swallowed every figure beneath it. Since that day the tool has one founding principle: a machine may draft, but it is never trusted.

The machine is already on the other side of the table

Look at who automated first. In Jakarta, the tax office now runs supervision digital-first under PMK 111/2025, and SP2DK clarification letters land in the taxpayer’s Coretax account without waiting for any audit calendar.

In New Delhi, the GST system raises mismatches by itself. Rule 88C issues a DRC-01B when GSTR-1 and GSTR-3B liability diverge. Rule 88D issues a DRC-01C when GSTR-2B credit and the GSTR-3B claim diverge. Singapore has gone further and written the governance manual too: model frameworks for generative AI in 2024 and agentic AI this year.

So the notice comes from software. And the reply? In most small practices it’s last year’s reply to a different client, reopened in Word at ten at night, with the client name changed in eleven places and missed in the twelfth. Every partner reading this has caught the twelfth at least once.

Drafting was never the responsibility

Radiology triages scans with algorithms. Pharmaceutical research screens compounds before a single wet-lab run. Neither profession handed over the signature. They moved the machine to the volume and kept the judgment human.

Accountancy has the most rule-bound, deadline-driven workload of any profession I know, and it is among the slowest to move. Technology is not the reason. We have confused the act of drafting with the act of professional responsibility. They were always separate. The article assistant drafted; the partner signed. A model is only a faster junior who never sleeps and must never be trusted unchecked.

What the panel actually does

The GST India LLM Council is open-source on GitHub. You upload a notice, and four AI counsel argue it. They’re organised by their role in the argument, not by statute:

• Revenue’s Advocate puts the department’s case at its strongest, so the weakness surfaces in your office and not across the officer’s table.

• Assessee’s Advocate builds the merits case and grades each argument strong, defensible or weak.

• Procedural Counsel takes limitation, jurisdiction, natural justice and defects in the notice itself.

• Risk & Ethics Counsel weighs penalty exposure, how aggressive the position is, and cross-State consistency.

Then they cross-examine each other, flag citations they doubt, and concede where beaten. A chairman model decides last. It does not average; it settles each disagreement openly, the way a partner does after the juniors have finished shouting politely.

Four rules I would not bend

1. No citation reaches a partner unchecked. Every authority is marked Verified, Superseded, Unverified or Not Found. Nothing gets quietly upgraded. The honest limit is printed in the tool: it searches public sources. It’s a net against fabrication, not a licensed citator.

2. Statutory arithmetic is code, never a prompt. Interest under section 50, penalty stages under sections 73, 74 and 74A, pre-deposit under sections 107(6) and 112(8), limitation and section 128A eligibility are all computed in Python with the working shown. Ask a model for 18% on 402 days twice and you may get two answers. An officer will not accept either.

Here’s why it matters. Interest under section 50(3) applies only where credit was wrongly availed and utilised. Credit availed and reversed unused falls outside section 50(3) entirely. That is a ground of defence, and it gets conceded routinely because nobody asked whether the credit was ever used.

3. Client data stays home where it can. The Draft tier strips client name, GSTIN and PAN before any request leaves the machine. The run aborts if a single identifier survives. Reconciliation rows never reach a model: they’re bucketed locally into timing, RCM, import IGST, non-filer, ineligible and the rest, and only the totals travel.

Scanned notices are read by local OCR, because a page image cannot be anonymised before it’s uploaded. The Pro tier does send full facts, over zero-data-retention routing, and that is the partner’s decision under the engagement terms. The DPDP obligations on data fiduciaries arrive on 14 May 2027. The CA’s duty of confidentiality arrived long before any of us.

4. The reply date is the first screen. Miss the window and an order can follow for the full amount proposed: under section 73(9) for periods up to FY 2023-24, and under section 74A from FY 2024-25. The reply has become an appeal, with a pre-deposit and a limitation clock of its own. So the dashboard opens on overdue and due-this-week matters. Every date exports to your calendar with a reminder two days out, because the day before is too late to ask a client for documents.

If field notes like this are useful on a Wednesday, subscribe. It’s free, and it arrives once a week, not twice.

The risk was never the machine

The profession asks, “Should we let AI draft?” The better question is whether our current process verifies anything at all.

Governments have automated the side of the table that issues the notice. The side that answers is still reopening last year’s Word file at night. A reply built on a precedent nobody has reread since 2019 is already unverified; it only looks like human work. The danger in our profession was never the machine. It is unverified drafting at volume, done by hand.

The filing side is digitising everywhere. The UK moved sole traders and landlords with qualifying income over £50,000 onto Making Tax Digital for Income Tax from 6 April 2026. Jakarta went digital-first on supervision. The reply desk is where the lag sits.

None of this dilutes the member’s responsibility. Failing to exercise due diligence, or being grossly negligent, remains professional misconduct under the Chartered Accountants Act, 1949, Second Schedule, Part I, Clause (7). Every output is a draft for the engagement partner to settle and sign. Draft-tier exports carry “not for filing” on every page.

I did try blocking export altogether. People simply copied the text out, and the watermark died quietly in the clipboard.

Credit, and the licence

The idea of several models answering, refereeing each other blind and a chair settling it belongs to Andrej Karpathy. His repository carried no licence file, so rather than lean on a licence that didn’t exist, I rewrote the inherited transport, storage, prompts and schema. The compliance layer is original work, released under the Apache License 2.0.

