Ts. Lukas J. Tan

In the age of AI, protecting what we have built is just as important as building something new.

Synopsis

Businesses are adopting artificial intelligence, cloud technology and automation faster than ever. Yet one of the most basic questions is often overlooked: what happens when important business information is lost, damaged or compromised? The 3-2-1 Backup Rule offers a practical approach that organisations of almost any size can understand and apply. From small businesses to multinational corporations, the principle remains surprisingly relevant. This article explores how different organisations approach backup protection, why having multiple copies does not automatically guarantee safety, and why responsible technology leadership requires us to think carefully about both innovation and recovery.

1. We Keep Building New Technology, But Are We Protecting What We Already Have?

Over the years, I have worked with businesses that want to digitalise their operations, develop software, move systems to the cloud and, increasingly, introduce artificial intelligence into their daily work.

The conversations usually begin with exciting possibilities. How can we automate repetitive tasks? How can we improve productivity? Can we use AI to reduce operating costs? Can we build a system that helps employees work faster and make better decisions?

These are important questions, and I strongly believe businesses should continue exploring new technology.

However, there is another question that deserves equal attention.

What happens if everything we have built suddenly becomes unavailable?

Imagine spending years developing a customer database, maintaining financial records, building internal systems and collecting important business information. One morning, an employee accidentally deletes a folder. A computer fails. A cloud account is compromised. Or ransomware encrypts important business files.

Suddenly, the conversation changes from innovation to survival.

Many companies believe their information is protected because their computers automatically back up files or because they subscribe to cloud storage services. Unfortunately, storing files in the cloud and maintaining recoverable backups are not necessarily the same thing.

For example, synchronisation services may copy accidental deletions or unwanted changes across connected devices. A backup application may also successfully copy files that were already damaged or compromised.

The problem is that a backup system does not automatically know whether the information it is preserving is correct.

This is why I believe data protection should become a normal management conversation, not something discussed only after a serious incident.

Fortunately, there is a simple principle that almost every business owner can understand.

It is called the 3-2-1 Backup Rule.

2. What Is the 3-2-1 Backup Rule?

The 3-2-1 Backup Rule is one of the most widely recognised principles in data protection. Its strength is its simplicity. You do not need to be a cybersecurity professional to understand it.

The first number, 3, means keeping at least three copies of important information. One is the original working copy, while the other two serve as backups. If the primary system fails, the organisation still has alternative copies available.

The second number, 2, means storing those copies using two different types of storage or media. For example, a business might maintain information on its computer systems while keeping backups on a separate storage device and in a cloud backup service. The objective is to avoid relying entirely on one storage technology.

The final number, 1, means keeping at least one backup off-site. If a fire, flood, theft or other incident affects the office, the organisation should still have access to information stored elsewhere.Consider a small business with customer records, quotations and accounting documents. It might maintain its working information on office computers, keep an automatic backup on a separate storage device and maintain another encrypted backup in a cloud service.

That is a practical example of applying the 3-2-1 principle.

Of course, the arrangement must be properly maintained. The backup should be protected against unauthorised access, and the company should occasionally test whether its files can actually be recovered.

The United States Cybersecurity and Infrastructure Security Agency has long recommended maintaining offline backups and regularly testing recovery procedures as part of protection against ransomware.

The important lesson is that the 3-2-1 rule is not about purchasing expensive equipment. It is about reducing the chances that a single failure will destroy everything.

It also gives business owners an easy way to begin asking the right questions about information security.

3. How Small Businesses and Growing Companies Can Apply 3-2-1

A backup strategy should match the size and complexity of the organisation. Small businesses do not need to copy the infrastructure used by multinational corporations, but they should understand what information is essential to their survival.

Consider a microbusiness with five employees. Its important records may include invoices, customer contacts, business correspondence and financial documents. The company may rely on laptops, cloud applications and a shared folder.

At this level, automatic backups, a separate encrypted storage copy and a protected off-site copy can provide a sensible starting point. The owner should also ensure that at least one person knows how to recover the information if the person normally responsible is unavailable.

Now consider a growing company with 30 to 50 employees. The situation becomes more complicated. Different departments may maintain separate records, including sales information, accounting documents, inventory, payroll and internal operational data.

For this organisation, backing up individual computers may no longer be sufficient. Management should understand where important information is stored, which systems need protection and how frequently backups should be performed.

The company should also avoid giving unnecessary backup access to every employee. Someone who can edit an operational document should not automatically have permission to delete all backup copies.

As the business grows, responsibilities must become clearer. Who monitors backup failures? Who checks storage capacity? Who maintains access credentials? Who verifies that recovery is possible?

These questions do not necessarily require a large IT department. They require clear ownership and consistent practices.

For many small and medium enterprises, the greatest improvement may come not from purchasing additional software but from documenting and regularly reviewing an existing backup process.

The 3-2-1 rule provides the foundation. Good management turns that foundation into a reliable routine.

4. How Larger Corporations and Enterprises Approach Backup

When an organisation grows to hundreds or thousands of employees, backup becomes closely connected to business continuity.

Consider a manufacturing company operating several production facilities. Its operations may depend on inventory systems, order processing, financial applications and production scheduling. Losing access to these systems could delay deliveries, interrupt production or affect customer commitments.

The company therefore needs more than additional copies of files. It must decide which systems should be restored first and how long each department can operate without them.

A hospital has different priorities. Patient records, appointment systems and clinical applications must remain accurate and accessible. The consequences of unavailable or incorrect information can be significantly more serious than ordinary administrative inconvenience.Financial institutions also face demanding requirements. Beyond safeguarding customer information, they need to consider record integrity, access controls, audit requirements and continuity of critical services.

Large multinational enterprises introduce another layer of complexity. They may operate across countries, cloud platforms and multiple offices, each with different systems and operational dependencies.

Such organisations commonly adopt more advanced backup arrangements, including separate recovery environments, protected backup storage, restricted administrative access and regularly scheduled disaster recovery exercises.

Some use storage that cannot be changed or deleted during a defined protection period, often referred to as immutable storage. This can help protect backups from attackers attempting to erase recovery options.

Although the technologies become more sophisticated, the basic principle remains familiar. Maintain multiple copies, avoid depending on a single storage environment and ensure that at least one protected copy survives an incident affecting the primary location.

The difference is in the scale of implementation and the consequences of failure.

A small company may need to recover its accounting documents. A manufacturing company may need to restore its production operations. A bank may need to maintain continuity across critical financial services.

Each organisation requires a different recovery plan, but all benefit from the same fundamental thinking.

5. The Biggest Risk: What If Your Backup Is Already Compromised?

There is one issue I believe deserves more attention, particularly as businesses increasingly adopt AI and automation.

What if the backup itself is no longer trustworthy?

Imagine a company that performs automatic backups every evening. Everything appears normal, and the backup reports show successful completion.

However, an attacker has quietly gained access to a computer or business system. Before anyone notices, important information has been altered, malicious software has been introduced or unauthorised changes have been made.

The backup process continues saving the information every night.

When the company eventually discovers the attack, it may find that its newest backup also contains compromised information.

This situation highlights an important distinction.

Successfully backing up information does not necessarily mean successfully protecting the business.

Even strong encryption cannot determine whether the original information was correct before it was backed up. Encryption helps prevent unauthorised reading, but it cannot independently identify every malicious change inside the original files.

This is why companies should retain appropriate historical backups instead of relying on a single recent copy.

They should also test recovery periodically, monitor unusual activity and protect backup access from unnecessary exposure.

In more serious incidents, the organisation may need to investigate which backup was created before the compromise and verify the recovered environment before using it again.

Artificial intelligence makes this consideration increasingly relevant.

Today, businesses are experimenting with AI agents capable of reading documents, modifying files, updating databases and executing workflows. These capabilities can improve productivity, but an incorrectly configured automated process can also make unwanted changes at considerable speed.

The issue is not that AI is inherently unsafe. It is that greater automation requires greater attention to permissions, monitoring and recovery.

When technology performs more actions on our behalf, we must ensure we retain sufficient control over those actions.

We should not assume that every automatically created backup is safe simply because the software reports success.

Sometimes, the most valuable backup is not the newest one. It is the most recent copy we can confidently establish as clean and recoverable.

6. Build for the Future, Protect What MattersI have always believed that technology should help businesses move forward.

We should continue developing software, adopting artificial intelligence, automating operations and creating better ways of working. Innovation is essential for competitiveness, particularly as organisations face increasingly rapid technological change.

But I also believe that building technology comes with responsibility.

When we create a system, we should not think only about how powerful it can become. We should also consider what could go wrong, how information is protected and how the organisation would recover if something unexpected happened.

This is an area of technology to which I pay particular attention.

Even when discussing a new application, automation workflow or AI solution, I find myself considering questions that may not immediately appear in the project requirements.

Where will the information be stored? Who can access it? What happens if the information is accidentally modified? Can previous versions be recovered? What if an account is compromised? Would an attacker be able to affect the backups as well?

These questions reflect how I approach technology development.

I enjoy building things and moving quickly. But I am equally conscious that the systems we create may eventually hold information that customers, employees and organisations depend upon.

For me, cybersecurity is not simply about installing security products. It involves paying attention to the details, understanding potential risks and making deliberate decisions about how systems should operate.

The same thinking applies to governance. Responsible innovation requires us to consider not only what technology allows us to do, but also how we maintain control and accountability.

The 3-2-1 Backup Rule is an excellent example because it makes an important security principle accessible to everyone. Whether operating a small business or leading a large enterprise, management can begin by asking whether critical information has sufficient protection and whether recovery has actually been tested.

A backup is not something we should create once and forget. As the organisation grows, its information, systems and risks will change. Protection measures must evolve alongside them.

I often see businesses investing considerable resources in creating new capabilities. They are willing to pay for automation, digital transformation and AI adoption because they can see the potential benefits.

I believe we should give the same attention to protecting what those investments produce.

After all, there is little value in developing an advanced digital operation if a single incident can destroy years of work.

My approach to technology has always involved the determination to build and the discipline to consider the consequences of what we build.

We should move fast when creating new possibilities, but remain careful when protecting what others have entrusted to us.

The next time you review your company's technology, try asking three simple questions.

Do we have three copies of our important information? Are those copies protected across different storage environments? And if something goes wrong, can we confidently recover a clean version?

If the answers are uncertain, the 3-2-1 Backup Rule is a good place to begin.

Because building a successful digital business is important. Ensuring that the business can survive an unexpected incident is equally important.

We build technology to move businesses forward. We protect it because we understand what is at stake.

Ts. Lukas J. Tan

Technology Entrepreneur | Software Builder | AI & Cybersecurity Educator

Dream It. Execute It. Ground It.

Synopsis

AI Future Makers (AIFM) Bootcamp 2026 is a talent development and innovation programme organised by the Penang Digitalisation–AI Conference & Expo (PDX), co-hosted by Agensi Pekerjaan CKM Sdn Bhd, and led by Ts. Lukas J. Tan, CEO of OPERiON Ecommerce & Software Sdn Bhd. Bringing together 98 young talents from 22 universities across Malaysia, the programme challenges participants to develop AI solutions addressing real-world human resource problems, including candidate screening, interviews, recruitment, employee retention and workforce development. Beyond technical knowledge, it emphasises creativity, courage, independent thinking and execution, empowering emerging talents to remain relevant, adaptable and competitive as AI transforms the workforce.

AI Future Makers is part of PENtastic Startup Month 2026, a wider entrepreneurship and innovation initiative led by Digital Penang, a Penang State Government-owned company focused on advancing the state's digital economy. Following the strong positive response to this year's competition, the AIFM organisers plan to expand the initiative to SMEs, entrepreneurs and innovators at the Penang Digitalisation–AI Conference & Expo (PDX2027). The vision is to create a sustainable platform where emerging talents and industry innovators can showcase practical AI solutions, strengthen their human capabilities and transform innovative ideas into meaningful business and career opportunities.

1. Penang Welcomes Nationwide Young Innovators

PENANG, 7 November 2026 — A total of 98 participants from 22 universities across Malaysia, representing 41 team and individual entries, participated in AI Future Makers Bootcamp 2026, a nationwide talent development and innovation initiative designed to address real-world industry challenges while nurturing future-ready capabilities. Following four weeks of workshops, mentoring and preliminary pitching, 20 finalist entries advanced to the Grand Final at SEGi College Penang, the Official Venue Sponsor, competing for a total prize pool of RM10,000. YAB Tuan Chow Kon Yeow, Chief Minister of Penang, is scheduled to attend the Prize Presentation Ceremony, where the achievements of the finalists will be recognised. The programme is organised by the Penang Digitalisation–AI Conference & Expo (PDX), co-hosted by Agensi Pekerjaan CKM Sdn Bhd, and led by Ts. Lukas J. Tan, CEO of OPERiON Ecommerce & Software Sdn Bhd. It is also part of PENtastic Startup Month 2026, a wider entrepreneurship and innovation initiative led by Digital Penang, bringing together ecosystem activities to strengthen Penang's startup and digital economy development.

2. Addressing Industry Talent Challenges Through AI

Led by Ts. Lukas J. Tan, Chairman of AI Future Makers Bootcamp 2026, the initiative emerged from industry engagement through PDX, where engineering talent shortages, workforce development challenges and the growing gap between available talent and industry expectations were identified. The competition encourages participants to explore how artificial intelligence can improve the way organisations discover, engage and develop human potential, while addressing practical challenges faced by today's businesses. Beyond technological innovation, AIFM also provides an opportunity to connect expertise across human capital development, education and industry, encouraging knowledge exchange and new approaches to workforce transformation. Lukas, a Professional Technologist registered with the Malaysia Board of Technologists (MBOT), believes that meaningful innovation requires both technological capabilities and a deeper understanding of people and industry needs. "AI can transform how organisations operate, but developing human potential requires experience, collaboration and the right ecosystem. Through AIFM, we hope to bring together different perspectives and expertise to explore practical solutions. As we move towards PDX2027, we look forward to strengthening these connections and creating more opportunities for collaboration between industry professionals, innovators and the wider business community," he said.

3. Preparing Young Talents to Thrive Beyond Technical Skills

As AI becomes increasingly capable of writing software, analysing information, developing applications and automating routine processes, Lukas believes the next generation must develop strengths that extend beyond technical proficiency. While technical knowledge remains important, creativity, critical thinking, leadership, adaptability and the ability to execute ideas are increasingly essential for long-term employability. AI Future Makers therefore welcomed talents from both technical and non-technical disciplines, guiding them through workshops, industry mentoring, collaborative problem-solving and pitching exercises. The judging framework evaluated not only the AI applications but also problem understanding, innovation, business potential, teamwork and presentation capabilities. "If everyone can access the same AI tools, what makes one graduate different from another? We should not prepare our younger generation merely to compete with AI in performing technical tasks. We must develop their inner strengths, confidence and ability to create value. Our objective is not merely to help young talents survive the AI transformation, but to develop the capabilities to grow stronger through it," Lukas explained.

4. Recognising the Courage to Innovate — Even Alone

Among the 60 entries, Lukas was particularly encouraged by participants who chose to compete individually, demonstrating the courage to develop and present their ideas without relying on a team. He believes this willingness to take initiative represents an important quality that should be encouraged among young people, especially when opinions and discussions are often more visible than genuine execution. "Voices are loud, but execution is often limited. Many people have ideas, but fewer are willing to take the first step to make something happen. I was particularly impressed by those who dared to participate alone. They may not have the perfect team or resources, but they were willing to create, learn and demonstrate what they could achieve," Lukas said. He added that not every capable individual receives the same opportunities or recognition, and that talent should not remain hidden simply because someone lacks confidence, connections or visibility. "Do not wait for someone to discover your talent. Be brave enough to propose an idea, demonstrate your abilities and take action. I would rather see an imperfect solution that has been created than a brilliant idea that has never been attempted. That is the spirit of innovation we want to promote through AI Future Makers," he emphasised.5. Strengthening Penang's Industry and Talent Ecosystem

The Final Pitching Day brought together representatives from established corporations, industry organisations and the professional community, providing emerging talents with valuable exposure beyond the academic environment. As part of PENtastic Startup Month 2026, AI Future Makers also contributes to the wider innovation ecosystem led by Digital Penang, bringing together talents, businesses and industry expertise to encourage meaningful collaboration. The programme reflects a shared interest in recognising emerging potential, fostering innovation and strengthening the connection between talent development and industry needs.

Christine Chuah, representing co-host Agensi Pekerjaan CKM Sdn Bhd, highlighted the importance of recognising talent beyond conventional recruitment criteria. "In recruitment, we often see capable individuals whose potential may not be fully reflected in their qualifications or resumes. What employers increasingly value is the ability to communicate, adapt, solve problems and take initiative. AI Future Makers provides an opportunity for emerging talents to demonstrate these qualities through practical innovation. We hope this platform will encourage greater understanding between employers and talents, while helping organisations recognise capabilities that might otherwise go unnoticed," she said.

6. From Caterpillar to Butterfly — Let Your Ideas Shine

Carrying the theme "From Caterpillar to Butterfly — Let Your Ideas Shine", AI Future Makers Bootcamp 2026 represents the transformation of young people as they discover their strengths, develop confidence and learn to turn ideas into practical solutions. The programme celebrates not only its winners, but also the determination, teamwork, resilience and personal growth demonstrated throughout the innovation journey. The organising committee expressed appreciation to Digital Penang for bringing together the wider PENtastic Startup Month ecosystem, SEGi College Penang as the official venue sponsor, and the programme's sponsors, mentors, judges, educational institutions and supporting partners. For Lukas, the strong response to this year's competition has reinforced the potential for AI Future Makers to become a broader innovation platform. "Not everyone will become a champion, and not every idea will succeed on the first attempt. But every individual who dares to step forward and take action has already made meaningful progress.

