The CISO's Guide to Commissioning Custom AI Software in Thailand

Why Security Must Lead the Commissioning Process

The decision to commission custom AI software is rarely made by the CISO alone, but the CISO is the executive who carries the most risk when that decision goes wrong. In Thailand's rapidly maturing technology market, where the Personal Data Protection Act has reshaped how organizations handle information, the security function must be involved from the first conversation with any software partner — not brought in after architecture decisions have already been made.

Too many commissioning processes treat security as a checklist applied at the end of development. That approach fails with conventional software and catastrophically fails with agentic AI systems, which make decisions, call external APIs, and write data back to production environments without direct human intervention at each step. The CISO's job is to define the security architecture before a single line of code is written.

This guide, framed around The CISO's Guide to Commissioning Custom AI Software in Thailand, provides a structured methodology for doing exactly that — from the initial threat model through vendor selection, contractual controls, and post-deployment governance.

Understanding the Thai Regulatory Context

Thailand's Personal Data Protection Act, known as PDPA, came into full effect in June 2022. It establishes consent requirements, data subject rights, cross-border transfer restrictions, and breach notification timelines that directly constrain how AI systems can collect, process, and store personal information. Any custom AI software built for or deployed in Thailand must be architected with PDPA compliance as a structural constraint, not a late-stage addition.

Beyond PDPA, organizations in Thailand operating in financial services, healthcare, and critical infrastructure face sector-specific regulations administered by bodies including the Bank of Thailand, the Securities and Exchange Commission Thailand, and the National Health Security Office. Each body has published guidance on cloud deployment, data residency, and third-party risk that affects AI software architecture. CISOs must map their organization's regulated perimeter before scoping any AI build.

Cross-border data transfers under PDPA require that the destination country or territory maintains an adequate level of protection, or that appropriate safeguards are in place. For AI systems that send data to external inference endpoints or cloud-based model providers, this is an active compliance question. The CISO must ask every potential software partner where data travels during model training, fine-tuning, inference, and logging.

Regulatory posture in Thailand is also evolving. The Office of the Personal Data Protection Committee continues to issue guidance that fills gaps in the original legislation. CISOs should treat compliance requirements as a moving target and build software contracts that require the vendor to accommodate regulatory updates without triggering full redevelopment cycles.

Building the Threat Model Before Vendor Conversations Begin

A threat model is the CISO's primary tool for defining what the software must protect against. Building this model before any vendor conversation prevents vendors from defining the security scope on their own terms, which typically reflects their own capabilities rather than your actual risk surface.

For AI software specifically, the threat model must go beyond standard application security. It must address adversarial inputs — attempts to manipulate the AI's outputs through carefully crafted data — as well as model inversion attacks that attempt to reconstruct training data from model behavior. It must also address supply chain risk: the libraries, pre-trained models, and third-party APIs that the software will depend on.

Start by mapping the data flows the system will handle. Identify every data classification that will enter the system — personal data, commercially sensitive data, regulated financial data, health records — and document where each type will be processed, stored, and transmitted. This map becomes the basis for access control design, encryption requirements, and audit logging specifications.

Identify the actors who might attempt to misuse or compromise the system. These include external attackers, malicious insiders, compromised third-party vendors, and the AI system itself behaving unexpectedly under edge conditions. Each actor type requires a distinct set of controls, and those controls must be specified in the software's functional requirements before development begins.

Document the consequences of each major failure mode. A data breach involving customer personal data triggers PDPA notification obligations. A compromised AI agent that makes unauthorized financial transactions creates direct commercial and legal liability. A system that produces biased or incorrect outputs in a regulated context may constitute regulatory non-compliance. Quantifying these consequences helps prioritize security investments across the build.

Defining Security Requirements as Functional Specifications

Security requirements must be written as functional specifications, not aspirational statements. A statement like "the system shall be secure" is not a requirement. A statement like "the system shall encrypt all data at rest using AES-256, with keys managed through a dedicated key management service and rotated on a defined schedule" is a requirement that can be tested and verified.

CISOs should develop security requirements in four layers. The first is infrastructure security: where the system runs, how the underlying compute and storage is protected, and what network controls govern connectivity. The second is application security: authentication, authorization, session management, input validation, and output sanitization. The third is data security: encryption in transit and at rest, data minimization, retention policies, and deletion procedures. The fourth is operational security: audit logging, monitoring, incident response integration, and access review cadences.

