The AI CEO Brief · Operating card
Five checks before anything AI built goes live
Your people are already building small things with AI, usually in marketing or finance. Your checks were designed for work that humans wrote slowly. This is the one-page fix. It needs no IT department and costs nothing.
For any company · No IT department · Two minutes per job · Free
What happened
The company behind Singapore's first AI-related data breach did almost everything right, which is exactly what makes it useful.
An employee at Bee Cheng Hiang asked a generative AI tool to write a script for sending marketing emails in batches. Normal tool, normal task. The employee tested the work. The regulator confirmed afterwards that the tool had not malfunctioned. The prompt simply never said to hide recipients from each other, and the email addresses of 95,364 customers went out visible to one another.
The employee tested it by checking the activity logs, and the logs reported that the emails had sent successfully. They had. From the system's side, a successful disaster looks exactly like a success.
Nobody opened the email.
The Last Look
Is it written down?
One line is enough: what it does, who built it, what it touches. If it is not on the list, it does not run. You cannot check work you do not know exists, and most AI-built work in a company is invisible to the person accountable for it.
Does it touch a customer?
Their data, their money, or anything they will see. If yes, checks 3 to 5 are not optional. If no, use your judgement and move on. This is the only sorting you need and it takes a few seconds per job.
Did someone open the output?
Not the logs. Not a success message. Send it to three addresses you control and open all three. Look at the address field. Look at whether the right name sits on the right record. Look for anything visible that should not be. A log tells you something ran. It cannot tell you it was right.
Did a second person look?
Someone who did not build it. They are not reviewing code and nobody needs to read Python. They are looking at what arrives, with fresh eyes, for about a minute.
Does everyone know what to do if it goes wrong?
One named person, one number, and notify the regulator inside 48 hours. In Singapore’s first AI-related breach, reporting within two days ended in a voluntary undertaking and no fine. Speed is the cheapest control on this card.
The rule underneath all five
Never paste real customer records into a chat tool. Not to clean them, not to sort them, not to test something. That is a breach the moment you press enter, and no check further down this card will catch it.
Get the next one
The AI CEO Brief goes out every Sunday, 8PM Singapore time. One thing that matters, what to do about it, and roughly one of these cards a month.
Send it to your team
THE LAST LOOK Five checks before anything AI built goes live. 1. IS IT WRITTEN DOWN? One line: what it does, who built it, what it touches. If it is not on the list, it does not run. 2. DOES IT TOUCH A CUSTOMER? Their data, their money, or anything they will see. If yes, checks 3 to 5 are not optional. 3. DID SOMEONE OPEN THE OUTPUT? Not the logs. Not a success message. Send it to three addresses you control and open all three. Check the address field, check the right name is on the right record, check nothing is visible that should not be. A log tells you something ran. It cannot tell you it was right. 4. DID A SECOND PERSON LOOK? Someone who did not build it. Not a code review. They look at what arrives, for about a minute. 5. DOES EVERYONE KNOW WHAT TO DO IF IT GOES WRONG? One named person, one number, and notify the regulator inside 48 hours. THE RULE UNDERNEATH ALL FIVE Never paste real customer records into a chat tool. Not to clean them, not to sort them, not to test something. That is a breach the moment you press enter.
Where this failure hides
The pattern is always the same. Somebody automates a manual task, the output looks finished, nobody opens it. Six places to look, in the order they usually turn up.
| Where | How it fails |
|---|---|
| Bulk email and mail merges | Every recipient can see every other address |
| Spreadsheet formulas pulling customer records | The report leaves the company with more in it than intended |
| Automated replies in a support inbox | One customer’s details quoted back to another |
| Invoice and statement runs | A wrong loop sends person A’s balance to person B |
| Website and chatbot code | Visitor input logged somewhere nobody is watching |
| Data clean-up in a chat tool | The breach happens on paste, before anything runs |
Frequently asked
Based on Singapore's first AI-related data breach, reported to the Personal Data Protection Commission in 2026. The regulator found the AI tool had not malfunctioned; the gap was in testing and review.
Published by The AI CEO Brief. Forward it freely.
Get the next one
The AI CEO Brief goes out every Sunday, 8PM Singapore time. One thing that matters, what to do about it, and roughly one of these cards a month.