My message to future talents is simple: Do not wait to be discovered. Dare to innovate, dare to create and dare to demonstrate what you are capable of. We look forward to carrying this spirit into PDX2027, where SMEs and innovators will have opportunities to showcase their AI capabilities and practical solutions. Stay tuned for PDX2027 — the next chapter of AI innovation in Penang," he concluded.

The Hidden Responsibility Behind Giving Intelligent Systems Access to Our Digital World

Synopsis

As Artificial Intelligence becomes increasingly integrated into business operations, organisations are connecting intelligent systems to email platforms, customer databases, financial applications, internal documents and enterprise software. These connections make AI more capable, allowing it to retrieve information, coordinate activities and execute tasks across different environments. Yet every additional connection introduces an important question that is often overlooked in the excitement surrounding automation: just because an AI system can access something, does that mean it should? Drawing from his experience in software development, enterprise transformation and AI implementation, Ts. Lukas J. Tan explores the distinction between technological capability and authorised responsibility. He argues that the next stage of responsible AI adoption requires businesses to think beyond data security alone and examine how permissions, authority, human judgment and organisational trust must evolve alongside increasingly autonomous systems.

The Moment Technology Becomes More Powerful Than We Intended

There is a particular satisfaction that comes from connecting two systems that previously operated independently. For someone who has spent many years developing software, I have always appreciated the possibilities created when information begins flowing more efficiently between applications. A customer management system can communicate with an accounting platform, a website can connect directly to business operations, and information that once required manual handling can become available almost immediately. Every successful integration offers the possibility of improving productivity, reducing errors and allowing people to concentrate on work that creates greater value.

Artificial Intelligence has introduced an entirely new dimension to this process. Instead of connecting applications only through predefined workflows, we can increasingly build intelligent systems that interpret instructions, retrieve information and decide how to use the tools made available to them. An AI assistant may begin by summarising documents, but with additional integrations, it can become capable of examining customer records, coordinating administrative activities, preparing communications and supporting operational decisions. For a software developer, these possibilities are exciting because they offer new ways to solve problems that previously required considerable technical effort and human coordination.

However, I have noticed that enthusiasm for increasing technological capability can sometimes cause us to overlook a more fundamental question. As a system becomes capable of accessing more information and performing more activities, are we deliberately expanding its authority, or are we simply enabling whatever functionality is technically available?

The distinction is important because technology does not become responsible merely by becoming more capable. An AI model may be able to interpret a request, identify a relevant database and execute a particular action, but that does not establish whether the action is appropriate for the organisation or consistent with the permissions that should govern its operations. An intelligent system can perform a technically valid action while still producing an outcome that management never intended.

I believe this is one of the defining challenges emerging from the development of Agentic AI. The question is no longer limited to whether an application functions correctly. We must increasingly ask whether the system possesses the appropriate authority to perform each function, whether the organisation understands the boundaries of that authority and whether those boundaries remain effective as the technology evolves.

From Information Access to Operational Authority

In traditional business software, access permissions have long been an essential aspect of system design. Employees may receive different privileges depending on their responsibilities, while administrators establish boundaries intended to protect information and maintain operational control. An accounting employee may require access to financial records, but that does not automatically mean the employee should be authorised to approve every payment. A salesperson may need customer information to manage relationships, but it would rarely be appropriate to provide unrestricted access to confidential employee records.

These distinctions seem natural when we discuss people because organisations understand that the ability to access something is not the same as having legitimate authority to use it for every purpose. Yet when AI applications are introduced, the same principles can become less visible. Business owners may focus on connecting the necessary systems and enabling the desired automation without examining whether the permissions granted to the AI are broader than the task actually requires.

Consider an AI application designed to help a sales team prepare customer follow-up communications. Initially, the system may need only limited access to relevant customer information and historical correspondence. If the company later allows the same application to modify customer records, create quotations or send messages automatically, its responsibilities have expanded considerably. The change may appear to be a routine improvement in functionality, but it represents a meaningful increase in operational authority.

The implications become more significant when AI is connected to multiple enterprise systems. An intelligent agent with access to email, internal documents, customer information and business applications may be capable of combining information that was previously separated across departments. Such integration can improve efficiency, but it can also create new pathways through which information may be used, disclosed or acted upon in ways that the organisation did not originally anticipate.

In my view, this is why AI governance must extend beyond the conventional question of whether data is secure. Security remains essential, but organisations must also examine whether the system is authorised to use available information for a particular purpose and whether the actions it performs remain within appropriate business boundaries.

The fact that information is accessible does not automatically make every possible use of that information legitimate or appropriate. Responsible implementation requires a clear distinction between what a system is technically capable of doing and what the organisation has deliberately authorised it to do.

The Invisible Expansion of Permission

One of the most interesting characteristics of modern software development is how easily capabilities can accumulate over time. An application rarely remains exactly as it was when first deployed. Developers introduce improvements, businesses request new functions, and integrations are added as operational requirements evolve. These changes are often beneficial because they allow software to adapt to the needs of an organisation.

With AI, however, the consequences of incremental changes deserve particularly careful consideration. A system that initially performs a limited task may gradually receive additional permissions without undergoing a complete reassessment of its operational role. New APIs may be connected, access to further databases may be granted, and automated actions may be introduced as confidence in the technology increases. Each enhancement appears reasonable when considered independently, yet the combined result may be a system with substantially greater authority than originally intended.

This creates what I consider an important management challenge: the invisible expansion of permission. Organisations may recognise that their AI has become more functional without fully recognising that it has also become more influential within their operations.

In software development, a permission setting may appear to be a small technical detail. In business governance, however, that setting can determine whether a system is allowed to observe information, modify records, communicate externally or initiate an action with real consequences. The same technical connection may therefore carry very different levels of responsibility depending on how it is configured and used.

My experience has made me increasingly sensitive to these distinctions. I enjoy building systems that can perform more work, but I also recognise that the ability to create an integration does not remove the need to consider its consequences. A well-designed system should not require unlimited authority to provide meaningful value. In many circumstances, its usefulness can be preserved while limiting access and maintaining appropriate human oversight.

This is not an argument against technological progress. It is an argument for ensuring that progress remains deliberate rather than accidental. When an organisation expands the capabilities of an AI system, it should also understand how that expansion changes the system's responsibilities, risks and relationship with the people whose information it processes.

The Data Behind Every Digital Action Belongs to Someone

As developers, we frequently work with databases, records, identifiers and information structures. These elements are necessary for building applications, and they allow organisations to manage large volumes of information efficiently. Over time, it can become easy to think about data primarily in technical terms: fields, records, tables, access permissions and processing requirements.

Yet I believe one of the most important habits in responsible software development is remembering that personal data is not merely a technical resource. Behind many records is an individual whose circumstances, expectations and privacy may be affected by how that information is handled.

A customer database may contain information about personal preferences, purchasing behaviour and communication history. An employee system may contain confidential employment details. A recruitment application may contain information about education, experience and career opportunities. When AI is introduced into these environments, the organisation must consider not only whether the technology can process the information accurately, but also whether the processing is appropriate for the intended purpose.

This sensitivity has become increasingly important to me because modern AI systems can bring together information from multiple sources with extraordinary convenience. The ability to combine information may create useful insights, but it may also introduce risks when the combined information reveals details that were not apparent in the original records. Data that seems ordinary in one context can become more sensitive when connected to other information.

I do not believe businesses should avoid using data simply because it carries responsibility. Information is essential to modern operations, and intelligent analysis can help organisations make better decisions. However, the ability to generate additional insights does not automatically justify every possible use of personal information.

Responsible AI development requires an understanding of purpose, proportionality and the expectations of the people affected by the system. These considerations should influence how we design applications and how we determine which information an AI system is allowed to access.

For me, protecting data is ultimately about protecting trust. A technically successful system can still damage confidence if people believe their information has been used beyond reasonable expectations. Rebuilding that confidence may be considerably more difficult than correcting a software defect.

The Human Consequences of a Technically Correct Action

Not every problem created by automation involves a security breach or an incorrect database operation. Sometimes, an AI system may perform exactly the action it was instructed to perform while creating an outcome that is inappropriate in the human context.

Imagine an AI assistant that is authorised to send follow-up messages to customers who have not responded to earlier communications. The application may accurately identify pending enquiries, prepare professional messages and deliver them according to a schedule. From a technical perspective, the automation works as intended.

However, a customer may be dealing with circumstances that are not visible to the system. A previous reply may have suggested hesitation or dissatisfaction. The relationship may require a more personal approach, or the timing of the communication may be inappropriate.

I have always been sensitive to these aspects of human interaction. Sometimes, the wording of a message makes me reconsider how a situation should be handled. A particular phrase or an unexpected response may prompt an inner feeling that there is more to understand. I do not treat that feeling as evidence, because human interpretation can be mistaken, but I regard it as a reason to examine the context more carefully.

This distinction matters when AI is authorised to communicate or act on behalf of an organisation. The system may be capable of producing convincing language, but persuasive wording does not guarantee an understanding of the relationship behind the conversation. An automated response may be accurate and grammatically correct while still creating an impression that the organisation is insensitive or unwilling to listen.

Such outcomes remind me that governance involves more than controlling technical operations. It also involves understanding the consequences of allowing technology to act within relationships shaped by human expectations, uncertainty and emotion.

The objective should not be to require human approval for every routine message or administrative activity. That would undermine many of the advantages of automation. Instead, organisations should recognise that different actions carry different consequences and that some situations require more careful treatment.

Good judgment involves knowing when speed is appropriate and when a person deserves greater attention.

Why Governance Must Move Alongside Innovation

There is a tendency to view governance as something introduced after technology has been developed. A team builds an application, demonstrates its functionality and then considers the policies and procedures required to operate it responsibly. This approach may appear efficient because technical development progresses without interruption, but it can create difficulties when governance concerns are discovered only after the system has become deeply integrated into business operations.

I believe governance should be considered alongside development rather than treated as a separate activity that follows it. This does not mean every software experiment requires extensive documentation or formal approval. Exploratory work is essential to technological innovation, and developers need room to test ideas, learn from mistakes and discover possibilities that were not initially anticipated.

However, when a system begins interacting with real business information or receiving authority to execute operational actions, its responsibilities change. The developer and the organisation should understand those changes before treating the system as a routine part of daily operations.

This principle reflects how I prefer to approach technology. I want to move quickly, experiment and develop practical solutions, but I also want to remain conscious of the conditions under which those solutions will operate. The objective is not to create unnecessary bureaucracy. It is to recognise that different activities require different levels of care.

A reversible experiment using non-sensitive test information presents a different situation from an automated workflow that modifies live customer records. An internal assistant preparing draft material carries different implications from a system sending messages to external parties. The appropriate governance arrangements should reflect these differences.

In my view, effective governance makes innovation more sustainable because it allows organisations to understand the boundaries within which technology can operate confidently. When permissions, responsibilities and escalation processes are clear, developers and business users can move forward without relying entirely on assumptions.

The strongest implementation is not necessarily the one with the fewest restrictions. It is the one where the controls are proportionate to the risks and sufficiently clear that everyone involved understands what the system is intended to accomplish.

The Business Owner Must Remain in Control

As intelligent systems become more capable, business owners may increasingly rely on technology providers to determine how AI should operate. This is understandable because many organisations do not possess extensive internal expertise in software engineering, cybersecurity or artificial intelligence. SMEs in particular often depend on external developers and commercial technology platforms to introduce new capabilities.

Nevertheless, the decision to delegate work to AI remains a business decision as well as a technical one. A developer can explain what the system is capable of doing, but the organisation must understand why those capabilities are necessary, which activities are appropriate and what responsibilities accompany their use.

This does not mean every business owner must become a software engineer. In fact, one of the responsibilities of technology practitioners is to translate complex technical possibilities into practical choices that management can understand. A responsible implementation process should help leaders recognise the implications of different levels of automation and make informed decisions about the authority being granted.

For local software developers and technology consultants, this creates an opportunity to contribute more meaningfully to digital transformation. Our role should not be limited to delivering requested functionality. We can also help organisations examine their processes, identify unnecessary complexity and understand how emerging technologies may affect their operations.

I believe this is particularly important as Malaysia continues developing its AI ecosystem. The country's proposed Artificial Intelligence and Personal Data Protection Framework provides an opportunity to examine how existing data protection responsibilities apply to increasingly capable AI systems. As the technology evolves, industry dialogue can help clarify practical issues surrounding external AI providers, access permissions, human oversight and accountability.

The ultimate objective should be responsible innovation that businesses of different sizes can understand and implement. Governance should not exist only as a theoretical framework. It should help organisations make better decisions about how technology is used.

The Authority We Give AI Reflects the Judgment We Exercise

When I look towards the future of enterprise AI, I do not believe the most successful organisations will necessarily be those that connect the greatest number of applications or deploy the largest number of agents. These measurements may indicate technological ambition, but they do not automatically demonstrate responsible management or meaningful business value.A more important measure may be whether the organisation understands the authority it has delegated and can explain why that authority is appropriate.

AI should be allowed to perform tasks that create genuine value, and businesses should remain willing to explore increasingly sophisticated applications. I believe strongly in innovation, practical development and the courage to move beyond familiar limitations. At the same time, I recognise that every additional capability deserves to be considered in relation to its purpose, consequences and effect on the people involved.

For me, the relationship between building and governance has become increasingly inseparable. I want systems that work, but I also want to understand what they are permitted to do and how their actions will be supervised. I want businesses to move quickly, but not so quickly that they lose awareness of the information, relationships and responsibilities affected by their decisions.

This is the perspective I bring to conversations about enterprise AI implementation. Before discussing how many applications can be connected, I am interested in understanding the organisation's objectives, the information required and the decisions that should remain under human control. Often, the quality of these early questions determines whether an AI project becomes a meaningful business improvement or simply another layer of technical complexity.

I welcome discussions with business leaders, technology practitioners and industry organisations that are exploring how intelligent systems can be integrated into operations responsibly. The opportunities are significant, but so is the responsibility to ensure that technology serves the organisation without exceeding the authority it has been given.

As AI becomes more capable, we should continue asking what it can do. That question drives innovation and helps us discover possibilities that were previously unavailable. But we must also develop the discipline to ask what it should be allowed to do, because that question determines whether innovation remains aligned with human judgment, organisational responsibility and trust.

The future of responsible AI will not be defined by unlimited access. It will be defined by the wisdom with which we grant authority.

And that leads me to the question I believe every business leader should consider before connecting another system to an AI agent: if the technology can access almost everything, have we taken enough care to decide what it actually needs?

Ts. Lukas J. Tan is the Founder & CEO of OPERiON Ecommerce & Software Sdn Bhd. A software development and enterprise digital transformation practitioner since 2007, he writes about Artificial Intelligence, responsible technology implementation, business leadership and the relationship between innovation, governance and human judgment.

For discussions on enterprise AI implementation, software development and responsible AI governance, visit [www.lukastan.com](http://www.lukastan.com/) or contact [email protected]_._this is article for social media manager

Building Fast Is a Capability. Knowing What Should Be Controlled Is a Responsibility.

## Synopsis

As Artificial Intelligence evolves from a tool that assists people into systems capable of performing tasks independently, businesses are beginning to imagine a future in which digital workers operate alongside human employees. Yet the excitement surrounding AI agents and automated workforces often overlooks a more fundamental challenge: who is responsible for managing the authority, behaviour and consequences of these intelligent systems? Drawing on nearly two decades of entrepreneurship, software development and enterprise transformation, Ts. Lukas J. Tan reflects on the lessons of growing a technology company, the changing meaning of management and the importance of preserving human judgment in an increasingly automated world. He argues that the future of AI leadership will require an unusual combination of qualities: the courage to build quickly, the discipline to govern responsibly and the sensitivity to recognise that behind every piece of data, business process and message lies a human consequence.

## The Entrepreneur Who Wants to Build, and the Voice That Tells Him to Think Again

I have always been attracted to the possibility of building something that does not yet exist. Perhaps it began with my early fascination with computers, when technology still felt like a mysterious world of machines, cables and commands. Over the years, that fascination gradually developed into a professional journey involving software development, business systems, cloud infrastructure and enterprise digital transformation. What has remained consistent is my natural inclination towards execution. When I encounter a promising idea, I instinctively begin considering how it might be transformed into a working application, a practical business process or an entirely new approach to solving a problem. I am rarely satisfied with discussing possibilities indefinitely when there is an opportunity to test them in the real world.

This instinct has become even stronger with the emergence of Artificial Intelligence. For someone who has spent years building software and managing technology projects, AI represents far more than another generation of digital tools. It offers the possibility of fundamentally changing how systems are developed, how information flows through organisations and how work is coordinated. Tasks that once required extensive manual intervention can increasingly be supported by intelligent applications, while processes that previously depended on several employees may be redesigned around smaller teams and automated systems. Naturally, I find these developments exciting. I want to understand what is possible, experiment with emerging capabilities and move quickly enough to turn technological potential into practical value.

Yet there is another side to the way I approach technology, one that may not be immediately obvious to people who associate software entrepreneurs with speed, efficiency and innovation. I am also highly conscious of governance, sensitive to how information is handled and attentive to the consequences of actions that may initially appear insignificant. Sometimes, even a short message can cause me to reconsider a situation. A particular word, an unusual tone or a response that arrives at an unexpected moment may trigger an internal sense that something deserves closer examination. I do not assume that this instinct is always correct, but I have learned that it can be valuable as a reminder to slow my judgment, consider another person's perspective and ask whether there is more to the situation than the words themselves reveal.

These two characteristics may appear contradictory. One encourages me to build, experiment and move forward without unnecessary hesitation, while the other makes me cautious about information, authority and human consequences. Over time, however, I have come to believe that they are not opposing qualities at all. They are complementary disciplines that become increasingly important as technology grows more powerful. The ability to build quickly creates opportunity, but the willingness to examine consequences creates trust. Without execution, ideas remain unrealised; without judgment, even impressive technological achievements can produce outcomes that their creators never intended.

