Organisations are adopting AI faster than they can govern it. Models now shape decisions on credit, pricing, hiring and customer service, employees use AI tools that were never approved, and vendors build AI into systems the company already depends on. The personal data behind those systems is regulated by the Personal Data Protection Act (PDPA). When something goes wrong, regulators, courts, boards and customers ask the same questions: who decided, on what evidence, and under what controls.

VA Partners builds governance that can answer those questions. We set decision rights and board oversight, tier AI uses by risk, run impact assessments, review vendor terms, and design data protection programmes around how data is actually collected and used. Programmes are aligned with Thailand's AI guidelines, sector guidance from the Bank of Thailand, the SEC and the OIC, and the PDPA, and with the EU AI Act, the GDPR, ISO/IEC 42001 and the NIST AI RMF where clients have international exposure.

When an incident occurs, from unauthorised AI use to a data breach or a harmful automated decision, we investigate. We establish what happened, reconstruct how data reached which systems, assess the legal, data protection and regulatory exposure, and quantify the impact. Where evidence must be collected to forensic standards, we work with specialist forensic partners and lead the matter through to remediation.

The practice combines law, economics and data science. Our team includes a co-author of Thailand's AI Guidelines (TAIG 1.0) and advisers to the OECD, ASEAN, UNESCO and the World Bank on AI governance and regulatory policy.