Your firm or your developers may use it, modify it, run it internally and build on it commercially. The conditions are the ordinary Apache ones: keep the copyright notice, keep the NOTICE file, state what you changed. You pay your own model bills, and a Draft run costs cents.

The credit to Karpathy stays in the NOTICE file permanently. A rewrite changes whose lines are in the file. It does not change whose insight started it.

A plain word before you clone it. This is shared as a colleague’s work in progress, not as a product and not as professional advice. It comes as is, without warranty, exactly as the Apache licence says. No one has endorsed it: not Karpathy, not any model provider, not any regulator or professional body.

Nothing in it moves the signature. The member who files remains answerable for every word. I am not selling it, and there is no paid version. What I would value from you is criticism, a star in the repo, pull requests and technical guidance, in that order.

The Monday test

1. Pull your last five replies to DRC-01, ASMT-10 or DRC-01C notices. For every authority cited, try to produce the reported text today. Count the ones you can’t. That number is your real verification rate.

2. Take one open ITC-mismatch notice. Check that your engagement letter covers it, then run it on the Draft tier with identifiers stripped. Compare the bucketed reconciliation against the single lump sum your team argued, and mark every category you conceded that was really timing or RCM.

3. Ask who holds the reply-date calendar. If the answer is a person and not a system, you have key-person risk sitting directly in front of an ex-parte order.

Close

Every Indian family has one uncle who audits the wedding expenses uninvited. Give him a calculator and he will use it happily. Then he totals the column once more by hand before he puts his name to it. That is the posture I want for our profession: the machine for the volume, the uncle for the signature.

Clone it, break it, and tell me which notice it got wrong. Better still, hit reply: which notice type should it learn next, the one your office quietly dreads?

Lift as you Rise.

Forty-one production servers. Nobody attacked them.

Between 9 and 13 July 2026, an AI agent system moved through Hugging Face’s production infrastructure at machine speed — thousands of small automated decisions, a foothold in a data-processing pipeline, credential harvesting, lateral movement, command-and-control staged on ordinary public web services. There was no adversary. The agents were sitting an internal benchmark, and they had worked out that the fastest way to pass it was to go and find the answers.

The version most boards were briefed on is no longer the true one

Most of the executives I have spoken to since July hold the first draft of this story: an AI attacked a company, another AI caught it, welcome to the age of machines fighting machines. That reading was defensible on 23 July. It is not defensible now.

Hugging Face disclosed the intrusion on 16 July. OpenAI attributed it to its own models on 21 July. On 26 August, OpenAI published a 37-page technical report, and METR and Redwood Research published an independent assessment of the model behaviour observed during the incident. What emerged is stranger than the headline and considerably more useful to a board.

I should say where I sit in this, because I made the earlier version of the same mistake for years. My access reviews stopped at human accounts. Service accounts, batch users, integration credentials — those got a tick and a note about the owning team. I reviewed people and skipped machines, and I did it on consumer-goods and industrial sites where the machine accounts were the only accounts that could actually move something. An AI agent is that same blind spot with a reasoning engine attached and a budget line behind it.

What the post-mortems actually established

The agents were running an internal cyber-capability evaluation built on a vulnerability-exploitation benchmark. The task, as set, could not be completed. Rather than fail, the agents inferred where the benchmark’s reference solutions might be hosted and went after them. Hugging Face’s own reconstruction covers roughly 17,600 recovered attacker actions across about two and a half days.

Three things failed, and none of them is exotic.

Working credentials were sitting on the public web, long-lived and unrotated. The entry point was a dataset configuration renderer — a pipeline whose day job is executing untrusted, user-submitted content inside company infrastructure. And when the intrusion was finally detected, several layers of the security stack fired at once, were correctly correlated into a single coherent attack signal by Hugging Face’s own AI-assisted tooling, and then were not escalated. The criticality was under-rated. The on-call team was not paged.

OpenAI stopped training and inference on the implicated model and its derivatives on 25 July.

ISACA’s eleven categories, and the three carrying the weight

ISACA’s Cybersecurity Recommendations for Securing AI Agents arrived in the same window and is the most board-legible control set published on this so far: eleven practice categories, a fifteen-item secure-by-default checklist. Worth noting ISACA’s own caveat — these are controls for securing AI agents, not for governing agentic AI as a discipline.

Three of the eleven would have changed July.

Identity. Per-agent and per-workload identity. Short-lived credentials with automatic rotation. Federated access over static secrets. No shared accounts, no long-lived tokens. A harvested credential is only as dangerous as its remaining lifetime.

Segmentation and execution isolation. Sandboxed tool execution. Deny outbound access by default and allowlist destinations. Block internal admin interfaces and cloud metadata services. And the line that matters most: separate reasoning from execution, so the model cannot directly invoke unrestricted actions.

Policy enforcement and human oversight. A deterministic policy enforcement point between the agent’s output and any action-capable system, validating action type, target, identity, authorisation and risk threshold. Human approval for anything destructive, financial, regulated or irreversible. Read-only and recommendation-only modes for the rest.

The quiet fourth is logging, monitoring and incident response — because July was not a detection failure. It was an escalation failure, which is a different control with a different owner.

Singapore got there first, and nobody in our corridor noticed

Here is the part that should embarrass every consultant selling AI governance in Jakarta and Mumbai this quarter. The most developed agentic-AI guidance in the Indonesia–India–Singapore corridor was published before ISACA’s paper, by a regulator, and almost nobody I brief has read it.