It is from this perspective that I have begun thinking more deeply about the next stage of Artificial Intelligence. As businesses move beyond using AI to generate content and begin allowing intelligent systems to carry out operational tasks, the challenge is no longer simply whether the technology can perform the work. A more difficult question is emerging: if AI becomes part of our workforce, who is prepared to manage it?

## What Managing Forty People Taught Me About the Future of AI

During the earlier years of my entrepreneurial journey, I understood business growth in a relatively conventional way. As opportunities increased, the company needed more employees to manage the expanding workload. Software projects required developers, design work required creative talent, customer relationships demanded attention and everyday operations depended on administration and coordination. What began as a small team eventually grew into an organisation of approximately forty people, a development that represented both an important business achievement and a significant personal learning experience.

Managing a growing organisation taught me that business complexity does not increase in a simple, predictable relationship with the number of employees. A larger workforce introduces additional communication channels, overlapping responsibilities, departmental priorities and decisions that must pass between individuals before reaching execution. The organisation may become more capable, but it can also become slower if its operating structure does not evolve alongside its growth. As a founder, I began spending increasing amounts of time coordinating work rather than directly creating it, and I discovered that managing the organisation itself had become a substantial responsibility.

Like many entrepreneurial journeys, mine did not follow a continuous upward trajectory. The business experienced different stages of expansion, difficulty, restructuring and transformation. At a later point, the team became considerably smaller, and that experience forced me to reconsider assumptions I had previously accepted about the relationship between manpower and business capability. I began questioning whether growth always required additional people, whether every established process genuinely contributed to value creation and whether organisational structures sometimes survived simply because they had become familiar. These were not comfortable questions, but they changed the way I thought about management and technology.

When Artificial Intelligence began demonstrating its ability to support increasingly complex activities, those earlier experiences became especially relevant. I could see the possibility of coordinating work through intelligent systems rather than relying exclusively on traditional departmental structures. Software development, research, administrative support, communications and information analysis could potentially be connected through a different operating model. The attraction was not merely reducing labour requirements. It was the possibility of redesigning how a business functions, removing unnecessary layers of coordination and allowing human employees to concentrate on activities where experience, relationships and judgment create the greatest value.

However, my previous experience managing a human workforce also made me recognise a problem in the growing enthusiasm for AI workers. An organisation that struggles with unclear responsibilities will not automatically become better managed because its tasks are delegated to intelligent software. If the business process is poorly designed, AI may simply execute that process faster. If management does not understand which activities are important, automation may produce more reports, notifications and transactions without improving the quality of business decisions. Technology can reduce certain operational burdens, but it cannot independently determine what kind of organisation a business should become.

This is why I believe that the rise of AI workers requires us to reconsider management before we reconsider headcount. The important question is not how many artificial employees a company can deploy, but how intelligently the organisation can combine human talent, redesigned processes and machine capability. Without that understanding, businesses may reproduce their existing management problems in digital form, creating a workforce that operates continuously without necessarily moving the organisation in a meaningful direction.

## The Difference Between Performing Work and Carrying Responsibility

The expression “AI employee” has become popular because it provides a convenient way to describe intelligent systems that can perform activities traditionally associated with human workers. An AI agent may prepare documents, examine information, assist with software development, communicate through connected applications or coordinate routine workflows. When these capabilities are presented together, it is easy to imagine a digital workforce capable of supporting business operations throughout the day and night. For an entrepreneur who has experienced the challenges of recruiting, training and coordinating employees, the possibilities are undeniably attractive.

Nevertheless, I believe we must be careful about allowing a useful analogy to become an inaccurate understanding of responsibility. An AI system is not a human employee, even when the work it performs resembles a human task. Employees operate within professional, social and organisational relationships. They may understand context through personal experience, recognise subtle emotional signals and exercise judgment based on responsibilities that extend beyond explicit instructions. AI can imitate aspects of these capabilities through sophisticated language processing and pattern recognition, but this does not mean it possesses human awareness, personal accountability or the same capacity to understand the moral weight of a decision.

Consider the way an experienced employee handles a sensitive customer complaint. The employee may read the message, recall the history of the relationship and recognise that the customer is expressing disappointment without stating it directly. Instead of sending an immediate response, the employee may decide to consult a manager, review the underlying problem or contact the customer personally. That decision may depend on information that is difficult to capture in a standard workflow, including the relationship between the individuals involved and the potential consequences of choosing the wrong words.

An AI system may also analyse the complaint, identify possible intentions and generate a response that appears thoughtful and appropriate. In many cases, such assistance can be valuable. The difficulty emerges when we assume that the system's ability to generate a convincing response is equivalent to understanding the full human situation. Language can be ambiguous, emotions are not always expressed directly and even experienced people can misinterpret the intentions of others. Automated systems should not be granted unlimited confidence merely because their responses sound persuasive.

If the organisation authorises AI to communicate directly with customers, modify records or execute consequential actions, the responsibilities associated with those activities do not disappear. A message sent by an AI system still represents the organisation. An inappropriate disclosure can still damage trust. An automated decision can still affect an individual's opportunities or circumstances. The business cannot simply explain an unfortunate outcome by pointing towards the technology that produced it, because the decision to deploy that technology and define its authority remains a matter of organisational responsibility.

This distinction is central to how I believe AI management should develop. Delegating a task is not the same as delegating accountability, and enabling software to perform work does not remove the need to supervise the consequences of that work. The more capable an AI system becomes, the more deliberately we must consider the limits of its authority.

## Why a Single Message Can Matter More Than a Thousand Automated Actions

One aspect of technology governance that receives relatively little attention is the sensitivity of human communication. In software development, we naturally focus on data accuracy, security permissions, system performance and the reliability of automated workflows. These are essential responsibilities, but they do not capture every consequence that technology can create. Sometimes, the greatest impact of an automated process is not a technical failure at all. It is the effect of a message on the person who receives it.

I have become increasingly conscious of this distinction in my own interactions with people. A brief reply can occasionally communicate more than a lengthy explanation, particularly when its tone differs from the pattern of an established relationship. A person may express agreement while feeling uncertain, respond politely while experiencing disappointment or avoid discussing a sensitive matter directly. These possibilities do not mean that every short message conceals an emotional problem, and it would be equally unwise to assume that personal intuition can reliably reveal another person's private thoughts. What matters is recognising that human communication contains uncertainty and that responsible judgment sometimes requires us to examine the context rather than act immediately on an interpretation.

Imagine a customer responding to a company's proposal with the sentence, “It's fine. We can talk about it another time.” A straightforward automated workflow might classify the matter as postponed, update the customer record and schedule a follow-up. An AI system could generate a courteous acknowledgment and complete the administrative process within seconds. From the perspective of operational efficiency, the task appears successful. Yet a human familiar with the relationship might wonder whether the response indicates genuine agreement, hesitation or disappointment. The appropriate response could depend on previous conversations and circumstances that are not fully represented in the immediate message.

For me, this illustrates a broader point about the limits of automation. The value of communication cannot always be measured by how quickly a message is processed, classified or answered. A technically correct response may still be insensitive, while a delayed response made after careful consideration may protect a relationship that is far more valuable than the time saved through automation. This does not mean AI should never communicate with customers. Rather, organisations should understand which situations are suitable for routine automation and which deserve greater attention because the consequences of misunderstanding may be significant.

The same sensitivity applies to personal information. Behind each customer record is a person whose circumstances may not be visible to the software processing the data. A database field may appear routine to a developer, but its contents may be personally significant to the individual concerned. A record that is technically accessible is not automatically appropriate for every business purpose, and information that can be combined across systems is not necessarily information that should be combined without further consideration.

This is one reason I do not regard governance as a subject confined to legal documentation or cybersecurity procedures. Good governance involves understanding how technology affects people, including the effects that cannot easily be measured through system performance statistics. A business may avoid a data breach yet still damage trust through careless communication. An automated workflow may operate exactly as designed yet still create an outcome that management would have questioned if it had understood the human context.

As AI becomes more deeply integrated into business operations, I believe the ability to recognise these distinctions will become an increasingly valuable management quality. Technology can support communication at scale, but scale also increases the responsibility to ensure that the organisation does not lose its sensitivity to the people it serves.

## When Access Becomes Authority

One of the most significant changes introduced by Agentic AI is the growing relationship between access to information and the ability to perform actions. Traditional business applications generally operate according to defined processes, while increasingly capable AI systems may interpret instructions, select tools and coordinate activities across several connected services. This can create substantial operational benefits, particularly when organisations want to reduce repetitive work and allow information to move more efficiently between applications.

However, every new integration introduces questions about authority. An AI assistant that can read a customer database has a different operational role from one that can modify customer information. A system authorised to prepare an email draft is not performing the same function as one permitted to send that email automatically. A tool that analyses financial information has different implications from a system capable of initiating financial transactions. Although these capabilities may appear to be natural stages in the development of increasingly useful AI, each involves a different relationship between technical possibility and organisational permission.

I find this distinction especially important because software development naturally encourages us to explore what can be connected. Once an application is working, the next question often concerns additional functionality, improved integration or reduced manual intervention. With modern AI, it can become technically straightforward to expand a system's reach across business applications. The danger is that organisations may treat these integrations as ordinary functionality enhancements without recognising that they are also expanding the operational authority granted to the system.

A company may introduce an AI assistant to prepare reports, then allow it to retrieve information directly from internal systems. Later, the same assistant may receive permission to update records or trigger business workflows. No individual development step may appear particularly dramatic, yet the cumulative result could be an AI system with substantial influence over daily operations. If management has not reviewed the purpose and boundaries of these additional capabilities, the organisation may discover that it has delegated more authority than originally intended.

This is why I believe the governance of AI cannot focus exclusively on the protection of information. Personal data protection remains essential, but the increasing ability of AI systems to act creates an additional need to understand what actions are authorised, under what circumstances and with whose approval. The distinction is not an argument for avoiding AI integration. It is an argument for designing integration with a clearer understanding of responsibility.

In my own approach to technology, I want systems to become more capable, but I also want the authority granted to those systems to remain deliberate. I do not regard these objectives as competing priorities. Appropriate boundaries can make advanced automation more dependable by reducing ambiguity about what a system should do and what should remain under human control. The objective is not to restrict every action, but to ensure that expanding technological capability does not quietly become unrestricted operational permission.

## A Workforce That Never Sleeps Still Needs Management

The prospect of AI systems operating continuously is particularly attractive to business owners. Tasks can be processed outside normal office hours, information can be prepared before employees begin work and routine activities can be coordinated without waiting for manual intervention. For smaller organisations, these capabilities may create opportunities that previously required larger teams and more extensive administrative resources.

Yet continuous operation introduces its own management challenges. Human organisations contain natural pauses through meetings, working hours and supervisory reviews. These are not always efficient, but they provide opportunities for people to notice mistakes, reconsider priorities and intervene when something appears unusual. An automated workflow can operate at a pace that removes many of these pauses, potentially completing large numbers of activities before anyone examines the results.

When the workflow is well designed, this speed can create substantial value. When the process contains an error or operates under inappropriate assumptions, the same speed can amplify the consequences. A mistaken update to a single customer record may be inconvenient, but an automated process that repeatedly applies the same mistake across many records can create a much larger problem. Similarly, an AI system that continuously generates unnecessary reports and notifications may increase information overload rather than improve decision-making.

This leads to a question I believe deserves greater attention in business discussions about AI productivity. Are we measuring how much work technology performs, or are we measuring the value that work creates? A system that produces hundreds of outputs may appear productive, yet those outputs may require extensive checking, create unnecessary distractions or fail to influence any meaningful business decision. The quantity of automated activity should not be confused with the quality of organisational outcomes.

I have become increasingly convinced that businesses should reconsider their processes before automating them. Many activities survive within organisations because they were introduced at a particular moment and subsequently became routine. Reports are prepared because management requested them years earlier, information is passed between departments because the workflow was designed around an older organisational structure, and employees repeat administrative tasks because nobody has questioned whether those tasks remain necessary.

AI provides an opportunity to challenge these habits. Instead of simply automating every existing process, organisations can reconsider why particular activities exist, what decisions they support and whether the same objectives could be achieved more effectively through a redesigned operating model. Sometimes the greatest improvement does not come from executing a task faster, but from discovering that the task can be simplified or eliminated altogether.

For me, this is the difference between introducing AI tools and genuinely transforming a business. One approach makes the existing organisation faster. The other asks whether the organisation itself should operate differently.

## The Management Structure Behind an Intelligent Organisation

If AI becomes an increasingly important part of everyday business operations, companies will eventually need to reconsider how responsibility is assigned. Traditional management structures establish reporting relationships between employees, supervisors and organisational leaders. These arrangements are intended to ensure that activities are coordinated, important decisions are reviewed and responsibilities remain identifiable.

AI systems introduce a different form of delegation, but they do not remove the underlying need for accountability. A business may deploy several intelligent agents to support different functions, yet someone must still understand why each system exists, what it is permitted to accomplish and how its performance should be evaluated. Without this clarity, organisations risk creating a collection of automated activities that operate independently without contributing to a coherent business objective.

I do not believe every company requires a large governance department or an elaborate management hierarchy for AI. Such an approach would be impractical for many SMEs and might undermine the flexibility that makes AI attractive in the first place. Instead, governance should reflect the nature of the activities being performed, the sensitivity of the information involved and the potential consequences of an incorrect action. A system preparing routine administrative summaries does not necessarily require the same level of supervision as one participating in consequential employment or financial decisions.

What matters is that responsibility should remain clear. When an AI system performs an activity, the organisation should understand who owns the process, who determines the permissible boundaries and how concerns are escalated when the outcome requires further attention. Effective management does not mean approving every individual action. It means establishing a structure in which authority is appropriately delegated and important consequences do not disappear into the complexity of automated systems.

This is also why I believe the management of AI cannot belong exclusively to technical teams. Developers understand the capabilities and limitations of software, but business leaders understand the objectives, relationships and priorities of the organisation. Responsible implementation requires these perspectives to work together. The technical ability to create a workflow does not automatically establish whether the workflow is commercially appropriate, ethically acceptable or consistent with the organisation's responsibilities.

As AI becomes more capable, leadership will increasingly involve deciding not only what technology can perform, but what work should be delegated, what judgment must remain human and how the organisation evaluates the consequences of that delegation. In this sense, AI does not make management obsolete. It changes the questions that good management must answer.

## Governance Is Not the Opposite of Innovation

There is a perception that governance slows down progress, particularly among organisations eager to experiment with emerging technology. Policies, approval processes and risk assessments are sometimes viewed as obstacles that prevent innovative ideas from reaching implementation. I understand why this perception exists. As someone who enjoys building software and moving ideas into execution, I have experienced situations in which excessive procedures created unnecessary complexity without improving the final result.

However, I do not believe the choice is between moving quickly and acting responsibly. That is a false distinction. Well-designed governance should help an organisation understand which activities can proceed rapidly, which require additional safeguards and which involve consequences that justify closer examination. It should support proportionate decisions rather than impose identical restrictions on every application of technology.

A minor adjustment to a website interface can usually be tested and reversed without significant consequences. An automated action involving sensitive customer information deserves a different level of consideration because the impact of an error may be more difficult to undo. The appropriate response is not to slow every development activity to the same pace, but to recognise the difference between reversible experimentation and actions that can affect people, finances or trust.

This is particularly relevant for Malaysian SMEs, many of which are eager to adopt AI but operate with limited technical and administrative resources. Governance frameworks that are excessively complicated may discourage responsible adoption or create compliance requirements that smaller organisations struggle to understand. At the same time, vague guidance may leave businesses uncertain about how to manage the risks associated with increasingly autonomous applications.

Malaysia's proposed Artificial Intelligence and Personal Data Protection Framework reflects an important effort to address the responsible processing of personal information through AI systems. The draft acknowledges the importance of security, organisational oversight, risk assessment and controls throughout the AI lifecycle. As these discussions develop, I believe practical perspectives from software developers, business operators and technology implementers can help ensure that governance remains both meaningful and achievable.

The objective should be to encourage innovation that businesses and individuals can trust. Strong governance, when implemented intelligently, is not simply a legal obligation or administrative requirement. It can become part of the foundation that allows organisations to deploy technology more confidently and sustainably.

## The Human Judgment We Must Not Surrender

Beyond the questions of technology and business management, I believe AI raises a deeper concern about the way human beings make decisions. As intelligent systems become more convenient, there is a natural temptation to rely on them without examining their recommendations as carefully as we might have done in the past. An answer that arrives instantly and appears professionally written can feel convincing, even when its assumptions are incomplete. An automated decision may appear objective because it is produced by software, even though the system may rely on imperfect information or inappropriate criteria.

The greatest risk may not always be an AI system making an obvious mistake. It may be an organisation becoming so accustomed to automated output that fewer people feel responsible for questioning it. When technology prepares every report, we may gradually stop examining the purpose of the reports. When AI drafts every customer response, we may become less attentive to the subtleties of communication. When intelligent systems coordinate entire workflows, we may overlook the assumptions embedded in the processes they execute.

This is where my own sensitivity to information and communication becomes especially relevant to how I think about AI. I value efficiency, but I also recognise the importance of that internal moment when something does not feel quite right. Sometimes it is a discrepancy in data; sometimes it is an unusual message or a decision whose consequences seem inconsistent with the stated objective. That feeling does not provide an answer, but it can prompt an important question. It reminds me that human judgment begins with awareness and must be followed by evidence, context and careful consideration.

I would not want technology to remove that habit of questioning from the way I work. On the contrary, I want AI to create more space for meaningful thinking by reducing unnecessary administrative burdens. The purpose of intelligent automation should be to strengthen our ability to make informed decisions, not to encourage us to abandon responsibility for those decisions.

As machines become more capable, the value of human leadership may increasingly reside in the ability to establish direction, recognise uncertainty, understand consequences and decide when an action requires more than technical confidence. These are qualities that cannot be measured simply through processing speed or the number of tasks completed.