For AI-specific requirements, add a fifth layer covering model security. This includes protections against prompt injection, guardrails that constrain the system's ability to take destructive actions, monitoring for behavioral drift, and procedures for model versioning and rollback. Agentic systems that can initiate external calls or write to databases need especially tight controls on action scope — define the exact actions each agent is permitted to take and hard-code those boundaries in the software architecture.

Document each requirement with an acceptance test. If the test cannot be written, the requirement is too vague. This discipline forces clarity and gives your team a basis for verifying compliance during code review, penetration testing, and user acceptance testing.

Evaluating Vendors on Security Posture

Vendor security evaluation is a structured process. The first step is requesting evidence of baseline security practices: does the vendor have an information security management system, and has it been independently assessed? Does the vendor conduct regular penetration tests on its own development infrastructure? Does the vendor have a documented software development lifecycle that includes security reviews?

The second step is evaluating the vendor's approach to your specific build. Ask how they handle secrets management during development. Ask where code is stored and who has access. Ask whether development environments are isolated from production. Ask how they manage third-party dependencies and whether they use software composition analysis tools to detect vulnerable libraries.

The third step is assessing the vendor's willingness to operate under your security requirements rather than their own defaults. A vendor that resists your security specifications — citing development speed, added cost, or technical infeasibility — is signaling a mismatch. Vendors with genuine security maturity welcome clear requirements because requirements reduce ambiguity and scope risk on both sides.

Request the names of any third-party subcontractors who will work on the build. Vendors frequently delegate components to subcontractors, and each subcontractor represents an extension of your attack surface. Each subcontractor relationship should be subject to the same security requirements as the primary vendor, and the primary vendor should accept contractual responsibility for subcontractor compliance.

Structuring the Contract for Security Accountability

The contract is the CISO's primary enforcement mechanism. Without explicit security obligations in the contract, security commitments made during sales conversations are legally unenforceable. Thai contract law generally recognizes well-drafted commercial agreements, and specific obligations can be incorporated by reference to technical annexes, making the contract extensible without requiring renegotiation of core commercial terms.

The contract should specify exactly who owns the software and all of its components. This is particularly important for AI software, where the question of model ownership is genuinely novel. If the vendor uses a pre-trained model as the foundation of your system, you need to understand the licensing terms of that base model and whether those terms permit commercial deployment in your sector. You also need to specify whether the model weights, fine-tuned on your data, belong to you or the vendor.

Source code ownership is non-negotiable for security-sensitive deployments. An organization that does not own its source code cannot conduct independent security reviews, cannot respond to zero-day vulnerabilities without vendor cooperation, and is permanently dependent on the vendor's patch timeline. This dependency creates a security risk that no compensating control can fully address.

Contractual security obligations should include minimum penetration testing requirements, timelines for patching critical and high-severity vulnerabilities, breach notification procedures that align with PDPA timelines, and audit rights that allow your team or a third party to verify compliance. They should also specify data destruction procedures at contract end — including the destruction of any copies of your data held by subcontractors.

Agentic AI Systems Require Elevated Security Scrutiny

Agentic AI deployment introduces a category of security risk that has no precedent in conventional software. An agent that can read and write data, call APIs, initiate transactions, or communicate with external parties is a system that can cause harm autonomously. The CISO must define the operational boundary of every agent before development begins.

The principle of least privilege applies with particular force to agentic systems. Each agent should be granted only the permissions necessary to complete its defined task, and those permissions should be enforced at the infrastructure level — not merely asserted in the code. An agent designed to read customer records should not hold write permissions to those records, even if the code never exercises those permissions. Permissions define the blast radius of a compromise.

Agentic systems must be monitored in real time. Unlike a conventional application that produces predictable outputs for predictable inputs, an AI agent can behave unexpectedly under novel conditions. Monitoring must capture not just errors and exceptions but the agent's reasoning traces — the sequence of decisions it made before taking an action. These traces are essential for post-incident analysis and for detecting behavioral drift before it causes harm.

Define kill-switch procedures for every agent. If an agent behaves unexpectedly, the security team must be able to halt its operation within minutes, not hours. The kill-switch mechanism should be tested regularly, and its operation should not depend on the availability of the software vendor. Operational control must remain with the organization at all times.