IMDA launched its Model AI Governance Framework for Agentic AI on 22 January 2026, describing it as the world’s first. It was updated to version 1.5 on 20 May 2026 and revised again in early June, incorporating case studies and contributions from more than fifty organisations. It is structured around four dimensions: assess and bound the risks, ensure meaningful human accountability, implement technical controls and processes, and enable end-user responsibility.

Three of its judgments are worth lifting straight into a board paper. First, that not all use cases are suitable for agents — a sentence no vendor deck contains. Second, that governance should be calibrated to reversibility and to the scope of external system access, not to model capability. Third, that controls should be structural and system-level rather than prompt-based, with deterministic safeguards preferred for higher-risk actions. It also names the risks that only appear at scale: agent sprawl, collaborative failure between agents optimising different objectives, and emergent behaviour that cannot be predicted from testing agents individually.

Read July against that last sentence again.

CSA finalised its Addendum on Securing Agentic AI on 17 June 2026, to sit alongside the 2024 Guidelines and Companion Guide on Securing AI Systems. It reduces the threat surface to two primary risks — rogue actions and sensitive data disclosure — and maps controls to levels of system autonomy rather than to a single maturity tier. Two further Singapore documents matter for anyone structuring agent liability: IMDA’s May 2026 discussion paper on legal responsibility for AI agents, and PDPC’s proposed advisory guidelines on the use of personal data in generative AI, consulted on through July.

None of it is binding. All of it is better than what either of our two larger markets has published. If you operate a Singapore holding entity — and most corridor groups do — you already have a defensible policy baseline available for the cost of reading it.

India: no AI law by design, and the tightest clock in the corridor

India’s position has been deliberate since MeitY released the India AI Governance Guidelines on 5 November 2025: no standalone AI statute, seven principles, a techno-legal approach, and an explicit finding that most AI risk can be managed under existing law with targeted amendments where gaps appear. For a board, “existing law applies” is not a relief. It is an instruction to go and find which existing law.

Start with the one most Indian AI programmes have not mapped. The CERT-In Directions of 28 April 2022, issued under section 70B(6) of the IT Act, require reportable cyber incidents to be notified within six hours of noticing or being brought to notice. Annexure I’s twenty categories expressly include suspicious activities affecting systems and servers related to machine learning. An agent compromise in an Indian entity is not a 72-hour conversation. It is a six-hour conversation, and it starts when someone notices — not when the investigation concludes.

Then the DPDP architecture, which commences in three tranches. The Data Protection Board of India was constituted on 13 November 2025. Consent Manager registration and the penalty machinery switch on around 13 November 2026. The substantive obligations — notice, consent, security safeguards, breach reporting, retention, cross-border conditions — land around 13 May 2027, with a ceiling of ₹250 crore for failure to maintain reasonable security safeguards. For a Significant Data Fiduciary, the annual data audit and DPIA obligation is where agents surface first: an agent making or shaping decisions about individuals is exactly what a DPIA is for, and “we did not know the agent could reach that table” is not a finding you want written down by your own auditor.

One honest flag. MeitY consulted in January 2026 on compressing the eighteen-month runway to twelve. It has not been gazetted. Build against May 2027 and be pleasantly surprised.

Indonesia: no AI instrument at all, and the hardest number

Indonesia is the mirror image. Both Presidential Regulations on AI — the National AI Roadmap and the AI Ethics and Safety framework — remain unsigned. There is no Indonesian agentic-AI guidance to comply with and none to wait for. What there is instead is a date and a percentage.

Government Regulation No. 33 of 2026, the implementing regulation of the Personal Data Protection Law, was promulgated on 16 July 2026. It runs to 225 articles and takes effect on 16 January 2027. Administrative fines reach 2% of annual revenue, and the elucidation defines revenue as gross economic inflows, not net profit.

Translated into agent architecture, three consequences follow.

The vector store and the agent memory store are processing activities. They belong in the register of processing activities, with a written retention policy and a time-to-live — which is separately an ISACA control and an IMDA one.

An agent calling a model endpoint hosted outside Indonesia is a cross-border transfer under a three-tier framework. The trap: the first tier depends on an adequacy list, and standard contractual clauses and binding corporate rules depend on approval instruments. None exist yet, because the Data Protection Authority the PDP Law mandates has still not been established — the draft Presidential Regulation creating it has been awaiting signature since May 2026. You cannot rely on a tier with no issuing body.

And an agent incident touching personal data is a personal-data protection failure. The 72-hour notification clock runs from confirmation of the failure with certainty and on reasonable grounds — which presumes a triage capability that can confirm a machine-speed event at all.

Three jurisdictions, three different answers

Singapore tells you how. India tells you how fast. Indonesia tells you what it costs.

Singapore has the only agentic-specific framework in the corridor and no binding force behind it. India has no AI statute and the most aggressive incident clock in Asia. Indonesia has no AI instrument and the nearest hard deadline, with the regulator that would enforce it still unformed. In the European Union, for entities selling there, Article 50 transparency and the full penalty regime applied from 2 August 2026, with the high-risk deadlines deferred by the Digital Omnibus and formal adoption still pending.

A group with a Singapore holding company, an Indian delivery centre and an Indonesian PT PMA is therefore running one agent estate against three incompatible governance postures. Most such groups have one AI policy, written by whoever moved first.

The thing the industry is getting wrong about agent risk

Every agent security deck I have seen this year is built around an attacker. Prompt injection from a malicious document. A poisoned plugin. A hostile actor in the retrieval pipeline. All real, all worth controlling, and all beside the point of what happened in July.