## Building an Organisation That Can Move Fast Without Losing Its Conscience

Looking back over my entrepreneurial journey, I see how much my understanding of technology has changed. In the beginning, I was fascinated by what computers could do. Later, I became interested in how software could help businesses operate more efficiently. As my company grew, I learned that technology alone could not solve every organisational problem and that management structure, communication and human relationships were just as important as technical capability.

Today, Artificial Intelligence brings these lessons together in an unexpected way. It gives us the opportunity to develop systems that can perform increasingly complex work, but it also forces us to reconsider how responsibility should be distributed between human beings and technology. The question is no longer simply how many people a business needs or how many tasks can be automated. It is how the organisation should be designed so that intelligent systems contribute to genuine value while remaining subject to appropriate human judgment and control.

I want to continue building. I want to experiment with new technologies, develop practical AI applications and explore ways for smaller organisations to achieve capabilities that were previously beyond their reach. I believe entrepreneurs should have the courage to move forward rather than wait until every uncertainty disappears. Progress has always required experimentation, and technological leadership demands a willingness to challenge familiar assumptions.

But I also want to remain sensitive to the responsibilities that come with that ambition. I want to recognise when personal information deserves additional protection, when a message requires more thoughtful handling and when an automated action could produce consequences that are not immediately visible to the system executing it. I want the companies I help to become more capable without losing their sense of responsibility towards customers, employees and the people whose information they hold.

To me, this is not about choosing between innovation and governance. It is about recognising that responsible governance is part of building technology well. A capable AI system may help an organisation move faster, but a thoughtful management structure determines whether that speed serves a worthwhile purpose. The future belongs not simply to companies that deploy more AI, but to organisations that understand how to combine machine capability with human judgment.

## The Next Conversation I Want to Have with Business Leaders

As more companies begin exploring AI workers, I believe the most valuable discussion is not about how quickly another agent can be deployed. It is about understanding the organisation that will receive that agent, the authority it will be given and the responsibilities that must remain with people. This is where my experience as a software developer, entrepreneur and business transformation practitioner comes together. I am interested not only in explaining what AI can do, but in helping organisations examine what they are trying to achieve and how their systems should be designed to support those objectives responsibly.

I welcome opportunities to engage with business leaders, industry organisations and technology stakeholders who recognise that AI adoption is entering a more demanding stage. Developing an application is one challenge; integrating it into real operations is another. Establishing the boundaries within which it can operate, protecting sensitive information and maintaining trust require an additional level of thinking that deserves attention from the beginning rather than after a problem has occurred.

My approach has always been practical. I prefer ideas that can be developed, tested and implemented, and I believe progress should be visible in how an organisation actually operates. Yet I am equally convinced that effective implementation must be accompanied by appropriate governance, clear accountability and a sensitivity to human consequences. Technology should help businesses move forward without making them careless about the people who depend on them.

Perhaps that is the kind of leadership the AI era will increasingly demand: leaders who are ambitious enough to build what has not existed before, disciplined enough to define the limits of what they create and thoughtful enough to recognise when the human element matters more than another automated action.

We are entering a period when companies may be able to build an AI workforce more quickly than they can develop the management practices required to supervise it. The organisations that recognise this imbalance early may be better prepared for the changes ahead. They will understand that intelligence is not the same as wisdom, execution is not the same as judgment and the ability to delegate work does not remove the responsibility to govern its consequences.

For me, the objective is clear. I want to keep building, keep learning and keep moving forward, but never become so impressed by the speed of technology that I forget the importance of responsibility. As AI becomes part of our workforce, the central challenge will not simply be teaching intelligent systems how to perform more work. It will be ensuring that the people leading those systems remain conscious of why the work matters, what consequences it may create and who must ultimately answer for the results.

The day AI becomes part of our workforce should not be the day we surrender management to machines. It should be the day we become more deliberate about what responsible leadership truly means.

---

Ts. Lukas J. Tan is the Founder & CEO of OPERiON Ecommerce & Software Sdn Bhd. A software development and enterprise digital transformation practitioner since 2007, he writes about Artificial Intelligence, business transformation, responsible innovation and the evolving relationship between human judgment and intelligent systems. His work focuses on translating emerging technologies into practical business applications while promoting thoughtful governance and accountability.

For industry dialogue, enterprise AI implementation and discussions on responsible AI adoption, visit www.lukastan.com or contact [email protected].

Introduction

When people first see ScamAlert Junior™, they usually notice the colourful illustrations, cheerful characters, and engaging comic stories. What many do not see is the amount of planning, research, educational thinking, and creative development that happened long before the first page was illustrated. Creating a meaningful educational intellectual property is very different from simply creating a comic book. Every character, every personality, every conversation, and every visual element must serve a larger educational purpose.

From the beginning, my vision was never to produce a single publication that children would read once and place on a bookshelf. I wanted to build something that could continue growing over many years while remaining relevant to future generations. That meant thinking beyond stories and artwork. It meant building an educational universe where every character, every activity, and every future product would consistently reinforce the same values of critical thinking, responsible digital behaviour, empathy, and lifelong learning. ScamAlert Junior™ was therefore designed not merely as a publishing project, but as an original Malaysian educational intellectual property that could evolve across books, schools, digital platforms, animation, merchandise, and community programmes without losing its educational identity.

Every Character Started with an Educational Mission

One of the first decisions made during the development of ScamAlert Junior™ was surprisingly simple: we would not begin by designing the characters’ appearance. Instead, we began by asking a much more important question — what should each character teach? This educational-first approach became the foundation for the entire project. Rather than creating attractive illustrations and then inventing personalities afterwards, every character was first given a clear educational purpose, moral values, communication style, and behavioural role within the story.

Lukas was designed to represent careful observation and critical thinking. Leo encourages curiosity, confidence, and learning through exploration. Lynn reminds children to pay attention to details while showing empathy towards others. Johan and Lina demonstrate responsible parenting and healthy family communication, while Atuk Hassan bridges traditional wisdom with today’s digital world. Turbo, our official mascot, brings excitement and emotional connection, helping children associate digital safety with fun rather than fear.

This approach ensures that every story naturally reinforces educational objectives instead of forcing lessons into the narrative. Children are not simply reading adventures. They are observing different personalities solving problems together using observation, communication, responsibility, and teamwork. Over time, these values become part of the reading experience without making the stories feel like formal classroom lessons.

By placing education before illustration, ScamAlert Junior™ became more than entertainment. Every character was intentionally created to become a positive role model capable of supporting children’s learning both inside and outside the classroom.

Building a Professional Character Asset Library

As the characters gradually developed, it became clear that consistency would become increasingly important if ScamAlert Junior™ were to grow beyond books. A character appearing in a comic today might eventually appear in animation, educational games, classroom resources, merchandise, exhibitions, or digital applications tomorrow. Without clear standards, characters can easily lose their identity over time as different artists, designers, or production teams interpret them differently.

To address this challenge, every official ScamAlert Junior™ character was documented through a comprehensive Character Asset Library. Each library goes far beyond visual appearance. It defines personality traits, educational purpose, behavioural principles, communication style, official colours, facial expressions, body proportions, poses, costumes, props, commercial usage guidelines, and even restrictions on how the characters should never be portrayed.

This level of documentation is common among established animation studios and global entertainment brands because consistency builds recognition and trust. Whether Lukas appears in a printed comic, a classroom poster, an animated video, or a future mobile application, children should immediately recognise him as the same thoughtful, responsible character they already know.

More importantly, the Character Asset Library protects the educational philosophy behind the intellectual property. It ensures that future adaptations continue promoting the same positive values regardless of the platform. In many ways, these documents become the foundation that allows the ScamAlert Junior™ universe to grow responsibly without compromising its original mission.

Thinking Beyond One Comic Book

Many intellectual properties begin with a successful book and only later explore opportunities in animation, merchandise, or educational programmes. ScamAlert Junior™ was approached differently. From the very beginning, the project was designed as an educational ecosystem rather than a single publication. Every creative decision was made with long-term adaptability in mind.

The comic serves as the starting point because stories create emotional engagement and introduce children to the characters naturally. However, the same educational messages can also be reinforced through activity books, classroom worksheets, teacher guides, parent discussion materials, digital learning applications, educational games, workshops, exhibitions, and community awareness campaigns. Each platform reaches children differently while maintaining the same learning objectives.

This ecosystem approach also creates opportunities for collaboration across different sectors. Schools can incorporate the materials into classroom discussions. Parents can continue conversations at home. Government agencies can use the characters for public awareness campaigns. Corporate organisations can support educational initiatives through corporate social responsibility programmes. Technology companies may eventually contribute digital learning experiences that extend the educational journey beyond printed books.

By thinking beyond a single comic, ScamAlert Junior™ becomes a platform rather than simply a publication. The stories remain at the heart of the project, but they are supported by an expanding ecosystem that allows the educational mission to reach children through multiple learning environments.

Building a Malaysian Educational Intellectual Property

Malaysia has produced many talented artists, writers, educators, and creative professionals. Yet when we look at globally recognised educational character brands, many originate from overseas. This presents both a challenge and an opportunity. I believe Malaysia has the creativity, cultural diversity, educational expertise, and technological capability to develop original intellectual properties that not only serve local communities but also contribute internationally.

ScamAlert Junior™ was created with this broader perspective in mind. Although the stories are rooted in Malaysian values such as respect, family, kindness, responsibility, and multicultural harmony, the challenges they address are universal. Online scams, misinformation, cyberbullying, digital responsibility, and critical thinking are issues affecting children around the world. By combining local identity with globally relevant educational themes, the intellectual property has the potential to resonate beyond national borders while remaining authentically Malaysian.Creating original educational IP is also about building long-term national capability. Intellectual property generates value not only through books but also through licensing, educational partnerships, digital products, animation, merchandising, and international collaborations. More importantly, it contributes knowledge and positive influence that can continue benefiting society for many years.

If Malaysia wishes to become increasingly recognised for innovation, digital transformation, and creative industries, developing original educational intellectual property is one meaningful step towards that future.

Conclusion

Building ScamAlert Junior™ has been far more than a creative exercise. It has been a journey of combining education, technology, storytelling, design, and long-term thinking into a single integrated vision. Every character, every conversation, every illustration, and every supporting document was created with one objective in mind — helping children develop the judgement and confidence needed to navigate an increasingly digital world responsibly.

As technology continues evolving, educational content must also evolve. However, while platforms, devices, and artificial intelligence may change, the importance of honesty, curiosity, empathy, responsibility, and critical thinking will remain constant. These timeless values are what give educational intellectual property its lasting significance.

My hope is that ScamAlert Junior™ becomes more than a series of books. I hope it becomes a trusted educational companion for children, a valuable teaching resource for educators, a conversation starter for families, and a meaningful contribution to Malaysia’s growing creative and educational ecosystem. Every great educational journey begins with a single story. With the right vision, consistency, and purpose, that story can continue inspiring generations long into the future.

Beyond Data Protection: Rethinking Authority, Accountability and Human Responsibility in the Age of Artificial Intelligence

Synopsis

Artificial Intelligence is entering a new phase. What began as technology designed to process information, generate content and assist human decision-making is gradually evolving into systems capable of accessing business applications, coordinating workflows and executing tasks with increasing independence. This transformation raises a fundamental question that goes beyond traditional discussions about data privacy and cybersecurity: when AI is authorised to take action, who determines the limits of its authority, and who remains accountable for the consequences?

Drawing from his experience in software development, enterprise digital transformation and AI implementation, Ts. Lukas J. Tan explores why the next challenge of AI governance is not simply protecting the information AI processes, but governing what AI is permitted to do with that information. Against the backdrop of Malaysia's proposed Artificial Intelligence and Personal Data Protection Framework, he argues that businesses, technology developers and policymakers must begin preparing for a future in which AI is no longer merely an assistant, but an increasingly active participant in organisational operations.

The Question We Have Not Been Asking

For many years, whenever we discussed digital transformation, cybersecurity or the development of information systems, one question consistently appeared at the centre of the conversation: how do we protect our data?

Businesses invested in databases, servers, firewalls, encryption, access controls and privacy policies. Governments introduced legislation to protect personal information, while organisations developed procedures to determine who could collect, process, store and disclose that information. As technology evolved, the methods became more sophisticated, but the underlying objective remained largely the same. We wanted to ensure that information was handled responsibly and that individuals could trust the organisations holding their data.

Today, Artificial Intelligence is beginning to challenge the boundaries of that conversation.

I have spent many years working in software development and enterprise digital transformation. Throughout that journey, I have witnessed organisations move from manual records to computerised systems, from standalone applications to interconnected platforms, and from traditional automation to increasingly intelligent software. Each technological transition has brought new opportunities, but it has also required businesses to reconsider how they manage operations, responsibilities and risks.

The arrival of Generative AI has accelerated this transformation significantly. In a relatively short period, businesses have begun using AI to prepare documents, analyse information, answer customer enquiries, generate marketing materials and assist employees with daily work. The discussion has largely focused on productivity, efficiency and the ability to complete more work with fewer resources.

These benefits are real. However, I believe we are approaching a more important turning point.

AI is no longer developing solely as a technology that produces answers. It is increasingly becoming a technology that can perform actions.

That distinction may sound simple, but its implications for businesses, governments and society are substantial.

When AI generates an answer, a human usually decides what to do next. When AI is authorised to execute an action, the system may directly influence business operations, modify information or initiate processes before a human reviews the outcome.

The question therefore changes.

Instead of asking only whether AI produces accurate information, we must begin asking whether AI has been given appropriate authority to act.And beyond that, we must ask who remains responsible when its actions have consequences.

From a Tool That Assists to a System That Acts

To understand this transformation, we should consider how software has evolved.

Traditional computer systems operate largely according to predefined instructions. A programmer develops rules, establishes conditions and determines how the application should behave. When a user performs an action, the system executes the relevant instructions. Although complex software can produce unexpected outcomes, the intended workflow is generally designed and controlled through explicit programming logic.

Generative AI introduced a different capability. Rather than relying only on fixed instructions, AI models can interpret natural language, recognise patterns, generate content and produce recommendations based on the information available to them.

For example, when an employee asks AI to summarise a customer report, the system analyses the document and prepares a summary. The employee then reads the result and decides whether to use it. If the summary contains an error, the employee has an opportunity to identify and correct it before taking further action.

Now imagine a different situation.

An AI system is connected to the company's customer database, sales application and internal communication platform. It receives a request to review outstanding customer enquiries, prepare follow-up communications, update relevant records and notify the responsible employees.

The system may retrieve information, identify pending tasks, decide which tools to use and execute several authorised steps in sequence.

This is where the discussion begins moving towards Agentic AI.

The significance of Agentic AI is not simply that the technology becomes more intelligent. It is that AI can be integrated into systems where its outputs may trigger actions within the real business environment.

The same underlying AI model might be used in both scenarios. However, the operational consequences are different.

An incorrect document summary may misinform an employee. An incorrect automated database update may alter business records. An incorrectly addressed communication may expose confidential information. An action taken without appropriate authorisation may affect customers, employees or commercial operations.

In other words, the risk of AI is not determined solely by the intelligence of the model. It is also influenced by the authority we give it, the systems it can access and the consequences of the actions it can perform.

This is an important distinction that I believe business leaders must understand before integrating autonomous AI systems more deeply into their organisations.

Data Protection Remains Essential, but the Conversation Must Evolve

When we discuss AI governance, personal data protection remains one of the most important foundations.

Organisations must continue asking why personal data is collected, how it is processed, who can access it, where it is stored and how long it should be retained. Individuals should be able to understand how their information is being used, while businesses should maintain appropriate safeguards against unauthorised access, misuse and disclosure.

These responsibilities do not disappear because an organisation introduces AI.

In fact, the increasing use of AI makes them even more important.

However, I believe there is an additional governance dimension that deserves greater attention.

Traditional data protection primarily addresses the handling of information. As AI becomes capable of taking action, we must also consider the authority assigned to the system.

For example, imagine that an AI application has legitimate access to a customer's personal information. The organisation has implemented the necessary security controls, and the system is permitted to process the information for an authorised business purpose.Does that authorisation automatically mean the AI should be able to change the customer's information? Should it be permitted to send messages on behalf of the company? Can it combine that information with records from another department? Should it be allowed to initiate a transaction based on its own interpretation of the customer's circumstances?

These are not simply questions of whether personal information is protected.

They are questions about the limits of operational authority.

The distinction between accessing information and acting upon information becomes increasingly important as AI systems gain autonomy.

In my view, future AI governance must address both dimensions. Organisations need to protect the information AI processes while also defining the actions AI is authorised to perform.

One responsibility cannot replace the other.

An organisation may have strong data security but poorly defined AI permissions. Conversely, an AI application may have carefully restricted functionality while still handling personal information inadequately.

Responsible AI implementation requires both data protection and operational control.

The Invisible Transfer of Authority

One of the most interesting developments I observe in enterprise AI adoption is how easily organisations can begin transferring operational authority to technology without fully recognising that they are doing so.

At the beginning, a company may introduce AI to support employees with routine tasks. The technology prepares email drafts, analyses spreadsheets or helps answer customer questions. Management sees improvements in productivity and naturally wants to extend those capabilities.

The next step may involve connecting AI to existing business applications. Instead of copying information into an AI interface, employees allow the system to retrieve records directly. This reduces manual work and improves convenience.

Later, the company may allow AI to update information, schedule activities or coordinate tasks between departments. Each enhancement appears to be a logical extension of the previous implementation.

Over time, however, the organisation may reach a point where AI is no longer simply assisting a workflow. It has become part of the workflow itself.

This transition can happen gradually.

No single decision may appear especially significant. Yet the cumulative effect can be substantial because the organisation has progressively expanded what AI is allowed to do.

I believe this creates a new responsibility for management.

Business leaders need to understand that connecting an AI system to more applications is not merely a technical integration exercise. It may also represent an expansion of operational authority.

The question is not whether such integration should be avoided. Integration is precisely where many of the benefits of enterprise AI can be realised.

