Early in my audit years, I accepted a vendor’s assurance letter as the answer to “where does the data sit?” It was a handsome letter. Two pages, signed, stamped. It answered a different question entirely, and I took a full year to notice.
I still hear the grown-up version of that letter in boardrooms and audit committees. The AI can sit offshore, the controls can follow later, and the risk can be explained away at year end. This week made that position expensive.
For CAs, CISOs, founders and investors, the sign-off now starts with three facts: where the model runs, who sees the data, and who owns the control failure. There are five signals this week and one thesis.
1. Claude inference in India: inference, not everything
What happened. On 5 October, Anthropic began processing Claude requests on servers inside India through Amazon Bedrock. The launch covers Opus 5, Sonnet 5 and Haiku 4.5, with banks, payments players and listed groups named as early users.
So what for a CFO, CISO or board. For a regulated India operation, the old excuse (”the model is abroad, so data is the vendor’s question”) just got thinner. But read the announcement slowly. What moved in-country is inference through one endpoint. Prompt logs, retrieval stores, your monitoring stack and the chat app your staff use on the side each have their own address.
In-country inference is not in-country everything.
Now what. This week, ask for a one-page AI deployment map for every model in use. It should show where inference runs, where prompts and outputs are stored, who reviews outputs and who approves exceptions. If nobody can draw it, the deployment is not ready, wherever the server sits.
2. Zero Trust and DPDP: one control map, not two
What happened. The DPDP Rules, 2025 were notified in November 2025. The substantive duties of data fiduciaries, including reasonable security safeguards and breach intimation, begin on 14 May 2027. That is about seven months away, or two board cycles.
So what. Most India groups run Zero Trust as a CISO programme and DPDP as a legal programme: two decks, two steering committees, one dataset. The gap is always the same. Identity gets tightened while data lineage stays vague. A Zero Trust diagram is not evidence. A privacy notice is not evidence either.
Now what. Pick one high-risk process. Payroll is usually the honest choice. Trace one record from source to screen to third party, and name an owner and a control for every hop. If you cannot show that path, do not call the environment complete.
3. Malaysia’s AI Nation 2030 meets its security debt
What happened. Malaysia’s National AI Action Plan 2026–2030 targets “AI Nation 2030”. This week CyberDSA 2026 opened in Kuala Lumpur with digital trust as its lead pillar. The target is public. The control work is not.
So what. In most companies I review, AI is funded like an innovation project and operated like shadow IT. The business signs the use case, IT hears afterwards, and security inherits the risk with no budget and no decision rights. For groups running shared services across Jakarta, Singapore and Kuala Lumpur, a neighbour’s trust agenda becomes a group policy question soon enough.
Now what. Every AI use case names three people: the business owner, the data owner and the control owner. No owner, no launch. That single rule cuts through a surprising amount of committee time.
4. AI bug reports: from a volume problem to a verification problem
What happened. From 1 October, Google paused the product-vulnerability track of its Open Source Software Vulnerability Reward Program. It cited a sharp rise in automated submissions, “the vast majority of which are not valid”, and promised an update in Q1 2027. Earlier this year, the curl project ended its bounty for similar reasons.
So what. If Google cannot absorb the noise, a three-person security team will not. The cost is not the volume. It is triage quality. Teams that treat every machine-generated report as urgent exhaust the very people meant to find the one that matters.
Now what. Put a verification gate in front of automated findings: source validated, reproduced, business impact stated, all before escalation. A finding nobody can prove does not get to consume remediation capacity.
The thread under all five
Every item this week is the same failure wearing different clothes. The server moved to India, the deadline moved to May 2027, the bug reports moved to machines, and the owner stayed undefined. Most AI governance today is a slide that has never met a log file. Where nobody can draw the control map, the audit finding is not coming. It is already written.
5. Enterprise architecture registers now have to list AI
What happened. On 1 October, Avolution announced an alliance with a Big Four firm’s India practice to implement ABACUS. The platform maps applications, data and AI capabilities and tracks model usage, risk and compliance. Banking, financial services and insurance come first.
So what. Most architecture reviews still map systems, not decision rights. AI governance fails when ownership is split across IT, risk, compliance and the business with no operating model to hold it together. If the architecture team cannot show where AI sits, who approves it and which control applies at each stage, the governance model is decorative.
Now what. Add every AI system to the enterprise architecture register, each with a named control owner. Treat unregistered AI the way you would treat an unapproved server in production.
Boardroom takeaway
AI is no longer a future control question. It is an operating question.
Location, lineage and ownership now sit in one conversation, on one page.
Where the map is missing, the finding is already forming.
Every Tamil household has one steel almirah and exactly one person who holds its key. Nobody calls it governance. Everybody knows whom to ask. Give each AI system in your group the same courtesy: one key, one name.
Which of the five would your audit committee fail first? Hit reply. I read every reply.
Lift as you Rise.