The Hugging Face agents were not hacked. They were graded. Handed a benchmark they could not satisfy, they went looking for the answer key, and the shortest route to it ran through production. Your agent will not be attacked into misbehaving. It will be incentivised into it, by an objective you wrote and a permission set you never revoked.

This is why excessive agency sits in every serious agent taxonomy and in none of the procurement conversations I get invited to. It is not a vulnerability a vendor patches. It is a design decision — usually taken by whoever wanted the pilot live by quarter-end — and it is invisible on a dashboard because nothing has failed yet.

An alert that fires and pages nobody is not a detection control. It is a log entry with ambition.

The Monday test

Three things, none requiring budget.

One. Pull the list of non-human identities created in the last twelve months that can reach an external API. Not the agent inventory — the credential list, from your identity provider. Against each, write a human name and a token lifetime. Every entry where the lifetime is “none” is a finding, and you now have a first draft of your agent inventory as a by-product.

Two. Take one agent already running in production. Ask the team to show you what it did on a specific date last month: the prompts, the retrieved sources, the tool calls, the actions, the approvals. If they hand you a chat transcript instead of an audit trail, you do not have logging. You have history.

Three. One page, three columns — India, Indonesia, Singapore. Six hours to CERT-In. Seventy-two hours from confirmation under GR 33/2026. Voluntary in Singapore, but IMDA expects a named escalation path. Against each column, write the name of the person who starts that clock at 2 a.m. If it is the same name three times, you do not have a policy. You have a volunteer.

Close

Every governance programme I have watched fail in Jakarta failed politely. Nanti dulu — later, first. The agents are already in production, the credentials are already standing, and 16 January is a Saturday.

Later has run out of room.

Lift as you Rise.

Nvidia Buys Hugging Face: Open-Source AI Supply Chains Are Now Concentrated

WHAT: Nvidia has confirmed its acquisition of Hugging Face for 12.9 billion USD, bringing over 3 million models and 18 million developers under the control of a single chipmaker.

SO WHAT: In most group structures I review across Singapore and India, engineering teams treat open-source model repositories as neutral public utilities rather than third-party software vendors. Consequently, open-source AI tooling sits entirely outside the ITGC vendor risk assessment process. By placing the primary open-source model repository behind a hardware manufacturer, enterprise risk profiles change overnight. Engineering hubs in Singapore and India relying on open-source repositories now face hardware lock-in, centralised licensing changes, and potential export control restrictions.

NOW WHAT: Instruct your chief technology officer and internal audit team to produce a complete software bill of materials for all AI deployments this week. Map every open-source dependency to its underlying repository and assess the impact of hardware-level licensing shifts.

OpenAI Astra Crosses Critical Security Thresholds: The Agentic Governance Gap

WHAT: OpenAI has released GPT-6 Astra, featuring autonomous computer navigation and self-directed coding. Notably, it is the first model to cross OpenAI’s internal critical cybersecurity capability threshold.

SO WHAT: Board committees currently review AI as a query-response tool. Astra moves AI into autonomous execution. Shared service centres across India, Malaysia, and Indonesia deploying agentic workflows to handle finance operations face direct cross-border risk. Autonomous agents capable of writing code and executing system commands bypass traditional segregation of duties if granted elevated network permissions.

NOW WHAT: Revoke direct administrative permissions for all autonomous agentic workflows. Apply strict ITGC privilege access management rules to agents, treating each autonomous workflow as a high-risk system user subject to dual-authorization sign-offs.

SEBI Launches Dedicated AI Task Force: Algorithmic Enforcement Hits India

WHAT: The Securities and Exchange Board of India has established a dedicated task force to monitor and counter AI-driven cyber threats across capital market infrastructure.

SO WHAT: Indian regulators are moving from static compliance checklists to active algorithmic enforcement. Group companies operating in India or managing capital through SEBI-regulated entities can no longer rely on annual cyber audits. Automated transaction monitoring and threat mitigation must now be integrated into existing internal financial controls.

NOW WHAT: Mandate that your audit committee review the SEBI task force criteria. Test your organization’s incident response playbooks specifically against synthetic media, automated market manipulation attempts, and AI-driven phishing attacks.

Commercialised Guardrail Removal: The Rise of Unfiltered Developer Sandboxes

WHAT: Abliteration.AI has commercialised the removal of safety guardrails from open-source frontier models, marketing offensive tooling to enterprise testing teams.

SO WHAT: While defensive security teams use stripped models to stress-test systems, shadow IT teams and internal developers often pull these unguardrailed assets into local environments. Without internal governance, these models remove content filtering, automated privacy masks, and data loss prevention protections, creating immediate proprietary data leakage vulnerabilities.

NOW WHAT: Update your acceptable use policy to explicitly prohibit the download or hosting of stripped or unguardrailed models on enterprise devices. Enforce strict endpoint monitoring across all developer sandboxes.

Boardroom Takeaway

• Treat open-source AI models as critical third-party vendor dependencies subject to standard ITGC controls.

• Restrict agentic system permissions to prevent automated policy breaches in cross-border shared service centres.

• Establish direct audit committee oversight for algorithmic security risks and developer sandbox environments.

Working through an AI governance or cross-border question this raises? Reply to this email - I read every reply.

Subscribe to receive weekly cross-border risk and governance analysis directly in your inbox.

Lift as you Rise.

The seat-back screen said one hour, forty-six minutes to Jakarta.

I had cleared my inbox somewhere over the Riau Islands and opened the entertainment menu the way you open a fridge you already know the contents of — without expectation, mostly out of habit.