The question is whether the organisation has deliberately considered the responsibilities and limitations associated with each additional capability.

An AI system does not need unrestricted authority to provide meaningful value. In many cases, carefully defined permissions and appropriate human oversight can support innovation while reducing unnecessary exposure.

The ability to delegate work does not remove the responsibility to determine how that work should be governed.

If AI Becomes Part of the Workforce, Who Manages It?

In conversations about the future of employment, we frequently hear that AI may become a digital employee, virtual assistant or member of an intelligent workforce.

These descriptions help people imagine the potential of AI. However, they can also create misunderstandings if taken too literally.

AI is not a human employee. It does not possess the same judgment, legal standing or personal accountability as an individual working within an organisation.

Nevertheless, there is a useful management lesson in the comparison.When a company recruits an employee, it normally defines the person's responsibilities, reporting relationships, access permissions and decision-making authority. A junior employee may prepare financial information without being authorised to approve payments. A customer service representative may access relevant customer records without receiving unrestricted access to the company's entire database.

The organisation establishes these boundaries because responsibility must be matched with authority.

Why, then, should the introduction of AI be treated as merely installing another software application?

As businesses begin deploying AI systems capable of performing increasingly complex tasks, management may need to develop clearer processes for assigning, reviewing and supervising AI responsibilities.

Some AI activities may require only basic oversight. Others may influence decisions involving employment, financial matters or sensitive personal information and therefore warrant stronger safeguards.

The appropriate controls should depend on the nature and consequences of the activity rather than the excitement surrounding the technology.

I believe this is where the role of business leadership will become especially important.

The technical team may understand how to connect an AI model to enterprise systems. But management must determine the organisation's objectives, acceptable risks, authority boundaries and accountability arrangements.

Technology teams cannot make every governance decision on behalf of business leadership.

At the same time, management cannot reasonably govern sophisticated AI systems without understanding their practical capabilities and limitations.

Effective AI governance therefore requires cooperation between leadership, operations, technology and relevant compliance functions.

The future of enterprise AI will not be determined by technology alone. It will also depend on whether organisations develop the management discipline necessary to use that technology responsibly.

The Difference Between Having a Policy and Having Control

Another issue deserves attention.

Many organisations measure governance maturity through documentation. They maintain policies, prepare procedures, record approvals and conduct periodic reviews. These activities are important because they establish expectations and provide evidence of organisational responsibility.

However, a written policy does not automatically mean that effective operational controls exist.

An organisation may have a comprehensive AI policy while allowing employees to connect AI applications to business systems with unnecessarily broad permissions. It may require human approval for certain activities without establishing a reliable way to enforce that requirement. It may maintain activity logs without regularly reviewing significant events.

The organisation can appear well governed on paper while important operational weaknesses remain unresolved.

This challenge is not unique to AI. Similar issues have existed for many years in cybersecurity, information technology management and corporate governance.

What makes AI particularly interesting is that the system's behaviour and capabilities may change over time.

An AI application might initially perform a narrow function. After a software update, new integration or change in permissions, it may gain access to additional information or become capable of executing new tasks.

The organisation may not regard these changes as a completely new system deployment, even though its operational risk has changed.

This is why I believe AI governance cannot be treated as a one-time compliance exercise.

It requires ongoing awareness of how the system operates, what permissions it holds, what actions it can perform and whether those capabilities remain consistent with the organisation's original objectives.

Policies should guide behaviour, but effective governance must also be visible in daily operations.Ultimately, the quality of an AI governance programme should be reflected not only in what an organisation says it controls, but in what it can demonstrate it actually controls.

A New Responsibility for AI Developers and Technology Providers

The emergence of increasingly autonomous AI also changes the conversation for software developers and technology providers.

In a traditional software project, responsibilities are often established through system specifications, contractual arrangements and agreed business processes. The developer builds the application, while the customer determines its intended business use and manages the relevant operations.

Modern AI solutions can introduce additional participants.

An enterprise application may use a foundation model developed by an international technology company, cloud infrastructure provided by another organisation, integration services delivered by a local software developer and business data controlled by the customer.

In some cases, these services may operate across different countries and contractual relationships.

When an AI-related problem occurs, identifying responsibility may not be straightforward.

The application developer may control the user interface and integrations but not the underlying foundation model. The model provider may control parts of the model service but not the customer's business workflow. The customer may determine the intended purpose but depend on external technology providers for technical implementation.

Existing legal responsibilities remain applicable, including those under relevant personal data protection laws. Nevertheless, practical guidance on the allocation and coordination of responsibilities can help organisations comply more consistently.

In my view, this is especially important for Malaysia's local technology industry.

Many Malaysian software companies and SMEs are not developing large foundation models from the beginning. Instead, they are building applications, integrating existing AI technologies and helping businesses apply AI to practical problems.

Their ability to inspect or control the internal workings of third-party AI models may be limited.

A practical governance approach should therefore recognise the difference between what an organisation directly controls, what it can reasonably verify and what it must address through contractual assurances and supplier oversight.

This is not an argument for reducing accountability.

It is an argument for making accountability sufficiently clear that organisations can meaningfully implement it.

Malaysia's Opportunity to Shape Responsible AI Adoption

In October 2026, Malaysia's Personal Data Protection Department, or JPDP, issued Public Consultation Paper No. 1/2026 concerning the proposed Artificial Intelligence and Personal Data Protection Framework under the Personal Data Protection Act 2010, Act 709.

The consultation represents an important development in Malaysia's approach to responsible AI adoption.

The proposed Framework addresses the processing of personal data throughout the AI system lifecycle, including development, testing, deployment, external AI services, data subject rights, security, fairness, risk management and compliance documentation.

I welcome this direction.

The protection of personal information is not an obstacle to technological progress. On the contrary, it is one of the conditions that enables individuals and businesses to adopt technology with greater confidence.

As part of my industry feedback, I have highlighted an additional question that I believe deserves further consideration as AI capabilities continue to evolve.

Should the level of autonomy and operational authority granted to an AI system become a more explicit consideration in governance and risk assessment?

The proposed Framework already recognises different levels of autonomy, access controls, human oversight and the importance of reviewing material changes to AI systems. These provide a useful foundation.My observation is that the relationship between these elements deserves further discussion, particularly when AI is permitted to execute actions across connected enterprise systems.

An AI application that generates recommendations and an AI application that independently executes business activities may process similar information, yet present different operational risks.

Recognising this distinction could help ensure that regulatory guidance remains relevant as Agentic AI becomes more widely adopted.

It is equally important that governance expectations remain proportionate.

Not every AI agent should automatically be classified as high risk. A system performing limited internal administrative tasks under appropriate controls is different from one that can independently execute actions with significant consequences for individuals.

Malaysia has an opportunity to develop a practical approach that recognises such differences while maintaining strong personal data protection principles.

This would support not only regulatory clarity, but also responsible innovation among local software developers and SMEs.

The Real Challenge Facing Malaysian SMEs

For many Malaysian SMEs, the challenge of AI adoption is not a lack of interest.

Business owners increasingly recognise that AI can improve efficiency, reduce repetitive work and support better decision-making. However, many do not have dedicated teams specialising in AI engineering, data protection, cybersecurity or technology governance.

They often depend on external vendors and commercially available applications.

As a result, the success of AI governance will depend partly on whether its principles can be translated into guidance that smaller organisations can understand and implement.

If governance becomes excessively complicated, costly or disconnected from operational realities, businesses may struggle to adopt it effectively.

On the other hand, if governance requirements are too vague, organisations may misunderstand their responsibilities or implement controls that do not adequately address the risks involved.

Neither outcome is desirable.

I believe Malaysia should continue pursuing an approach that balances innovation, responsibility and practical implementation.

This includes providing greater clarity on third-party AI services, explaining how risk-based controls can be applied to different use cases, and supporting industry awareness and capability development.

A framework becomes valuable when it can be understood not only by policymakers and legal professionals, but also by the people responsible for developing, operating and managing technology every day.

Responsible AI should not become a privilege available only to large corporations with extensive resources.

It should be achievable for smaller organisations through safeguards appropriate to their activities and risks.

The Human Role Becomes More Important, Not Less

As AI becomes capable of completing increasingly sophisticated tasks, it is natural to question the future role of human beings in organisations.

Will AI replace employees? Will managers become less necessary? Will decisions eventually be made entirely by machines?

I believe the deeper issue is not simply whether AI can perform work previously completed by humans.

It is how human responsibility changes when more work can be delegated to intelligent systems.

For many years, the value of technology has been measured by its ability to automate tasks. A successful system reduces manual effort, improves consistency and enables employees to focus on higher-value activities.

AI expands those possibilities.

But when technology becomes capable of performing more complex work, the importance of defining objectives, evaluating consequences and exercising judgment does not disappear.

In some circumstances, it becomes even greater.A manager who delegates an important task to an employee remains responsible for establishing appropriate expectations and oversight. Similarly, an organisation that authorises AI to perform business activities cannot assume that the technology itself has taken over the organisation's accountability.

The ability to delegate an action and the responsibility for authorising that action are two different matters.

This distinction may become one of the defining management challenges of the AI era.

We will need leaders who understand not only how to use AI, but also when to rely on it, when to question it and when human intervention is necessary.

We will need developers who think not only about functionality and performance, but also about the consequences of system integration and automated actions.

We will need employees who understand how to work productively with AI without surrendering their professional judgment.

And we will need governance practices that recognise both the capabilities and limitations of increasingly autonomous technology.

The future of human leadership may depend less on controlling every individual task and more on exercising sound judgment over the responsibilities we choose to delegate.

Building AI into Business Means Building Responsibility into AI

One of the principles I frequently emphasise is the importance of integrating AI into everyday business operations.

AI should not exist only as an interesting experiment or a tool occasionally used by employees. Its greatest organisational value often emerges when it is appropriately connected to real business needs, workflows and decision-making processes.

But meaningful integration also requires responsibility.

The more deeply AI participates in business operations, the more carefully organisations must consider its authority.

Who decides which information the system may access? Who determines which activities it can execute? Who monitors important outcomes? Who intervenes when the system behaves unexpectedly? Who answers when its actions affect another person?

These are management questions as much as technical questions.

I believe the companies that succeed in the next phase of AI adoption will not necessarily be those that deploy the largest number of AI tools.

They may instead be the organisations that understand how to combine technological capability with clear responsibilities, sensible controls and sound human judgment.

The objective is not to slow down innovation.

It is to develop the confidence and organisational discipline required to innovate sustainably.

When governance is understood and implemented properly, it can become an enabler of innovation rather than merely a compliance obligation.

Who Ultimately Controls AI?

Artificial Intelligence will continue to evolve. New models, applications and autonomous systems will introduce capabilities that may be difficult to imagine today.

The technology will become faster, more capable and increasingly integrated into how businesses operate.

However, technological advancement alone does not determine how society should use those capabilities.

Those decisions remain matters of human values, organisational responsibility, governance and judgment.

We should welcome AI's ability to improve productivity and support innovation. We should continue protecting personal information and strengthening confidence in digital services. We should encourage businesses, especially SMEs, to explore how AI can contribute to sustainable growth.

At the same time, we must recognise that the ability of AI to take action introduces responsibilities that go beyond conventional discussions about data processing.

The next stage of AI governance must consider not only what AI knows, but what AI is authorised to do.

Not only how information is protected, but how actions are controlled.

Not only whether a system is capable of making decisions, but who remains accountable for the consequences.

Perhaps the defining question of the next decade will not be whether AI can perform a particular task.We already know that its capabilities will continue expanding.

The more important question is whether we are prepared to exercise sound judgment over the authority we give it.

We have spent years teaching machines how to process information. We are now developing machines that can take action. The responsibility ahead is to determine what they should be allowed to do, under whose authority, and with what safeguards.

Because ultimately, the future of AI should not be defined only by what technology is capable of achieving.

It should also be defined by the wisdom of the people who choose how that technology is used.

And that brings us back to a question every business leader, developer and policymaker should consider:

When AI starts taking action, who is really in control?

Ts. Lukas J. Tan is the Founder & CEO of OPERiON Ecommerce & Software Sdn Bhd. He writes and speaks about Artificial Intelligence, enterprise digital transformation, technology leadership and responsible AI implementation.

This article reflects his independent perspective as an industry practitioner. It draws on themes from his October 2026 position paper, "Beyond Data Protection: Governing AI Autonomy, Accountability and Real-World Deployment", prepared in connection with Malaysia's JPDP Public Consultation Paper No. 1/2026. The views expressed do not represent an official position of JPDP.

From Daring to Dream to Daring to Build—and Present Yourself

Synopsis

As artificial intelligence becomes part of the way we work, learn and make decisions, we need to ask how we can embrace AI while preserving the qualities that make us human: sound judgment, communication, creativity and individuality.

Ts. Lukas J. Tan believes the future of AI will belong not only to people who know how to use the tools, but also to those who can identify the problems, turn ideas into solutions and contribute to the economic. Through the PENtastic Startup Month 2026, hosted by Digital Penang, OPERiON hopes to encourage young people to discover their abilities, build innovative solutions with confidence and learn to present their ideas to the market, future employers and investors.

I am Ts. Lukas J. Tan from OPERiON, and one of the people behind PDX, the Penang Digitalisation-AI Conference & Exhibition 2026. I am delighted to be part of PENtastic.

PENtastic brings together people with different perspectives and offers a wide-ranging view of how digital technology is developing. Events like this give businesses, talent, educators and communities the opportunity to learn from one another, exchange ideas and explore possibilities for working together. Those connections can help strengthen the foundations of Penang's digital economy.

As part of PENtastic, we are organising an AI Hackathon (www.aifm.asia) to discover and nurture the next generation of AI Future Makers. We want participants to do more than attend a talk or watch a demonstration. We want them to think about real problems, build solutions with their own hands and discover what they are capable of creating.

Embrace AI, but Preserve What Makes Us Human

Artificial intelligence is changing our lives at remarkable speed. It can help us gather information, organise content and generate ideas. It is also becoming involved in more of the decisions we make. AI can save time and open up new possibilities, but we should also consider what may happen if we hand too much of our thinking, expression and judgment over to it.

I worry that if we become accustomed to letting AI do all the thinking and communicating for us, our ability to connect with one another may gradually weaken. Face-to-face conversation, the exchange of ideas and the capacity to build meaningful relationships still matter. They are not simply steps in a process; they are part of how we understand one another and work together.

"We are also beginning to see a growing similarity in the way people speak and write. Some speeches and presentations sound increasingly alike. Their vocabulary, grammar, structure and tone can feel as if they were produced from the same template.", Lukas Said

People often say, "We should stop asking whether AI will replace us and start asking whether we know how to use AI." There is truth in that message. But when we hear the same line repeated in every speech and see it in every presentation, it is worth pausing to ask: are we expressing our own views, or repeating a familiar phrase?"

AI can help us organise our thoughts, but it cannot form our personal judgment for us. It can assist us in expressing an idea, but it should not cause everyone to lose their own voice. Our experiences, observations, opinions and ways of communicating are part of what makes each of us distinct.

I have nearly fallen into that trap myself. That experience reminded me to return to real questions, honest observations and authentic expression. The AI Hackathon is intended to give young people the chance to do the same. We want them not only to learn how to use AI, but also to discover more about themselves and develop ideas and styles of their own.

From Discovering Yourself to Building an Idea

In the AI Hackathon (www.aifm.asia), we want participants to experience more than the excitement of coming up with an idea. They will be encouraged to observe problems, understand the people affected by them, consider possible solutions and use AI and other tools to begin building.

That process can help young people identify their interests and strengths. It also invites them to think boldly. If a problem deserves to be solved, what new approach might I offer? Can I take an idea that seems distant or difficult and turn it into something people can see, discuss and perhaps develop further?

Innovation is not simply a concept that sounds original. It requires people to explore a problem, build and test a solution, listen to feedback and make adjustments. AI can support that work, but people remain responsible for identifying the problem, making choices and standing behind the outcome.

The Ability to Present Is the Ability to Create Impact

In the workplace and in business, people often say they know how to give a presentation. Yet communicating well means more than speaking in front of an audience or creating attractive slides.

When you present an idea to your manager, can you help them understand its value and earn their support? When you meet an interviewer, can you show what you can do and why you are suited to the role? When you introduce a solution to a client, partner or investor, can you explain the problem it addresses and why it deserves further attention?

That is when communication begins to make an impact.

We want participants in the AI Hackathon to learn how to do more than complete a project. We want them to explain their solutions clearly, demonstrate what they have built and help an audience understand why it matters. They will learn to present their ideas—and, through those ideas, to present themselves.

A project can also become a meaningful record of what a young person can do. It can show the problems they care about, how they think, how they use tools, how they work with a team and how they turn an idea into something tangible. These are the kinds of experiences that can help future employers, business partners and investors see a person's potential.

Giving Every Diamond a Chance to Shine

We are organising the AI Hackathon to encourage young people to think boldly, build with purpose and present their ideas with confidence.

Every young person has potential, although they may not yet have had the opportunity to show it. Some are natural observers. Some are designers or analysts. Others have a gift for bringing a team's ideas together. Participants do not need to come from the same academic background, and they do not need to begin with a complete set of technical skills. What matters is that they are willing to take part, learn and bring their ideas into the real world to be tested.

We hope that each participant will find a place where their strengths can contribute. We want their abilities to be recognised, their ideas to be heard and the wider market to understand the value they can bring.

This is more than a competition. It is a journey in which young people can practise thinking, building, collaborating and communicating. We look forward to seeing them start with a problem, develop a solution step by step and stand on stage with confidence to share what they have created.

Your Participation Can Support the Next Generation

We welcome students, educational institutions, businesses and community groups to take part in the AI Hackathon. Your involvement is more than support for an event; it is a way to support young people as they experiment, learn and grow.

When young people have the opportunity to work on real challenges, put forward ideas and present their solutions to others, they gain the confidence to keep developing into people who can create value. That support can extend beyond the event itself. It can help connect talent, businesses and new ideas across Penang's digital ecosystem.

