Home / Insights
InsightsPractical notes on AI governance, privacy and technology contracts
Plain-English guidance for founders, operators and in-house teams in Singapore and Asia-Pacific, written by Joshua Woo. Each article opens with a short answer and ends with an FAQ.
- Fractional GC · Legal operations · Startups
What is a fractional legal function, and when does a tech company need one?
A fractional legal function gives a growing company senior in-house legal and governance judgment part-time, without a full-time hire. What it covers, what it doesn't, and the signs you need one.
- AI contracts · Procurement · AI governance
AI vendor contracts: 8 terms to negotiate before you sign
Most AI procurement negotiates today's model price, the term that matters least. A checklist of eight AI vendor contract terms covering deprecation, version pinning, successor access, export and data use.
- AI governance · Business continuity · Third-party risk
What if your AI model goes dark? Business continuity for AI dependencies
In June 2026 access to two frontier AI models was suspended for nineteen days under US export controls. Why AI governance must treat model availability as a risk, and how to plan for it.
- Data protection · PDPA · AI governance · Small business
Free AI tools and your data: what "we don't train on your data" really protects
Enterprise AI contracts promise no training on customer data. Small businesses often get an account setting instead. What that gap means under Singapore's PDPA, and a practical compliance posture for companies below the enterprise threshold.
- AI strategy · Procurement · Vendor lock-in
Build vs buy is the wrong AI question. Ask what it costs to leave
The best AI model changes every few weeks. Why switching cost, not build versus buy, should drive AI architecture and procurement decisions, and how bring-your-own-key and abstraction layers keep your exit open.
- AI governance · Professional liability · Legal profession
Can a lawyer be negligent for not using AI?
Singapore lawyers have paid personal costs for AI-invented citations, and the UK Jurisdiction Taskforce says a professional can be negligent for failing to use AI. Why the duty of care now cuts both ways.
- Cybersecurity · Incident response · AI procurement
Will your AI tools help you during a cyber attack? Testing refusal behaviour
When Hugging Face defended against an autonomous AI agent attack, a frontier model's guardrails got in the way. Why refusal behaviour belongs in AI procurement and incident response tabletop exercises.
- AI vendor risk · Data protection · Third-party risk
LLM routers and AI data risk: how your prompt reaches the model matters
The same AI model can be reached directly, through a cloud platform, or through an LLM router. Each route creates a different trust boundary. The questions to ask about who sees, logs and retains your prompts.
- PDPA · Data protection · AI governance · Singapore
PDPC generative AI guidelines: three issues for companies deploying AI
Points from a deployer's submission to Singapore's PDPC consultation on personal data in generative AI, covering no-training promises, the limits of data correction, and agentic memory as a new privacy surface.
- Legal profession · Legal tech · AI skills
What AI skills do junior lawyers actually need?
Prompt engineering isn't the skill that matters. Three AI skills junior lawyers and law students need, from someone building AI legal workflows in Singapore.