Insights · Framework sketch
AI-assisted coding: a framework sketch for a small F&B business
What a governance framework for AI-written code can look like in a business with no IT team: six parts, with the review step shown in full.
In September 2026 the PDPC accepted a voluntary undertaking from Bee Cheng Hiang, after an email script written with an AI tool exposed its members’ email addresses (our write-up of the incident). Under term (a), the company commits to “a governance framework for AI assisted coding, including requirements for independent technical review of AI-generated code involving personal data incorporating the 11 AI Governance Principles from the AI Verify Testing Framework” (the PDPC’s decision).
Staff in small businesses can now write scripts with a chatbot. This page sketches what such a framework could look like for one of them.
Illustrative only. This is not Bee Cheng Hiang’s framework and not legal advice. AI Verify is a voluntary testing framework, not a certification.
The business it is for
A family-run food brand. It sells online, keeps a members’ list for promotions, and has a marketing executive who uses a chatbot to write small scripts, for example to send the monthly promotion email. There is no in-house developer.
The framework in six parts
- Owner. One named person, usually the owner or the operations manager, is accountable for AI-written code and approves its use.
- Allowed tools and uses. A short list of approved AI tools and what staff may use them for. Customer data is never pasted into a chatbot.
- Independent review. Any AI-written code that touches personal data is reviewed by someone other than its author before it runs. The checklist is below.
- Pre-send test. Every bulk send is first tested on dummy accounts, and someone opens what arrives. The email platform is set to refuse a message with several recipients.
- Evidence kept. One log line for each review or test: who, what, when and the result.
- Training. A short session for anyone who writes or runs scripts, on these rules and the reasons for them.
Sample: the review checklist
The reviewer works through this list before the script runs on real customer data.
- The request to the AI tool said what the code must not do, for example “never put more than one address in the To or Cc field”.
- The reviewer did not write or prompt the code, and can explain what each line does.
- The reviewer has checked what personal data the code reads, where it sends it and what it writes to logs.
- The script has no passwords, keys or other secrets written into it.
- A test run on a dummy list is done. Each test email is opened, and the To and Cc fields show one recipient only.
- The first live run goes to a small batch, and someone checks the results before the rest go out.
- The sign-off is recorded in the log before the full run.
- If anything is unexpected, stop, fix and test again. If personal data has already gone out, follow the data breach procedure.
How the sketch maps to the 11 AI Verify principles
AI Verify lists 11 principles. For a small script that handles personal data, five carry most of the weight and the other six apply more lightly.
| Principle | Weight | How the sketch covers it |
|---|---|---|
| Accountability | Core | A named owner, and a sign-off recorded before the full run. |
| Human agency and oversight | Core | A person who is not the author reviews the code and can stop the run. |
| Security | Core | No secrets in scripts, and customer data stays out of chatbots. |
| Robustness | Core | A dummy-list test, a small first batch, and a platform that refuses messages with several recipients. |
| Data governance | Core | The reviewer checks what personal data the code reads, sends and logs. |
| Transparency | Lighter for this use | The allowed-tools list tells staff where AI tools are used. |
| Explainability | Lighter for this use | The reviewer can explain the code line by line. |
| Reproducibility | Lighter for this use | The log records who ran what, when, and the result. |
| Safety | Lighter for this use | Stop, fix and test again when anything is unexpected, and follow the breach procedure if data is exposed. |
| Fairness | Lighter for this use | A promotion email script makes no decisions about people. Fairness matters more when AI does. |
| Inclusive growth, societal and environmental well-being | Lighter for this use | Training helps more staff use AI tools safely. |
This page uses the principle names only. The AI Verify Foundation publishes the full framework, with its outcomes and process checks (see Sources).
Sources
- Personal Data Protection Commission, Voluntary Undertaking by Bee Cheng Hiang Marketing Pte Ltd, 21 September 2026.
- AI Verify Foundation, AI Verify Testing Framework, updated 29 May 2025.
- AI Sherpa, An AI-written email script exposes 95,364 customers’ email addresses, Notable AI Incidents.