The AI Hackathon is an opportunity for young people to explore AI, understand themselves better, put their ideas into practice and show what they can do. We look forward to witnessing the growth of the next generation of AI Future Makers.

Take Part in the AI Hackathon—and Let Your Light Shine

Join the AI Hackathon (www.aifm.asia) with your observations, ideas and enthusiasm. Work with a team to explore a problem, build a solution and show the world what you are capable of.

Every one of you has the potential to shine. Give yourself the opportunity—and let more people see your light.

Synopsis

Almost everyone today claims to know artificial intelligence. Fresh graduates list ChatGPT and Gemini on their résumés, employees attend AI workshops, and companies proudly announce that their workforce is becoming AI-ready. Yet behind this growing enthusiasm, I see a serious talent gap emerging. Through organising the Penang Digitalisation Expo and AI Future Makers Bootcamp, I have come to realise that what businesses desperately need is not simply people who know how to use AI applications. They need individuals capable of applying AI to research, development, automation, workflows, programming and real business problems. The distinction may sound small, but its implications for recruitment, employability and business competitiveness are enormous. Perhaps it is time for employers to stop asking candidates whether they know AI and start asking what they have actually built with it.

The Talent Shortage We Discovered Through PDX

When we organised the Penang Digitalisation Expo (PDX), one of my objectives was to bring businesses, technology providers, universities and industry leaders together to accelerate digital transformation. We wanted to understand what companies needed, what technologies were available and how different industries could move forward in an increasingly digital economy.

Throughout the event, I had opportunities to exchange perspectives with business owners, technology professionals, educators and corporate leaders. Although the conversations covered many different subjects, one particular concern continued to stand out to me. The market does not necessarily lack technology. There are already countless software platforms, AI applications and digital solutions available. What remains difficult is finding the right people who can take these technologies and transform them into something genuinely useful for an organisation.

Initially, we might describe this as a shortage of digital talent. But after looking more closely, I believe the problem is more specific. We are short of people who can genuinely work with artificial intelligence beyond the level of ordinary application usage. In particular, individuals capable of combining AI with research and development, programming, process redesign, prototyping and business innovation remain relatively uncommon.

I sometimes jokingly describe these people as a rare species. Everyone is looking for them, many employers claim to need them, but finding someone who can actually demonstrate these capabilities is not as easy as it sounds.

And that raises an uncomfortable question. If everyone is learning AI, why are businesses still struggling to find AI-ready talent?

When Everyone Says They Know AI, What Does That Really Mean?

Over the years, hiring has been an important part of building our company. Like many employers, we evaluate candidates based on their qualifications, experience, attitude and ability to contribute to the organisation. More recently, another question has naturally entered our recruitment conversations: Do you know how to use AI?

Today, the answer is almost always yes.

When we ask candidates which AI tools they are familiar with, the responses are often predictable. ChatGPT. Gemini. Sometimes another popular application. There is absolutely nothing wrong with these answers. Both ChatGPT and Gemini are powerful technologies, and I use AI tools extensively in my own work. They can accelerate research, improve communication, assist with analysis and make everyday tasks considerably more efficient.

But knowing how to interact with an AI chatbot is not the same as knowing how to use artificial intelligence to solve a business problem.

Consider the difference between someone who uses ChatGPT to write a job advertisement and someone who can design an AI-assisted recruitment workflow. The first person may produce a better advertisement in minutes. The second person might examine how applications arrive, how candidate information is organised, how recruiters identify relevant qualifications, and where automation can reduce repetitive administrative work while preserving human judgement and fairness.

Both are using AI, but the depth of their contribution is completely different.

The same distinction applies to marketing, finance, operations, customer service and software development. One person asks AI for suggestions. Another person uses AI to develop a functioning prototype, connect different systems, automate repetitive processes and validate whether the solution delivers measurable value.

For a fresh graduate entering the workforce, simply stating that you know ChatGPT and Gemini is becoming an increasingly weak differentiator. These tools are accessible to almost everyone. What matters is your ability to move beyond using them and demonstrate something meaningful.

Your value does not come from the number of AI applications you recognise. It comes from what you are capable of accomplishing with them.

What Our AI Future Makers Participants Revealed

This talent challenge became even more interesting when we started organising AI Future Makers Bootcamp 2026, an initiative that will culminate in its final competition on 7 November 2026. Through this programme, we want to encourage students to move beyond classroom knowledge and demonstrate how artificial intelligence can be used to address actual industry challenges.

One of the areas we introduced involves human resource management. Recruitment, talent attraction, candidate screening and employee retention are familiar challenges for many organisations. HR departments often receive applications from multiple platforms, spend significant time reviewing résumés and face the difficult responsibility of identifying suitable candidates while maintaining consistent and fair evaluation practices.

We wanted participants to think about these challenges from a problem-solving perspective. Instead of simply asking AI to recommend hiring strategies, could they explore how AI might support a practical workflow? Could they research the problem, understand the people affected, develop a prototype and demonstrate an approach that might be useful to an actual HR department?

The response to our programme has been encouraging. Yet one observation from our participant survey caught my attention. Many students were familiar with ChatGPT and Gemini, while their exposure to other AI development tools and approaches appeared much more limited.

This is not a criticism of the students. In fact, I see it as a reflection of a much larger issue in how we understand AI education.

We have become very good at introducing people to AI applications. Workshops teach participants how to create prompts, generate presentations, produce images and improve productivity. These are useful skills, but they should represent the beginning of the learning journey, not the destination.

What I would like to see is a generation of young people who can use AI to conduct research, design workflows, develop basic software, build prototypes and experiment with ideas that previously seemed beyond their technical capabilities.

Not everyone needs to become a software engineer. A business student may understand an operational problem better than a programmer. An HR student may identify weaknesses in recruitment processes that a technology developer would overlook. What matters is their willingness to learn, experiment and connect their domain knowledge with the right AI capabilities.

That, to me, is where the next generation of valuable talent will emerge.

Perhaps Employers Are Asking the Wrong Interview Questions

If the definition of AI talent is changing, our recruitment methods must evolve with it.

Imagine interviewing two fresh graduates. Both hold similar qualifications, and both claim proficiency in AI. The first candidate explains that they regularly use ChatGPT for assignments, research and presentation preparation. The second candidate brings a working prototype that they developed to solve a problem they observed during an internship.

The prototype may not be perfect. It may contain limitations, require additional testing or need considerable improvement before being suitable for real-world deployment. Nevertheless, the second candidate has already demonstrated something valuable: the ability to identify a problem, research possible solutions, experiment with technology and turn an idea into something tangible.

As an employer, I would be very interested in understanding how that person thinks.

This is why I believe HR professionals should consider introducing practical demonstrations into their recruitment process, especially when hiring for roles involving digital transformation, innovation, operations improvement and AI adoption.

Instead of merely asking candidates which tools they know, ask them to explain a workflow they have designed. Ask them to demonstrate a prototype, describe a problem they solved or explain how they evaluated the reliability of an AI-generated result. Ask what went wrong during development and how they corrected it.

These conversations can reveal problem-solving ability, curiosity, adaptability and practical judgement that conventional résumé screening may not capture.

Of course, AI capability should not replace other essential hiring considerations. Communication, ethics, teamwork, business understanding and the ability to make responsible decisions remain important. A candidate who can generate impressive software but cannot explain its risks or understand its users is not automatically a strong hire.

The goal is not to recruit people who know the most AI tools. It is to identify people who can combine technology, critical thinking and execution to deliver meaningful outcomes.

The Next Talent Advantage Will Belong to Those Who Can Build

As I reflect on these experiences, I believe we are approaching an important turning point in the employment market.

For many years, academic qualifications and professional experience served as the primary signals of employability. They will continue to matter, but AI is creating additional ways for individuals to demonstrate their potential. A student no longer needs to wait until joining a large organisation to experiment with automation, develop a software concept or explore an innovative business solution.

With accessible AI tools, the distance between an idea and an early working prototype has become considerably shorter.

But accessibility also changes the expectations of employers. When almost everyone can generate content, prepare a report or ask AI for advice, those abilities alone become less distinctive. The competitive advantage increasingly belongs to individuals who understand what should be built, why it matters, how it works and whether it genuinely solves the intended problem.

That is the mindset we hope to encourage through AI Future Makers Bootcamp.

I do not expect every participant to develop a commercially viable product. I do not expect every student to become an AI engineer. What I hope to see is a change in how they approach challenges. Instead of waiting for someone to provide the answer, I want them to investigate, question, experiment and demonstrate what they can create.

For employers, this presents an opportunity to discover talent through evidence of capability rather than qualifications alone.

For young people, it is an invitation to become more than users of technology.

And for universities, industry leaders and HR professionals, it is an opportunity to reconsider how we prepare, identify and develop the workforce of tomorrow.

The next valuable employee may not be the candidate who claims to know every AI platform. It may be the one who arrives with a simple prototype, a clear understanding of a business problem and the determination to improve it.

A Message to HR Leaders, Talent Acquisition Managers and Employers

If your company is currently recruiting fresh graduates, developing an AI-ready workforce or struggling to identify people who can translate artificial intelligence into practical business outcomes, I would like to connect with you.

Through AI Future Makers Bootcamp 2026, we are creating an environment where emerging talents can explore real industry challenges and demonstrate their thinking, creativity and execution capabilities. Our final competition takes place on 7 November 2026, and I believe this is an opportunity for HR leaders and business owners to pay attention to a different kind of talent development.

I would particularly welcome conversations with HR Directors, Talent Acquisition Managers, Learning and Development leaders, and CEOs who are reconsidering how their organisations assess and recruit AI-capable people.

Perhaps the question we should ask in our next interview is no longer, "Do you know ChatGPT?"

Perhaps it should be, "Show me what you have built, explain the problem you solved, and tell me what you learned."

That is a conversation I would be excited to have with the next generation of talent.

Explore the initiative at https://aifm.asia and connect with me through https://lukastan.com.

The future of employment will not be defined simply by who knows AI. It will increasingly be shaped by those who know how to turn AI into real value.

Dream It. Execute It. Ground It.

Synopsis

We are raised to believe that success comes from preparation, experience, stability and patience. We are told to study first, work for someone else, accumulate knowledge, build financial security and only then consider starting a business. It sounds responsible, mature and sensible. But what if this conventional wisdom is also the reason so many capable people never pursue their ambitions? What if the years spent preparing for entrepreneurship gradually destroy the very courage required to become an entrepreneur? Drawing from my own journey since founding my business immediately after graduation in 2007, I want to challenge a belief that has shaped generations of young professionals. In a world where technology, artificial intelligence and business models are evolving faster than ever, waiting until everything is stable may be the greatest risk of all. This is not an argument against education, responsibility or preparation. It is an argument against allowing preparation to become a lifelong excuse for inaction.

The Conversation That Made Me Question Our Definition of Readiness

Last week, I had a conversation with a lawyer friend who shared his ambition to eventually establish his own legal practice. He was interested in becoming independent, but he believed that he should continue learning and wait until his circumstances became more stable before making the move. I listened to him and found myself wondering what stability actually meant in this situation. Was he waiting for a more predictable income, a stronger client base, greater professional confidence or simply the reassurance that everything would work out?

Around the same period, I reflected on the journey of a former colleague who had spent years working for other companies while developing a small business on the side. His business involved cleaning, restoring and polishing sofas, leather shoes and handbags. After operating part-time for approximately one or two years, he eventually decided to pursue the business full-time. I was pleased to see him taking that step, because building something independently requires effort and courage regardless of when a person begins.

However, these two experiences reminded me that people can have fundamentally different philosophies about entrepreneurship. Some believe that the responsible approach is to prepare extensively, establish a stable foundation and gradually move towards independence. My perspective is different. I believe that entrepreneurship is something you must experience directly, because the market teaches lessons that no amount of preparation can fully reproduce. You cannot learn everything about swimming while standing beside the pool. At some point, you must enter the water.

I recognise that expressing this opinion may make some friends uncomfortable. Perhaps they will consider me too aggressive, impatient or unrealistic. Perhaps we simply belong to different schools of thought. I can accept that. Friendship does not require identical ambitions, and I have no intention of disrespecting anyone's personal decisions. Nevertheless, I would rather express a conviction formed through nearly two decades of entrepreneurship than offer comfortable advice that I do not believe.

In 2007, I Started a Business Before I Had Anything Resembling Stability

I graduated in 2007 and entered entrepreneurship almost immediately. I did not have an established customer network, substantial financial resources, a recognised corporate background or years of industry experience. What I had was a willingness to build something and the belief that I could learn what was necessary along the way.

Our early business involved developing websites for customers. I still remember that some of our projects started at just RM500 per website. Five hundred ringgit was hardly an impressive foundation for building a technology company, particularly when we had to find customers, understand their requirements, complete the development work and maintain enough cash flow to continue operating. Yet that was where my entrepreneurial education began. Every customer meeting, rejected proposal, technical problem and completed project became part of my learning process.

There were difficult periods when business opportunities became scarce and I seriously considered returning to employment. I remember attending interviews with three companies, hoping that one of them might offer me a job. None of them hired me. At the time, rejection was disappointing because employment would have provided immediate financial relief and a more predictable future. Looking back today, however, I consider those unsuccessful interviews among the fortunate events of my life.

I often wonder what would have happened if one of those companies had employed me. Perhaps I would have developed a successful corporate career. Perhaps I would have become an excellent employee, manager or executive. There is nothing dishonourable about that path. But would I have built the businesses, systems, products and initiatives that have shaped my life? Would I have developed the same willingness to take risks, make decisions and accept responsibility for the outcomes? I cannot know the answer. What I do know is that I am deeply satisfied with the journey I eventually took.

Those rejections did not automatically make me successful. They simply removed an alternative that might have made it easier for me to abandon entrepreneurship. Without the comfort of a stable salary, I had to continue finding customers, improving my capabilities and confronting problems directly. The circumstances forced me to become more resourceful. I did not start because I was ready. I became more capable because I had already started.

Stability Is Not a Guarantee of Growth

One of the most common pieces of advice given to aspiring entrepreneurs is to start small, establish a stable business and only consider expansion when the operation is sufficiently mature. On the surface, this appears logical. A stable foundation reduces uncertainty, and disciplined growth can prevent unnecessary financial damage. Yet there is a dangerous assumption hidden inside this advice: that stability today somehow guarantees the opportunity to grow tomorrow.

It does not.

A company can operate successfully for ten years and still become irrelevant when customer behaviour changes. A professional can spend a decade mastering a particular skill only to discover that technology has significantly reduced its commercial value. A business owner can become so comfortable serving an existing customer base that the organisation loses the ambition to explore new markets. Stability can create confidence, but it can also create complacency.

Artificial intelligence makes this issue particularly urgent. We are entering an era in which small teams can accomplish work that previously required much larger organisations. Software development, content production, customer engagement, research and business automation are being transformed at extraordinary speed. The knowledge that once gave an experienced professional a substantial competitive advantage may no longer provide the same protection. Meanwhile, younger entrepreneurs with fewer resources but greater adaptability may be able to build entirely new business models.

I am not suggesting that experience has become worthless. Experience remains valuable when it improves judgement, strengthens execution and helps us recognise risks. But experience should be a tool for action, not a justification for postponing action indefinitely. The objective should not be to accumulate the greatest possible amount of knowledge before entering the market. It should be to develop knowledge while continuously testing whether that knowledge creates value.

My first website projects were worth RM500. That was my starting point, not the limit of my ambition. There is an enormous difference between starting small because your resources are limited and thinking small because your courage is limited. The former is a practical constraint. The latter can become a permanent barrier.

The Longer You Wait, the More Expensive Courage Becomes

There is another reality about entrepreneurship that young people rarely hear discussed openly. The cost of taking risks often changes as we progress through life, not necessarily because we become less capable, but because our responsibilities increase.

A fresh graduate may have limited savings and little professional experience, but may also have relatively few financial commitments. There may be no mortgage, no children requiring education, no large household expenses and no employees depending on the next payroll. This does not mean that every young person is financially free or that family circumstances are identical. Some graduates already carry significant responsibilities. Nevertheless, for many people, early adulthood offers a degree of flexibility that becomes more difficult to recover later.

As we grow older, we begin making commitments. We purchase homes, establish families, take on loans and become accustomed to a particular standard of living. These are meaningful achievements, and I would never suggest that people should avoid them. But each commitment changes the consequences of uncertainty. A business failure that might have been manageable at twenty-three could become far more disruptive at thirty-eight, when several people depend on your income.

This is why I question the advice to spend ten years preparing before considering entrepreneurship. During those ten years, you may gain valuable experience and financial resources, but you may also accumulate obligations that make independent business ownership increasingly difficult. The courage you possessed at graduation may gradually be replaced by a need to protect everything you have established.

Eventually, you may reach a point where you are professionally qualified, financially comfortable and highly experienced, yet unwilling to risk your current position. You have become ready according to every conventional measurement, except the one that matters most: your willingness to act.

I believe young people should understand this trade-off before surrendering their most energetic years to a preparation process without a clear destination. The right time to act is not necessarily when you have nothing to lose, but when you can make a considered commitment and still have sufficient flexibility to recover, adapt and try again.

Entrepreneurship Requires Aggression, Not Recklessness

When I speak about entrepreneurship, I often use words such as aggressive, bold, relentless and ambitious. Some people may interpret these expressions as encouragement to act recklessly. That is not what I mean.

I believe that if you decide to build a business, you should approach it with the determination to compete seriously. You should not enter a market merely hoping to survive. You should study the industry, identify opportunities, understand your customers and challenge yourself to create something better than what already exists. Your ambition should be large enough to force you beyond your existing capabilities.

Being aggressive means pursuing opportunities instead of waiting for customers to discover you. Being relentless means continuing to improve after rejection rather than allowing disappointment to determine your future. Being bold means entering unfamiliar territory with the willingness to learn, experiment and take responsibility. None of these qualities requires dishonesty, irresponsible borrowing or the sacrifice of professional ethics.