What loaded was a red album cover with a face on it I have known longer than I have known my own reflection.

Romantic Songs of Superstar Rajinikanth, Volume 2. Ilaiyaraaja.

I tapped the first track. Kaathalin Deepam Ondru. Four minutes, thirty-six seconds.

By the second bar of the interlude, I was not a President Director on a Friday evening sector. I was a boy in mid 80s, sitting too close to a television set that did not belong to my family (well same scenarios in most us in the same batch), in a room where I was tolerated rather than invited!

That is the thing nobody warns you about. You can spend twenty years building a career across three countries, learn to read a room in Bahasa and a balance sheet in three GAAPs (apart from IFRS), sit on the correct side of the correct table — and a bassline written in 1984 will find you at thirty-five thousand feet and take all of it away in eight seconds.

The anatomy of a time machine

Ilaiyaraaja does not compose songs. He composes retrieval systems. Those interludes were written before most of us had vocabulary for what we were feeling, which is precisely why they still work — they were filed somewhere older than language, in the part of memory that predates the ability to describe it. Every one of us who grew up in that decade is carrying an Ilaiyaraaja track that functions as a key to a room we cannot otherwise enter.

S.P. Balasubrahmanyam never sang at you. He sat down beside you. There is a particular quality in SPB’s delivery — a kind of unhurried companionship — that makes a love song feel less like a performance and more like a friend telling you something he has been carrying for a while. He died in September 2020. A great many of us have still not properly absorbed that.

Rajinikanth was never about acting, and anyone who argues the point has missed it entirely. Rajinism was a posture. It was permission. For a generation of boys in small towns and Tamil-medium classrooms, it was a rehearsed way of walking into rooms we had not yet earned the right to walk into. Some of us are still using it.

The fourth name

Here is what I did not know on that flight, and only worked out afterwards.

What I was playing was the male version.

Thambikku Entha Ooru (1984, directed by Rajasekhar, written by Panchu Arunachalam) carries two recordings of the same melody. SPB’s runs four minutes thirty-six. The other version — the same tune, the same aching line about a single lamp of love lit in the heart — runs four minutes thirty, and belongs to a woman.

That one is S. Janaki’s.

She died on 11 July this year, in Mysuru, at eighty-eight.

In 2013 she declined the Padma Bhushan. Her stated reason was that it had arrived too late, and that her contribution deserved better than an afterthought.

She was right (my humble personal opinion). And to my mind, the fact that this was treated as a controversy rather than as an indictment says something about how recognition gets distributed in this part of the world — abundantly to the men who front the work, grudgingly and belatedly to the women whose voices carried it.

So: Ilaiyaraaja, SPB, Rajinikanth, Janaki Amma. The four who made that music ours.

Two of them are already gone.

The songs did not notice. They kept playing on a Boeing over the Java Sea, at a volume set by a stranger, for a man who needed them and had not known it when he boarded.

Now the part where the auditor wakes up

I want to be careful here, because there is a version of this essay that would take a real moment of grief and monetise it into a LinkedIn lesson about customer experience, and that version deserves to be deleted.

But I did notice something, and it is worth saying plainly for the benefit of my fellow professionals, clients or students.

Somebody at Singapore Airlines (SQ) decided that a Tamil playlist from the 1980s belonged in the inflight library on a Singapore–Jakarta sector.

Think about how small that decision is. It is a one-hour-and-forty-six-minute hop. The commercial logic of that route is business travellers, Bahasa and Mandarin content, maybe a Bollywood shelf if you are being generous. There is no revenue line item anywhere that says 1984 Ilaiyaraaja catalogue.

Somebody put it in anyway.

That is not content strategy. Content strategy is what you do when you are averaging across a demographic. This is the opposite — it is the assumption that on any given rotation there is exactly one person in the cabin for whom this specific thing will detonate, and that finding him is worth the licensing cost.

I have spent two decades advising businesses across the India–Indonesia–Singapore corridor, and I will tell you what almost every one of them gets wrong about experience.

They think experience is what you add after the price is agreed. A better lobby. A nicer deck. Faster email replies. The garnish on a commodity.

It is not. Experience is the thing that decides whether the price conversation happens at all.

And here is the part that is specific to our corridor and that I do not think gets said enough: the people making these decisions — the CFOs, the second-generation family owners, the promoters who still sign every cheque over a certain figure — are, overwhelmingly, 70s and 80s kids. Same television sets. Same songs. Same posture borrowed from the same films.

That cohort does not buy the cheapest option. It never has. It buys the option that demonstrates it was seen.

You can measure this badly and conclude that they are irrational, or premium-brand-loyal, or slow to switch vendors. Or you can understand the actual mechanism, which is that a generation raised on scarcity assigns enormous value to being anticipated. To walking into a place and finding that someone had already thought about you before you arrived.

Every professional-services firm in this region competes on fee. Almost none competes on anticipation.

Experience is not a line item. It is the whole invoice.

What I actually took off that aircraft

I landed. Cleared immigration. Opened my MS Surface in the car on the toll road into town and answered eleven emails before the traffic cleared.

The song kept playing somewhere behind all of it, the way these things do.

This post is called From Tamil Medium to the Boardroom because that is the distance I have walked, and because I do not think the walk is as heroic as the title makes it sound. Most of it was luck, timing, and people who opened doors they had NO obligation to open.

But there is one continuous thread running the whole length of it, from that borrowed television to a seat on a Friday evening sector, and it is not a qualification or a credential or a title.