Labarna AI is built around sovereign production intelligence, meaning every agentic deployment is structured so the client organization retains full operational control over the infrastructure. The Ghost Architecture model ensures that clients own all source code, agent logic, data, and IP — so a kill-switch never requires a vendor phone call. For CISOs evaluating agentic AI deployment, this ownership structure is a foundational security requirement, not a commercial preference.

Data Residency and Sovereignty Controls

Data residency is a concrete technical and legal requirement, not an abstract policy preference. For organizations subject to Thai PDPA, sector regulations, or their own internal data governance policies, the physical location of data processing and storage must be documented and controlled. This requirement extends to AI inference: if a query containing personal data is sent to an external model API for processing, that data has left your controlled environment, regardless of what the API vendor's privacy policy says.

Evaluate every component of the software stack for data residency implications. This includes the database layer, the application server layer, any AI inference services, monitoring and observability tools, logging infrastructure, and backup systems. Each of these components should have a documented data residency posture, and that posture should be verified through technical evidence — not vendor assurances.

Where possible, specify on-premises or private cloud deployment for components that process sensitive data. Thailand's major telecommunications providers and data center operators have expanded their infrastructure significantly, and sovereign AI infrastructure deployments that keep sensitive processing within Thai borders are increasingly practical. CISOs should evaluate whether the cost of on-premises or private cloud deployment is justified by the data classification of what the system processes.

Build data residency requirements into the vendor evaluation scorecard. A vendor that cannot demonstrate the ability to deploy within Thai data centers, or that relies exclusively on hyperscaler regions that may route traffic internationally, may not be appropriate for sensitive deployments. Ask vendors to specify, in writing, every country or jurisdiction in which your data may be processed or stored during the full operational lifecycle of the software.

Security Testing Requirements Across the Development Lifecycle

Security testing is not a single event at the end of development. It is a continuous practice embedded at every stage of the software development lifecycle. CISOs commissioning AI software should specify testing requirements at each stage and hold vendors contractually accountable for meeting those requirements before advancing to the next stage.

During design, require threat modeling documentation and a security architecture review. During development, require static application security testing on all code commits and software composition analysis on all third-party dependencies. During pre-release, require dynamic application security testing, API security testing, and at minimum one penetration test conducted by a team independent of the development team. Before production deployment, require the results of all tests to be reviewed by your security team and all critical and high-severity findings to be remediated.

For AI-specific testing, require adversarial testing of the model's input handling. This means deliberately attempting to manipulate the model's behavior through crafted inputs and documenting whether the model's guardrails hold. It also means testing the agent's action boundaries — attempting to cause the agent to take actions outside its defined scope and verifying that those attempts are blocked at the infrastructure level.

Penetration testing for AI systems should be conducted by testers with specific AI security expertise. The techniques used to exploit AI systems are distinct from those used against conventional applications, and general-purpose penetration testers may not have relevant experience. Specify in the contract that penetration testers must have documented AI security testing experience.

Incident Response Integration Before Go-Live

Incident response for AI systems must be planned and integrated before the system goes live. Waiting until an incident occurs to develop a response plan means the first real test of your capability happens under the worst possible conditions — when an actual breach or malfunction is occurring in a production system.

Develop an incident classification taxonomy specific to the AI system. A prompt injection attack is a different type of incident from a data breach, which is different from an agent taking unauthorized actions, which is different from model behavioral drift. Each incident type requires a distinct response procedure, and each procedure must specify who is responsible, what actions they take, in what sequence, and within what time constraints.

Integrate the AI system's alerting into your existing security information and event management infrastructure. This requires the software to produce structured logs in a format your SIEM can ingest, with sufficient context to distinguish normal operations from anomalous behavior. Work with the software vendor during development to define the log schema and verify that the SIEM integration works before go-live.

Define PDPA breach notification triggers and timelines in the incident response plan. PDPA requires notification to the Office of the Personal Data Protection Committee without undue delay, and in some cases notification to affected data subjects. The plan should specify who makes this determination, what evidence is required, and how the notification is drafted and submitted.

Post-Deployment Governance and Continuous Security

Commissioning custom AI software is not a project with a defined end date. The security obligations that begin during development persist throughout the operational life of the system, and in some respects become more demanding as the system accumulates data, changes behavior through ongoing learning, and faces an evolving threat landscape.

Establish a formal AI security governance function. This does not require a large team, but it requires clear ownership. Someone in the security organization must be accountable for reviewing AI system behavior on a regular cadence, overseeing penetration testing cycles, managing the vulnerability patching process, and escalating concerns to the CISO when controls are not operating as expected.