In fact, the more ambitious an entrepreneur becomes, the more important discipline becomes. Financial management, governance, operational systems and accountability are necessary if a business is to survive beyond the founder's initial enthusiasm. Ambition without execution is fantasy, while aggression without judgement can become destructive.

What I reject is the belief that entrepreneurs must deliberately restrict their ambitions simply because they are inexperienced. Why should a young founder automatically assume that building a significant company is something reserved for people who have spent twenty years working elsewhere? Why should an entrepreneur who begins with a small project be discouraged from imagining an international business?

I started by selling websites for RM500, but I never believed that my entire professional future should be defined by the size of my first transaction. Starting small can be unavoidable. Remaining small should not become an unquestioned philosophy.

The world does not reward us simply because we have been patient. It responds to the value we create, the problems we solve and our ability to execute. If we want extraordinary outcomes, we must be prepared to make extraordinary efforts.

Failure Is an Education That Success Cannot Always Provide

One reason people delay entrepreneurship is their fear of failure. They worry about losing money, disappointing their families, damaging their reputations or discovering that their abilities are insufficient. These concerns are legitimate. Failure can have serious consequences, and it should never be romanticised as though financial losses and personal hardship are automatically beneficial.

Nevertheless, failure has taught me lessons that I would have struggled to understand through observation alone. When a customer rejects your proposal, you begin questioning whether you understand the customer's real problem. When a product fails to attract buyers, you discover the difference between building something interesting and building something the market values. When cash flow becomes difficult, financial management stops being an abstract business concept and becomes an immediate responsibility.

The experience of losing forces entrepreneurs to confront reality. It reveals weaknesses in assumptions, execution, pricing, positioning and leadership. A person who has never been tested may possess tremendous confidence without knowing whether that confidence is justified. A person who has experienced setbacks and reflected seriously on them can develop a more grounded understanding of business.

However, failure only becomes valuable when it produces learning and changes in behaviour. Repeating the same mistake without examining its cause is not courage; it is poor judgement. Entrepreneurs must be willing to analyse what went wrong, recognise what competitors did better and adjust their strategies accordingly.

Success presents a different danger. A successful product, business model or strategy can encourage us to believe that our existing methods will continue working indefinitely. We may stop questioning assumptions because the previous results appear to validate them. Over time, yesterday's success can become tomorrow's limitation.

That is why I believe entrepreneurship requires a willingness to challenge both failure and success. We should learn from failure without becoming defeated by it, and celebrate success without becoming imprisoned by it. The purpose of experience is not to make us comfortable. It is to make us more capable of building what comes next.

The Greatest Risk for the Next Generation Is Becoming Too Comfortable to Act

I am increasingly concerned that young people are being encouraged to pursue certainty in a world that can no longer provide it. We continue telling students to obtain qualifications, secure employment, accumulate experience and follow established career paths, even as the economic environment around them changes dramatically.

Education is essential, but education should develop independent thinkers rather than individuals who are afraid to act without instructions. Employment can provide valuable experience, but it should not convince people that their only possible contribution is to execute somebody else's vision. Professional training can strengthen competence, but qualifications alone cannot replace initiative, commercial judgement or the ability to build something from nothing.

This is particularly relevant in the age of artificial intelligence. AI can accelerate research, software development, design, communication and many other forms of work. It gives individuals access to capabilities that were previously expensive or difficult to obtain. A young entrepreneur no longer needs to master every technical discipline personally before testing a business idea. The tools are becoming more accessible, and the cost of experimentation is falling in many fields.

Yet technology cannot supply ambition to someone who refuses to act. It cannot make decisions for a person who is unwilling to accept responsibility. It cannot transform an idea into a meaningful enterprise unless someone is prepared to engage customers, make difficult choices and persist through uncertainty.

I want young people to stop measuring their readiness exclusively by the number of years they have worked or the certificates they have collected. Instead, they should ask whether they understand a meaningful problem, whether they can create a solution and whether they are prepared to test that solution in the real world.

The same principle applies beyond entrepreneurship. Whether you are working in a corporation, participating in a business association, studying at university or leading a community initiative, meaningful progress requires initiative. You cannot become a leader merely by observing leadership. You cannot become innovative merely by attending innovation conferences. At some point, knowledge must become action.

My concern is not that the next generation lacks intelligence or talent. It is that too many talented individuals may spend their most productive years waiting for permission to use their abilities.

Be Bold Enough to Build, or Accept That Someone Else Will Build Your Future

Nearly twenty years have passed since I began my entrepreneurial journey in 2007. I have experienced uncertainty, rejection, difficult business decisions and the constant pressure of maintaining and growing an organisation. I have also experienced the satisfaction of building businesses, developing technology, creating products and bringing ideas into the real world.

I do not claim that my path is the only correct one. Some people will achieve remarkable things through corporate careers, professional practices or other forms of employment. Others may need to spend time building financial reserves, fulfilling family responsibilities or acquiring specific qualifications before launching a venture. Those decisions deserve respect.

But I want to challenge the young person who already knows what they want to build, who has the ability to begin, who understands the risks, yet continues postponing action because they are waiting to feel completely confident.

Confidence is not always something you acquire before acting. Often, it develops through the experience of acting, making mistakes, solving problems and discovering that you are capable of more than you initially believed.

If you want to establish a business, start engaging the market. If you want to develop a product, build a prototype and place it in front of potential customers. If you want to transform an industry, begin by understanding its problems and challenging its assumptions. You do not need to abandon financial responsibility, but you do need to stop confusing caution with permanent hesitation.

My personal philosophy remains simple: Dream It. Execute It. Ground It. Dreaming gives us direction, execution transforms intention into action, and grounding ensures that our ambitions create real value. These principles have shaped the way I approach business, technology and the initiatives I continue to develop.

Above all, I believe in building. Building a business, building a system, building opportunities and building something that matters. I would rather confront the difficulties of creating something than spend my life explaining why the conditions were never favourable enough to begin.

To the next generation, my message is this: Be bold. Be relentless. Be courageous enough to pursue something that may fail. Do not become a coward in the face of your own ambition. Being afraid is human, but allowing fear to make every important decision for you is a choice. You may fail, lose an opportunity or discover that your original idea was wrong. If you remain willing to learn and rebuild, those experiences can become the foundation of something greater.

The world will not stop changing while you prepare. Competitors will not suspend their ambitions until you feel comfortable. Opportunities will not remain available simply because you intend to pursue them someday.

In 2007, I began with RM500 websites. I did not have everything I needed, and I certainly did not know everything I would eventually have to learn. But I started, and that decision changed the direction of my life.

Today, I am still building, still learning and still challenging myself to do more.

I want young people to understand that courage is not the absence of fear. It is the decision that your ambition deserves more influence over your future than your fear does.

You do not have to be ready to begin. But you must be willing to begin if you ever want to become ready.

And if you are still waiting for the perfect moment, ask yourself one final question: How many more years of your life are you prepared to sacrifice before you finally give yourself permission to build?

Ts. Lukas J. Tan
Founder & CEO, OPERION Ecommerce & Software Sdn Bhd

Dream It. Execute It. Ground It.

Why I Believe the Future of Enterprise AI Is Not About Renting Artificial Employees, but About Owning, Defending and Governing the Intelligence That Runs Your Business.

Synopsis

October 2026. The artificial intelligence industry is moving at extraordinary speed. Everywhere I look, companies are promoting AI employees, AI workforces, autonomous agents and subscription-based digital workers. The proposition sounds attractive: instead of hiring more people, businesses can subscribe to artificial intelligence that performs tasks, manages workflows, communicates with customers and operates around the clock.

Yet after more than two decades of building websites, software systems, databases and business applications, I see something that concerns me deeply. The greatest risk may not be what these AI employees can do for a company, but what the companies providing them could potentially learn about their customers.

I believe the subscription-based AI workforce industry, particularly services that require extensive access to an organisation's internal knowledge and operations, may face a serious crisis of trust. The more intelligent these systems become, the more difficult it will be for customers to understand what happens behind the interface.

My concern is not simply cybersecurity. It is something potentially more consequential: the ownership, extraction and reproduction of organisational intelligence.

Two Decades of Building Systems Have Taught Me to See What Others Overlook

I began building business software long before artificial intelligence became a fashionable commercial product. Since the early days of my career, I have worked across websites, databases, business applications, software implementation and digital infrastructure. To outsiders, these may appear to be ordinary technology services. To me, however, building a system has never been merely about delivering functionality.

A system must perform its intended purpose, but it must also be designed to withstand misuse, identify unusual activities, record operational behaviour and preserve evidence when something goes wrong. Whenever I build something, I naturally think from two directions: how it should work and how it could fail or be exploited. I want to know who accesses information, what actions they perform, where errors occur, what data moves between systems and whether anyone is attempting something outside the intended boundaries.

This habit has become part of my professional instinct. I do not see logging, monitoring and reporting as secondary technical features. They are fundamental instruments for protecting an organisation and continuously improving its technology. The information collected from legitimate operational monitoring can reveal weaknesses, expose inefficiencies and help developers improve systems over time.

An Experience From 2007 Changed How I Think About Information Protection

In 2007, I developed a business system that would eventually teach me an important lesson about the relationship between technology, employees and organisational trust. Several years after its implementation, an employee left the organisation and copied customer data from the system. That incident triggered something in my thinking that has remained with me ever since.

I realised that protecting software was not enough. The real asset was often the information contained within it, and the people authorised to use a system could sometimes represent a greater risk than outsiders attempting to break into it.

From that experience, I became increasingly sensitive to access controls, audit trails, operational logs and the ability to detect unusual behaviour. My philosophy was straightforward: if I build a system for people to use, I must also understand how it is being used. Not because every user should be treated as suspicious, but because responsible technology ownership requires visibility and accountability.

That lesson was learned in the conventional software era. Today, artificial intelligence has made the same problem considerably more complicated.

Artificial Intelligence Is Not Just Another Software Application

Traditional software generally operates according to defined logic, programmed functions and structured data flows. Although conventional systems can be extremely complicated, developers can usually investigate their architecture, inspect their code, examine database transactions and trace how particular operations occur.

Artificial intelligence introduces another dimension. Modern AI agents may combine language models, external tools, memory systems, APIs, retrieval mechanisms, autonomous workflows and third-party integrations. Some operate through open-source frameworks and increasingly complex orchestration environments. Each additional component creates new functionality, but also expands the potential attack surface.

Over recent months, I have been deeply involved in experimenting with agentic AI, automation workflows, self-hosted infrastructure and open-source agent frameworks. The deeper I explore these technologies, the more I appreciate their extraordinary potential. At the same time, I have become more concerned about how easily poorly configured systems can expose information or permit unintended actions.

An AI agent may appear to be performing a simple task, while behind the interface it could be accessing multiple databases, reading documents, calling external services or transmitting information between systems. Without appropriate observability and controls, even the organisation deploying the agent may struggle to reconstruct everything it has done.

The Invisible Back Door Is Only the Beginning

Consider a company subscribing to an external AI workforce service. The provider installs or configures an AI employee that handles customer enquiries, prepares proposals, reviews documents and assists with internal operations. The customer sees a convenient interface and measurable productivity improvements. What the customer may not see is the complete technical architecture supporting those operations.

Who controls the agent's instructions? Which external tools can it invoke? Where are its operational logs stored? Can the provider remotely change its behaviour? Are conversations retained? What happens when a third-party integration is compromised? Can the customer independently verify what information leaves the organisation?

These are not accusations against every AI workforce provider. Many vendors implement serious security controls, contractual protections and technical safeguards. Nevertheless, the risk exists because the architecture can create opportunities for unauthorised access, insecure integrations, malicious instructions or hidden data transfers.

A sophisticated back door does not necessarily announce itself through an obvious system failure. It may remain invisible during ordinary operations. More importantly, even a technically legitimate feature can become a security weakness if its permissions exceed what the business actually requires.

The question is therefore not whether every external AI workforce contains a back door. The question is whether the business owner has sufficient evidence to establish that its most sensitive operations remain under its control.

Data Leakage Is Dangerous, but Intelligence Leakage Could Be Worse

Most business owners understand the consequences of customer data being stolen. They worry about personal information, financial records, intellectual property and confidential documents. These are legitimate concerns, and existing cybersecurity practices are designed to reduce such risks.

However, artificial intelligence introduces a less obvious category of exposure. An AI workforce may interact with employees every day, observe recurring decisions, process internal discussions, interpret customer requirements and participate in operational planning. Over time, these interactions can reveal how an organisation thinks and behaves.

Imagine an AI assistant that helps a chief executive prepare proposals, evaluate opportunities and negotiate contracts. Through repeated interactions, it may encounter the executive's pricing philosophy, commercial judgement, risk appetite, preferred negotiation tactics and strategic priorities.

Whether that information is retained, analysed or used for further model development depends on the provider's architecture, contractual commitments and technical controls. It is not inevitable that every AI service learns from customer conversations. But where such processing is permitted or insufficiently restricted, the consequences could extend beyond conventional data leakage.

A company may lose not only confidential information, but valuable insight into the decision-making patterns that distinguish it from competitors.

What Happens When One AI Provider Serves One Hundred Competitors?

Let us imagine that I establish an AI workforce company specialising in the medical industry. I provide intelligent operational assistants to one hundred medical businesses. Each customer uses my service for scheduling, administration, procurement, customer communication, operational reporting and management support.

Individually, each organisation may see substantial productivity improvements. Collectively, however, the service provider could occupy a remarkably powerful position within that industry's information ecosystem.

If the architecture allows customer interactions to be retained and analysed across accounts, the provider could potentially identify common operational weaknesses, purchasing patterns, customer behaviours, commercial strategies and management practices. With sufficient access, the provider might develop a sophisticated understanding of how an entire sector operates.

Now consider the more troubling possibility. What if those insights were used to develop a competing business, inform another customer or construct specialised AI systems that reproduce the operational expertise of existing organisations?

This would not require the crude act of downloading a customer database. It could involve extracting patterns, processes, decisions and business knowledge from accumulated interactions. Reproducing a company's expertise accurately would still be technically difficult, and contractual or legal restrictions may prohibit such use. Nevertheless, the strategic possibility deserves serious examination.

The real competitive advantage of many companies is not their software. It is the knowledge embedded in how their people make decisions. If that knowledge becomes accessible to an external intelligence provider, the boundary between technology supplier and potential competitor becomes increasingly important.

The Subscription Model May Be Selling Convenience at the Expense of Control

I understand why AI workforce subscriptions are attractive. Businesses want immediate results. They do not necessarily have internal developers, AI engineers or the financial resources to establish their own infrastructure. A ready-made AI employee appears to solve these problems quickly and affordably.

But convenience should not be confused with ownership.

When a company subscribes to an external AI workforce, it must examine what it actually controls. Does it own the agent's configuration, workflows, memory, knowledge base and operational records? Can it inspect the system's permissions? Can it migrate to another provider without losing accumulated organisational knowledge? Can it terminate the relationship and verify that its confidential information has been deleted according to agreed retention policies?

I foresee that generic AI workforce subscriptions will face increasing pressure as AI development becomes more accessible and businesses become more conscious of data sovereignty. Providers selling only convenient access to standard AI capabilities may struggle to sustain differentiation.

This does not mean all AI subscriptions will disappear. Specialised providers with strong security, transparent governance and genuine domain expertise may continue to thrive. However, I believe the market will increasingly distinguish between renting artificial intelligence and surrendering control over business intelligence.

Those are two very different commercial decisions.

The Future Should Be Internally Governed AI, Not Blindly Trusted AI

My preferred direction is for businesses to develop the capability to own and govern their critical AI workflows internally. This does not necessarily mean every company must train its own language model or build every component from scratch. That would be economically unrealistic for many small and medium enterprises.

Instead, organisations should understand their AI architecture, retain ownership of their business knowledge, control access permissions and establish clear boundaries around external services. They should know what information an AI agent can access, what actions it can execute, where data is processed and how every significant operation can be audited.

External technology can still play an important role. Open-source frameworks, commercial models, cloud infrastructure and specialised vendors can all be incorporated into a properly governed architecture. The essential principle is that the organisation must remain capable of controlling, inspecting and replacing critical components.

For SMEs, this may begin with something as practical as assigning an internal employee to understand AI workflows, maintaining an inventory of connected systems, restricting sensitive data access and implementing approval requirements for high-risk actions.

AI governance cannot guarantee absolute security, and no single regulator can eliminate every technical risk. But effective governance, supported by technical verification, contractual accountability and continuous monitoring, can significantly reduce exposure.

Businesses should not become dependent on intelligence they cannot inspect, control or safely disconnect.

The Most Valuable Technology Professionals Will Know How to Build and Defend

Throughout my career, I have never been satisfied with understanding only how technology works when everything goes according to plan. I am equally interested in understanding what happens when something goes wrong, when someone attempts to misuse a system or when a seemingly harmless feature creates an unexpected vulnerability.

I believe this combination of offensive and defensive thinking will become increasingly valuable in the AI era. Organisations need builders who understand architecture, implementation and business operations. They also need people who can challenge assumptions, investigate hidden dependencies, recognise unusual patterns and question the intentions or consequences behind technical decisions.

These capabilities resemble elements of cybersecurity investigation, technical due diligence, adversarial testing, AI governance and strategic intelligence. They require more than knowing how to write software or operate an AI tool. They require curiosity, scepticism, technical experience and the willingness to investigate what others may overlook.

I have spent more than two decades developing that mindset through real systems, real customers, operational incidents and continuous experimentation. I remain a builder by nature, but I have learned that responsible building requires an equally strong instinct for defence.

In the AI era, creating something powerful is only half the responsibility. Understanding how that power could be misused is the other half.

Perhaps Every Organisation Needs Someone Who Thinks Like a Spy

Sometimes, I wonder whether the future of technology will require a different kind of professional. Not necessarily another software engineer, cybersecurity specialist or AI consultant, but someone who approaches technology with the curiosity of an investigator, the imagination of a strategist and the instincts of a builder.