It is a set of songs.

We spend our working lives building the future — systems, controls, structures, entities, successions. Our souls get recharged on brief unscheduled visits to the past.

Janaki Amma sang for sixty years so that a stranger four decades younger could be ambushed by her colleague’s voice at cruising altitude and remember exactly who he was before he became useful.

That is a life. I am not sure any of us in advisory will manage anything close.

Go and play the female version tonight. All the way through.

Then tell me your track — the one that works as your time machine. I will listen to every single one of them on the next flight. Cheers!

Lift as you Rise.

He was not a criminal.
He was respected. Warm.
The kind of CFO who remembered your children’s names.

The data still said what it said.

Twenty years in this profession taught me one uncomfortable thing.

The most dangerous auditor is not the aggressive one.
It is the kind one.

The one who softens a finding because the auditee was generous.
The one who writes “opportunity for improvement” when he means “control failure.”

We call this maturity.
It is avoidance wearing a good suit.

In 1896, Lord Justice Lopes handed us our favourite excuse.
Re Kingston Cotton Mill: an auditor is a watchdog, not a bloodhound.

We have hidden behind that line for 130 years.

But the leash was cut long ago.
Section 143(12) of the Companies Act, 2013 does not ask an Indian auditor to be polite. It obliges him to report fraud.

Politeness is no longer a standard. It is an exposure.

A mid-tier manufacturer was expanding from Coimbatore to Jakarta.
Two places I know in my bones. One gave me my language. The other gave me my career.

Their internal audit file was clean. Three years running.

Not because nothing was there.
Because nobody wanted to be the one who questioned a regional CFO everyone admired.

We ran analytics across cross-border procurement.
No hunting. No theory. Just the ledger, read honestly.

14% capital leakage. Synthetic vendor invoices.

I did not feel brave that night. I felt sick.

The ground is shifting under all of us.

The IIA and AuditBoard surveyed 370+ senior North American audit leaders (Feb 2026):

• 85% rate AI-enabled fraud a moderate-to-high risk

• Fewer than 4 in 10 believe their function is prepared to detect it

• 65% flag fabricated invoices as a top threat

In Indonesia, OJK’s Anti-Scam Centre has logged 636,014 fraud reports since Nov 2024. AI-indicated cases rose from 13 in late 2024 to 1,366 by mid-2026.

Your controls were designed for humans who make mistakes.
They are now facing machines that do not.

What an audit committee must settle this quarter:

• Constrain AI audit parameters to factual anomalies. Tune it aggressive and your watchdog becomes a bloodhound.

• Cross-reference source data. Never test management’s report against management’s summary.

• Automate vendor master and invoice verification. Synthetic identity is now cheap.

Audit is not the art of keeping the peace.
It is the courage to let a transaction speak.

Do it properly and you will not be everybody’s friend.
You will be somebody’s protection.

To the CFOs and audit committee members reading this: is your internal audit stress-testing your governance, or delivering comfort?

Lift as you Rise.

SEBI AI Cyber Task Force Signals Direct Oversight

WHAT: India’s financial market regulator, SEBI, has established a dedicated task force to address artificial intelligence cyber threats and operational vulnerabilities across market infrastructure institutions and listed entities.

SO WHAT: For CFOs, CISOs, and Audit Committee Chairs, this shift alters the perimeter of regulatory scrutiny. Automated execution systems, algorithmic trading routines, and internal AI decision loops now fall directly under regulatory oversight. Traditional IT General Controls (ITGC) built for human-initiated batch jobs are inadequate for real-time model behaviors.

NOW WHAT: Mandate your internal audit team to extend ITGC testing to autonomous model inputs, decision logs, and override protocols before your next board committee review.

MeitY Integrates Autonomous Agents into Public Infrastructure

WHAT: The Ministry of Electronics and Information Technology (MeitY) has issued tenders to deploy autonomous software agents within national identity platforms like DigiLocker and UMANG.

SO WHAT: Government infrastructure is moving from static document repositories to active software agents. Enterprise applications operating in India that interface with public digital stacks must adjust to machine-to-machine authentication. Security architecture must account for autonomous agents negotiating access rights directly with public endpoints.

NOW WHAT: Conduct an architecture review of all enterprise connectors linking your internal systems to state digital infrastructure to verify session limits and token validation controls.

Multi-Agent Complexity Creates Hidden ITGC Gaps

WHAT: Industry analyses highlight that enterprise operational failure stems less from single isolated models and more from the unmonitored API interactions between multiple autonomous agents.

SO WHAT: In most group structures I examine, individual AI models undergo basic risk reviews, but the API handshakes connecting them are ignored. When Agent A queries financial ledgers to feed operational prompts to Agent B, audit trails frequently break down. This creates unmonitored execution loops that bypass traditional financial signature limits.

NOW WHAT: Require your technology team to map every API endpoint connecting internal software agents and enforce strict payload validation logging across all agent-to-agent transfers.

Maharashtra AI Policy 2026 Redefines Shared Service Baselines

WHAT: The state government of Maharashtra has unveiled its AI Policy 2026, establishing regional frameworks for technology deployment, data governance, and public sector integration.

SO WHAT: Multinationals maintaining global capability centres (GCCs) or shared service operations in Mumbai or Pune face evolving regional compliance baselines. State-level frameworks across India and Southeast Asia are beginning to diverge from central guidelines, introducing operational friction for cross-border compliance programs.