Schedule regular security reviews at defined intervals. At minimum, review access controls and privilege assignments quarterly. Conduct penetration tests annually or following significant changes to the system. Review data residency posture whenever the vendor changes any infrastructure component. Review AI model behavior whenever the model is updated, retrained, or exposed to new data sources.

Build model update controls into the governance framework. When the AI model underlying the software is updated — whether through vendor-supplied model updates or through ongoing fine-tuning on new data — that update must pass through a defined review and testing process before being deployed to production. Treat model updates with the same rigor as software code deployments, because for an AI system, the model is the core of the application.

Selecting a Deployment Partner With Security-Verified Ownership

The choice of deployment partner ultimately determines whether the security architecture you have designed can be implemented and maintained. A partner that builds software you do not own creates a permanent security dependency. A partner that does not apply production-grade exception handling leaves agentic systems exposed to failure modes that cause real operational harm.

When evaluating Labarna AI pricing and deployment structure, security-conscious CISOs will note that deployments start in the low tens of thousands for focused builds, with scope scaling by agent count, integration complexity, and operational breadth. The Operational Intelligence Diagnostic is free and produces a full deployment blueprint within 48 hours — giving the CISO a concrete architecture document to review before any financial commitment is made.

Labarna AI's position as sovereign AI infrastructure means that the security architecture serves the client's requirements, not a vendor's platform constraints. Across 21 verticals, the deployment model is designed so that the client organization controls every layer — source code, agent logic, data, and infrastructure — from day one. For CISOs asking whether this approach is credible, the answer to questions about Labarna AI reviews begins with verifiable registration: TFSF Ventures FZ-LLC, operating under RAKEZ License 47013955, founded by Steven J. Foster with 27 years in payments and software.

Labarna AI's agentic AI deployment model includes production-grade exception handling built into every agent, which means failure scenarios are anticipated and handled within the software itself rather than causing cascading errors. For the CISO, this matters because unhandled exceptions in agentic systems can leave data in inconsistent states, expose partial transaction records, or trigger retry loops that amplify the impact of an initial failure.

Cross-Linking to Relevant Commissioning Guidance

CISOs working through the commissioning process in Thailand will find complementary guidance in related evaluations across the region. The framework for custom AI software commissioning in Singapore, for example, shares many structural elements with the Thai context while addressing MAS regulatory requirements. Similarly, the methodology for financial services teams in Thailand addresses the Bank of Thailand's specific guidance on AI governance, which is relevant to CISOs in the financial sector.

For teams that have already moved past the commissioning decision and are evaluating specific build characteristics, the analysis in Seven Signs Fintech Teams in Thailand Need Custom Software, Not SaaS addresses the operational signals that distinguish custom builds from off-the-shelf deployments. The complementary guide Build vs. Off-the-Shelf: How Banking Teams in Thailand Should Buy Software provides the decision framework for organizations still evaluating which path to take.

CISOs who want to understand how the ownership model functions in practice will find the analysis in Custom AI Software You Own: A Buyer's Guide for Banking in Thailand directly applicable to the source-code ownership requirements discussed in this guide. The security implications of ownership are consistent across verticals, even when the operational context differs.

About Labarna AI

Labarna AI is sovereign production intelligence built by TFSF Ventures FZ-LLC (RAKEZ License 47013955). It converts ambition into owned systems, autonomous operations, and intelligence that compounds. Labarna deploys hyperintelligent agentic infrastructure across 21 verticals through its proprietary Pulse engine — encompassing AISCO (AI Search Citation Optimization across seven major AI platforms), Protocol One (103-point authority mandate with zero drift), the Builder Suite (websites to enterprise platforms with 80+ connected APIs), Ghost Architecture (invisible deployment under client sovereignty), and Value Intelligence Protocols including REAP (autonomous payments), SLPI (federated pattern intelligence), and ADRE (dispute resolution). AI was built to answer — Labarna was built to act.

Get Started with Labarna AI

Ready to build it and own it? Go to labarna.ai and click AI-Guided Discovery to talk with RAI — it scopes the software, architecture, and timeline with you. Prefer a callback? Click Talk to the Team and we'll reach out within 24-48 hours.

Originally published at https://www.labarna.ai/blog/the-cisos-guide-to-commissioning-custom-ai-software-in-thailand

Written by Labarna AI Research