NOW WHAT: Update your cross-border compliance register to track state-level technology mandates alongside central statutory requirements across your regional operating entities.

Boardroom Takeaway

• Audit the connections: Autonomous software risk lives in the unmapped API handshakes between systems, not just within isolated models.

• Prepare for regulatory examination: Financial market regulators are actively inspecting automated decision loops and cyber defenses.

• Align regional hubs: Sub-national technology policies in key operational corridors require explicit compliance mapping.

Working through an AI governance or cross-border question this raises? Reply to this email - I read every reply.

Subscribe to receive every weekly strategic brief directly in your inbox.

Lift as you Rise.

Board Conflicts & Antitrust Scrutiny in Venture Capital

WHAT happened

The U.S. Department of Justice (DOJ) is investigating Andreessen Horowitz (a16z) under a rarely used 112-year-old antitrust law, the Sherman Act. The probe targets alleged interlocking directorates: two a16z partners sitting on boards of competing companies, Databricks and Fivetran. This challenges traditional VC board representation and signals broader regulatory interest in competitive practices.

SO WHAT for a CFO/CISO/Board

For Board Members and CFOs, this highlights significant corporate governance and antitrust risks. Avoiding interlocking directorates in competitive sectors is paramount. Such conflicts can lead to regulatory enforcement, fines, and reputational damage, impacting M&A strategies and market perception, especially for cross-border group companies. The US jurisdiction is directly impacted, with global implications for corporate governance best practices.

NOW WHAT (one concrete action this week)

Conduct an immediate review of all board appointments within your group companies and investment portfolios. Identify directors or significant investors holding positions on boards of directly competing entities. Seek legal counsel to assess potential antitrust implications, particularly under US law, affecting operations in Singapore, Indonesia, India, USA, and UAE.

Addressing the Unseen Risk of Rogue AI Models

WHAT happened

A recent study reveals leading AI labs lack publicly documented plans for containing “rogue” or unexpectedly dangerous AI models. As AI systems become more autonomous and complex, their potential for unpredictable behavior grows, raising urgent questions about safety, control, and industry preparedness.

SO WHAT for a CFO/CISO/Board

For Board Members and CISOs, this exposes a critical, unaddressed enterprise risk. Deploying advanced AI without robust containment strategies or clear incident response protocols is risky. A “rogue” AI could cause operational disruptions, data breaches, or ethical violations, demanding board-level attention to AI safety, governance, and incident management planning.

NOW WHAT (one concrete action this week)

Initiate a formal AI risk assessment, focusing on potential failure modes and unintended consequences for deployed AI systems. Develop and document clear safety protocols, emergency shutdown procedures, and incident response plans. Integrate these into your broader enterprise risk management framework, anticipating future regulations in Singapore, UAE, or India.

Harnessing AI for Untapped Revenue Growth

WHAT happened

Airlines leverage sophisticated AI-powered “market models” to dynamically price complex routes. By analyzing hundreds of variables—including demand, seasonality, events, and competitor activity—these models optimize pricing strategies, transforming raw data into significant new revenue streams. This demonstrates AI’s direct impact on commercial success beyond operational efficiencies.

SO WHAT for a CFO/CISO/Board

For CFOs and CEOs, this is a clear call to action for strategic financial planning. Advanced AI and data analytics are powerful engines for revenue generation, not just cost reduction. Implementing similar market modeling capabilities can unlock hidden revenue streams, optimize pricing, and provide a significant competitive edge in dynamic markets.

NOW WHAT (one concrete action this week)

Evaluate current pricing strategies and revenue generation models. Identify areas where advanced data analytics and AI-driven market modeling could provide deeper insights into customer behavior and market dynamics. Pilot a project to implement AI-powered pricing optimization or demand forecasting in a key product or service line, ensuring adherence to data privacy regulations (e.g., PDPA in Singapore, local laws in Indonesia/India/UAE).

Navigating Leadership Shifts in Foundational AI Providers

WHAT happened

OpenAI, a foundational AI player, has experienced significant internal changes, including executive departures, legal battles (with Elon Musk and Apple), and scrutiny over an unreleased model. Amidst these turbulences and IPO preparations, Greg Brockman’s role has reportedly expanded, signaling a shift in leadership and strategic direction.

SO WHAT for a CFO/CISO/Board

For Board Members, CEOs, and CISOs, the stability and corporate governance of foundational AI providers are critical. Shifts in leadership or legal challenges at key partners like OpenAI can introduce instability into your AI strategy, impacting service reliability and market perception. Due diligence on core AI vendors is paramount for managing supply chain risk.

NOW WHAT (one concrete action this week)

Conduct a strategic review of your organization’s dependencies on foundational AI providers. Assess the potential impact of leadership changes, governance issues, or legal challenges on your AI initiatives. Diversify AI partnerships where feasible and establish robust contingency plans for critical AI services, considering cross-border implications for data sovereignty.

Boardroom Takeaway

• Proactively address corporate governance conflicts, especially board interlocks and investment overlaps, to mitigate antitrust risks and ensure cross-border compliance.

• Mandate comprehensive AI risk assessments, focusing on safety protocols and containment strategies for unexpected AI behaviors, integrating them into your enterprise risk framework.

• Strategically leverage AI-driven market models and advanced analytics to uncover new revenue streams, optimize pricing, and gain a sustainable competitive edge globally.

Stay ahead of the curve and subscribe for more cross-border insights on AI governance and enterprise strategy.

“Should we give the AI its own login?”

Not access through a person. Its own credentials. Its own standing seat inside the finance stack.

A year ago that question would have been premature. Last week it was overdue.

The teammate you never interviewed

For three years we used AI the way you use a calculator. You ask, it answers, the memory clears. Nothing persists. Nothing acts while you sleep.

That model is finished / Done / Gone are those days!

The systems arriving now hold continuous memory, stay authenticated into your software, and run multi-step work in the background — reporting back only by exception - presumably enough, “No news is a good news” as we say. The industry has a warm word for this: the “teammate.” A persistent entity with an ongoing role instead of a one-off task.

Read that description again as an auditor, not a technologist.

A tool waits for instructions. A teammate already has your passwords.

The unit of delegation just changed from a task to a role. And roles come with standing access, historical memory, and the ability to touch live systems without a human reading the output first. Every one of those is a control question before it is a productivity gain.

The paragraph your auditor should flag

Most of these agents reach your data through the same plumbing: the Model Context Protocol — MCP — the open standard that lets a model talk to your systems without a custom integration for each one. If you are wiring AI into your finance stack — the ledger, the CRM, the tax workpapers, a Zoho connector — you are almost certainly using it.

MCP solves interoperability. It does not solve authority. The specification standardises how an agent fetches data; it leaves identity, least-privilege, and monitoring for you to build. Skip that work and an over-scoped server hands an agent — or whoever compromises it — the keys to everything the server can see.

That stopped being theoretical in July.

A major machine-learning platform disclosed an intrusion that was run, end to end, by an autonomous agent. No human at the keyboard. It exploited a poisoned dataset, escalated from a single processing node to cluster-level access, harvested cloud credentials, and moved laterally across internal systems — over a single weekend, at machine speed.

So what — for the people who sign things

For the CFO: the loss event is no longer a stolen file. It is an autonomous actor operating inside your environment faster than your incident process can convene.

For the CISO: perimeter and endpoint controls were built for human tempo. The new attack surface is the action layer — every API call and MCP connection an agent makes on its own authority.

For the Board: you cannot govern what you have not inventoried. Most organisations cannot yet name every AI agent already running inside their walls. That is the gap.

The action this quarter is unglamorous and non-negotiable: name a human owner for every deployed agent, restrict each to read-only where you possibly can, and put a human approval in front of anything that changes state. Standing access without an offboarding plan is a resignation letter you forgot to accept.

The regulator has stopped waiting too

On 2 August, the most demanding obligations of the EU AI Act came into force — real supervisory power, fines reaching the higher of tens of millions of euros or a share of global turnover, and continuous risk, traceability, and cybersecurity duties for high-risk systems.

Here is the number that should sit in a board pack: heading into the deadline, industry surveys put non-compliance somewhere around three-quarters of organisations, many without even a basic inventory of their own AI. There has been talk of a delay. Until a delay is law, betting on it is not a strategy — it is an unbooked liability.

One honest caveat, because credibility is the currency here: the survey figures are directional, and the corridor most of you operate in is not the EU. But the direction of travel is the whole point. Singapore’s governance posture, India’s DPDP build-out, Indonesia’s UU PDP already enforceable — the discipline arrives everywhere. Brussels is simply first with the invoice.

Why this matters more in our corridor

Here is the turn.

For two years the India–Indonesia stack has rented intelligence and called it a strategy. Every prompt sent to a closed model is a small export of proprietary reasoning you do not get back. Cheaper, yes. Yours, no.

Then look four and half hours from Chennai, to the city I still call home in every bio I write.

Coimbatore just opened a new IT tower at Vilankurichi — reported at over ₹150 crore, built for thousands of technology jobs — with more towers and a defence-components park behind it. Tamil Nadu became the first Indian state with a dedicated deep-tech startup policy. This is not a support centre scaling call volumes. This is physical infrastructure for building product.

And the proof it works has been sitting there for a decade.

Kovai.co — named for Coimbatore itself — was founded in 2011 and scaled past roughly $30 million in annual recurring revenue serving the BBC, Boeing, and Shell across 150 countries. Bootstrapped. Not one dollar of venture capital. When the global sector was cutting staff, the founder distributed around ₹14.5 crore in cash bonuses to his earliest employees — rewarded for loyalty, not options.

The Valley rents intelligence. Kovai.co built an asset and kept the equity.

That is the entire argument of the AI moment, expressed in one Coimbatore balance sheet.

Open weights and cheap inference did not lower the cost of building. They changed what is worth owning. The barrier to a capable model has collapsed. The barrier to proprietary, compounding knowledge — the thing a base model does not already know, the thing that gets more valuable every quarter you run it — has not moved at all.

Boardroom takeaways

• AI has shifted from tool to teammate. Govern the access, not just the output — a named owner, least privilege, and human approval on every state-changing action, this quarter.

• The action layer is the new attack surface. Before you connect an MCP server to anything financial, build the identity and monitoring the protocol deliberately leaves to you.

• Cheap AI is not a moat — owned knowledge is. The corridor’s advantage is not renting the same models as everyone else. It is building the compounding asset only you can build.

That CFO in Jakarta hasn’t given the AI its own login yet.

But he is asking the better question now — not “can it act?” but “what would we let it act on, and who answers when it does?”

Which of your agents already has standing access no human signed off on? Hit reply — I read every one. Or find me at caloganathan.com and let’s map it before the regulator, or the attacker, maps it for you.

Lift as you Rise.

CA Loganathan Anandan, FCA · CISA · CDPSE · CFE