Imagine a character in a corporate thriller. He walks into a room where everyone is celebrating the successful deployment of an intelligent system. The executives are impressed by its efficiency, the developers are proud of its architecture, and the employees are delighted that their workload has become lighter. Yet while everyone is admiring what the system can do, one person quietly asks a different question: What else could this system be doing that nobody has thought to examine?

Perhaps that is the kind of character I find fascinating. Someone who understands how systems are constructed because he has spent years building them. Someone who recognises weaknesses because he has experienced failures. Someone who can think like an attacker without becoming one, and defend like an engineer without assuming that every system is secure.

In the movies, such characters often work in intelligence agencies, investigating threats that remain invisible to ordinary observers. In the real world, the challenges may be less dramatic, but the underlying mindset is remarkably similar. The ability to notice unusual patterns, question convenient assumptions and imagine what might happen behind a perfectly functioning interface could become increasingly important as artificial intelligence grows more autonomous.

I sometimes think that if I had chosen a different career, I might have enjoyed being a technology detective. Fortunately, building software and businesses for more than two decades has provided enough mysteries of its own.

And perhaps, somewhere in the corporate world, there are challenges that need precisely this unusual combination of curiosity, technical experience and imagination.

After all, the most dangerous weakness in a system may not be the one that everyone can see. It may be the one nobody has thought to look for.

Dream It. Execute It. Ground It.

Build with imagination. Defend with intelligence.

Ts. Lukas J. Tan
Founder & CEO, OPERION Ecommerce & Software Sdn Bhd
Technology Builder | Digital Transformation | AI Systems & Governance

Introduction

Throughout history, stories have always been one of humanity’s most powerful tools for education. Long before formal classrooms, textbooks, or digital learning platforms existed, knowledge was passed from one generation to another through stories. Parents shared life lessons with their children, elders passed down wisdom through storytelling, and communities preserved important values by remembering memorable characters and meaningful experiences. Although technology has transformed the way we communicate today, one thing has remained remarkably consistent — people still remember stories far better than instructions.

This simple observation became one of the guiding philosophies behind ScamAlert Junior™. As digital scams become increasingly sophisticated and children spend more time interacting with technology, I began asking a different question. Instead of focusing only on how to explain scams, perhaps we should first consider how children actually learn. Children rarely remember long lists of rules or complicated technical explanations. They remember characters they admire, conversations that make them think, and stories that make them feel something. If we truly want to prepare the next generation for a safer digital future, then perhaps the most effective lesson does not begin with a warning. It begins with a story.

Children Remember Characters More Than Rules

Every parent and teacher has experienced the same situation. A child may struggle to remember a classroom lesson taught just a few weeks ago, yet they can accurately recall the name of a favourite cartoon character, a memorable scene from a movie, or a comic book dialogue they read months earlier. This is not because children dislike learning. It is because the human brain naturally remembers information that is connected to emotions, experiences, and relationships.

When education is delivered only as instructions, children often understand what they should do, but they may not fully understand why those actions matter. However, when the same lesson is experienced through a character facing a challenge, children become emotionally involved. They imagine themselves in similar situations, consider different choices, and naturally begin developing judgement alongside the character. Instead of memorising information, they are learning through experience.

This is why educational storytelling has remained effective across generations. A relatable character becomes a trusted companion rather than an authority figure. Children do not feel they are being lectured. Instead, they feel they are joining a journey where every decision carries a lesson. That emotional connection makes the learning process more enjoyable, more memorable, and ultimately more meaningful.

For digital safety education, this approach is particularly valuable because online situations are rarely black and white. Children need to develop judgement rather than simply memorise rules, and stories provide the perfect environment for building that kind of thinking.

Turning Complex Cybersecurity into Everyday Conversations

Cybersecurity is often perceived as a complicated subject filled with technical language, computer systems, and specialised knowledge. Adults frequently associate it with hackers, data breaches, passwords, and corporate security policies. For children, however, these concepts can feel distant and difficult to understand. Yet the risks themselves are already part of their everyday lives.

A child receiving a message from an unknown player during an online game, clicking an attractive advertisement while watching videos, downloading a free application, or sharing personal information on social media are all situations connected to digital safety. The challenge is not introducing technical cybersecurity terminology. The challenge is helping children recognise situations where good judgement is required.

Storytelling makes this possible by translating abstract concepts into familiar experiences. Instead of explaining phishing through technical diagrams, a story can show a character receiving an exciting message that promises an unbelievable prize. Instead of discussing identity theft, children can follow a storyline where someone pretends to be someone they are not. Rather than overwhelming young readers with technical definitions, stories encourage them to pause, observe, ask questions, and think before making decisions.

This approach transforms cybersecurity from an intimidating subject into an accessible conversation that children can understand. It demonstrates that digital safety is not simply about computers. It is about making responsible choices in everyday life.

Learning Together as Families and Communities

One of the greatest advantages of storytelling is that it naturally encourages conversation beyond the pages of a book. Unlike traditional lessons that often end once the classroom session finishes, a meaningful story creates opportunities for children to ask questions, share opinions, and discuss situations with the adults around them. These conversations often become the most valuable part of the learning experience.

When a child reads about a character facing an online scam, parents can ask simple questions such as, “What would you do if this happened to you?” Teachers can encourage classroom discussions about different choices the characters could have made. Grandparents can relate similar lessons using their own life experiences, showing that while technology changes, the importance of honesty, patience, and careful decision-making has always existed.

This collaborative learning environment is particularly important because digital safety cannot be taught by schools alone. Children move constantly between home, school, community activities, and online environments. The messages they receive become stronger when parents, teachers, and caregivers reinforce the same values consistently.

Storytelling provides a common language that everyone can participate in. Instead of discussing complicated cybersecurity concepts, families discuss familiar characters and relatable situations. The conversation becomes less about technology and more about trust, responsibility, communication, and good judgement. These are lessons that extend well beyond digital safety and contribute to lifelong character development.

Building Critical Thinkers Instead of Teaching Fear

Many awareness campaigns rely heavily on fear to capture attention. Images of cybercrime, alarming statistics, and warnings about online dangers certainly remind people that risks exist. While these approaches may be effective in raising awareness, they do not always build confidence. In some cases, excessive fear may even discourage children from asking questions because they worry about making mistakes or being criticised.

My belief has always been that education should empower rather than frighten. The objective is not to convince children that the internet is dangerous or that technology should be avoided. The goal is to help them become confident users who know how to think carefully before acting. Confidence grows when children understand how to recognise warning signs, verify information, seek advice, and make responsible decisions independently.

This philosophy influenced every aspect of ScamAlert Junior™. The stories are intentionally designed to encourage curiosity instead of anxiety. Characters are allowed to make mistakes because mistakes become valuable learning opportunities. Rather than portraying digital threats as unbeatable dangers, the stories demonstrate that observation, teamwork, communication, and critical thinking often lead to better outcomes.

Children who develop these habits early are not simply learning how to avoid scams. They are developing a mindset that helps them evaluate information, question assumptions, and make thoughtful decisions throughout their lives. In many ways, these skills become even more valuable than the specific cybersecurity lessons themselves.

Conclusion

Technology will continue changing at an extraordinary pace. Artificial intelligence, immersive digital experiences, smart devices, and new communication platforms will introduce opportunities that today’s children will naturally embrace throughout their lives. Alongside these opportunities, however, new forms of scams, misinformation, and digital manipulation will continue emerging in ways that we cannot yet fully predict.

Preparing children for this future requires more than teaching them today’s online threats. It requires helping them develop timeless skills that remain valuable regardless of how technology evolves. Critical thinking, empathy, observation, responsible communication, and the confidence to ask questions will always be among the strongest forms of digital protection.

That is ultimately why storytelling remains such a powerful educational tool. Stories create emotional connections that information alone cannot achieve. They transform lessons into experiences, characters into mentors, and reading into meaningful conversations that continue long after the final page has been turned.

ScamAlert Junior™ was built upon this belief. Not simply to entertain children, and not merely to warn them about online scams, but to help them become thoughtful, responsible, and confident digital citizens who understand that the best protection often begins with one simple habit: think before you click.

By Ts. Lukas J. Tan — Founder of ScamAlert Junior™ | CEO of OPERiON | AI & Digitalisation Strategist

Introduction

When people first hear about ScamAlert Junior™, many naturally assume it is simply a children’s comic with a few interesting characters. In reality, every character within the ScamAlert Junior™ universe was created with a very specific educational purpose. None of them exists merely to make the story more entertaining or colourful. Each personality, behaviour, strength, weakness, and interaction was intentionally designed to reflect the different ways children learn, communicate, make decisions, and solve problems in everyday life.

As someone who has spent many years working in digital transformation, technology, and cybersecurity awareness, I have learned that education is rarely effective when people feel they are being lectured. Children, in particular, connect with people rather than information. They remember personalities before they remember rules. They remember conversations before they remember instructions. Most importantly, they remember characters they admire. That understanding became one of the guiding principles behind the creation of ScamAlert Junior™. Instead of building superheroes with extraordinary powers, we created ordinary characters with extraordinary values. Together, they form a learning ecosystem that encourages observation, curiosity, empathy, responsibility, and critical thinking while helping children navigate an increasingly digital world.

Every Character Represents a Different Way of Learning

Children are wonderfully different from one another. Some are naturally curious and adventurous, while others are careful observers who prefer to think before acting. Some enjoy asking many questions, while others quietly analyse situations before speaking. As educators and parents, we often discover that there is no single teaching approach that works for every child. This realisation became the foundation for designing the ScamAlert Junior™ characters.

Rather than creating multiple characters who behave in similar ways, we intentionally developed personalities that reflect different learning styles and decision-making approaches. Lukas represents calm thinking and careful observation. Leo demonstrates curiosity, enthusiasm, and learning through experience. Lynn reminds children that paying attention to small details can often prevent bigger problems later. Each child character contributes a different perspective whenever challenges arise, showing readers that there is rarely only one correct way to approach a problem.

This diversity is important because children often identify with different personalities. One child may see themselves in Lukas, while another feels more connected to Leo’s adventurous spirit or Lynn’s thoughtful nature. By creating relatable personalities instead of perfect heroes, the stories become more authentic. Children begin learning not because they are told to imitate someone, but because they naturally recognise parts of themselves within the characters.

Behind Every Child Is a Family That Shapes Good Decisions

While children are the centre of the ScamAlert Junior™ stories, they do not grow or learn in isolation. Families play an equally important role in shaping values, judgement, communication, and responsible behaviour. That is why the ScamAlert Junior™ universe extends beyond children to include positive adult role models who reflect the importance of family guidance in the digital age.

Johan represents responsible fatherhood through integrity, leadership, and accountability. Rather than solving every problem for his children, he encourages them to think carefully and make responsible decisions. Lina represents compassionate parenting through patience, trust, and open communication. She demonstrates that meaningful conversations often build stronger relationships than strict rules alone. Completing the family guidance is Atuk Hassan, whose wisdom bridges traditional life values with modern technology. Through his experiences, children learn that while digital tools continue changing, honesty, kindness, respect, and good judgement remain timeless principles.

These adult characters are intentionally portrayed as mentors rather than authority figures. They listen before judging, guide before correcting, and encourage discussion rather than fear. In doing so, they model the kind of supportive relationships that help children develop confidence to ask questions, admit mistakes, and seek help whenever they encounter uncertainty online.

Turbo — Turning Digital Safety Into Fun

Every memorable educational brand has a character that immediately captures attention and creates emotional connection. For ScamAlert Junior™, that role belongs to Turbo, the official mascot of the intellectual property. Turbo was never intended to replace the educational role of the human characters. Instead, he complements them by bringing energy, humour, curiosity, and excitement into every learning experience.

Children naturally respond to mascots because they communicate through expressions, actions, and emotions that transcend age and language. Turbo celebrates achievements, encourages teamwork, and reminds children that learning can be enjoyable. Whether he is cheering on his friends, holding a ScamAlert Junior™ book, guiding children through activities, or simply making readers smile, Turbo reinforces positive behaviour without making education feel like a classroom lesson.

Beyond the stories themselves, Turbo also plays an important commercial role. As the official mascot, he has been designed to appear consistently across books, activity materials, school programmes, exhibitions, merchandise, digital applications, and future animation projects. His bright appearance, expressive personality, and friendly behaviour make him instantly recognisable while helping children associate digital safety with confidence rather than fear. Sometimes, a simple smile can become one of the strongest educational tools.

Building an Educational Character Universe for the Future

Many successful children’s stories begin with memorable characters, but relatively few are designed from the beginning as long-term educational intellectual property. From the earliest planning stages of ScamAlert Junior™, I wanted to build something that could continue growing beyond a single publication. That required thinking not only about storytelling, but also about consistency, educational philosophy, commercial sustainability, and future development.

Every official character now has a comprehensive Character Asset Library that documents appearance, personality, behaviour, communication style, educational role, expressions, poses, costumes, colour standards, props, and approved commercial usage. This level of documentation ensures that regardless of whether the characters appear in comics, animation, classroom resources, mobile applications, games, or licensed merchandise, they remain faithful to their original identity and educational mission.

Building a character universe is not simply about creating recognisable illustrations. It is about creating trust. When children repeatedly encounter the same positive personalities across different learning environments, those characters become familiar companions who reinforce the same values over time. This consistency strengthens both educational outcomes and long-term brand recognition while allowing the intellectual property to expand responsibly into new platforms and future opportunities.

Conclusion

At its heart, ScamAlert Junior™ is not a story about superheroes defeating villains. It is a story about ordinary people making extraordinary decisions through observation, curiosity, kindness, responsibility, and teamwork. Every character was created to represent qualities that children can realistically develop within themselves, reminding readers that courage often begins with asking questions, thinking carefully, and supporting one another.

As technology continues evolving, children will face new digital challenges that previous generations never imagined. While the tools around them will change, the importance of good judgement, empathy, communication, and critical thinking will remain constant. Through Lukas, Leo, Lynn, Johan, Lina, Atuk Hassan, and Turbo, ScamAlert Junior™ hopes to provide children with positive role models they can grow alongside for many years to come.

These seven characters are more than fictional personalities. Together, they represent a shared vision of helping the next generation become thoughtful, confident, and responsible digital citizens—one story, one conversation, and one meaningful lesson at a time.

Meet the Characters in the Book

Lukas, Leo, Lynn, Johan, Lina, Atuk Hassan and Turbo are waiting for your child inside the ScamAlert Junior™ book. Give them stories that teach them to pause, ask questions and talk to the people they trust.

Buy the ScamAlert Junior™ book here →

Synopsis

For years, the debate around artificial intelligence has been framed as a question of replacement. Will AI take our jobs? Will AI become more intelligent than us? Will machines eventually make human beings unnecessary?

I increasingly believe that this framing misses the more immediate problem. The greatest danger may not be that artificial intelligence becomes too powerful. It may be that human beings become too comfortable relying on it.

What concerns me today is not a distant science-fiction future in which machines suddenly seize control. What concerns me is what I can already see in ordinary business life: websites that look almost identical, presentations that use the same language, founders who describe entirely different products with the same vocabulary, and companies that appear to be outsourcing not only production, but judgement.

Artificial intelligence was supposed to increase our ability to create, analyse and execute. Yet if we are not careful, it may also encourage a generation of professionals to stop questioning, stop editing and eventually stop forming their own point of view.

The problem is therefore not simply whether AI will replace humans. The more uncomfortable question is whether humans are slowly learning to replace their own thinking.

I Began Noticing It in Websites

I have spent a large part of my professional life building websites, software systems, digital platforms and businesses. Because of that background, when I look at a website, I rarely judge it only by whether it looks modern, clean or attractive. I instinctively look at the thinking behind it. I notice how information has been prioritised, how the company explains itself, whether the customer journey makes sense, whether the wording reflects a genuine understanding of the market, and whether the design decisions actually support the business objective.

Over the last few years, however, I began to notice a pattern that became increasingly difficult to ignore. More and more websites started to feel strangely familiar. The logos were different. The industries were different. The colours had changed. Yet the structure was often almost interchangeable.

There would be a large hero section with an ambitious statement, followed by three or four rounded boxes. After that came a benefits section, then a feature section, then another row of cards, followed by perhaps a coloured gradient, some statistics, a frequently asked questions section and finally another call to action that repeated almost exactly what had already appeared at the beginning.

At first, I assumed that this was simply the result of contemporary design trends. Every era has its own visual language, and websites have always copied successful conventions from one another. But when I started reading the content carefully, another pattern emerged. The same point was often being made repeatedly in different forms. A promise introduced at the top appeared again in the benefits section, then once more in the feature section, then again near the bottom of the page.

The website looked polished, but it did not feel edited. It felt assembled.

That distinction matters.

A good website should not merely contain information. It should reflect decisions. Someone should have decided what matters most, what can be removed, what should be said only once, what deserves emphasis and what does not need to exist at all. Increasingly, I am seeing websites where those decisions appear not to have been made.

AI Is Very Good at Producing Completeness

One of artificial intelligence's greatest strengths is also one of its weaknesses. It is exceptionally good at producing something that feels complete.

Ask an AI system to create a website structure and it will rarely leave you with too little. It will give you a hero section, benefits, features, testimonials, process, use cases, FAQs and a closing call to action. Ask it to produce a proposal and it will supply context, objectives, methodology, milestones, deliverables and expected outcomes. Ask it to create a presentation and it will usually generate a neat sequence of problem, solution, framework, value proposition and next steps.

This completeness is useful. It saves time and reduces the friction of starting from nothing. But completeness can also create the illusion that the work is finished.

It is not.

The important work often begins after the generation.

An experienced human editor will remove repetition. A founder who understands the business deeply will recognise when a sentence sounds impressive but says very little. A designer with judgement will decide that six boxes should become three. A strategist will notice that a fashionable phrase is technically correct but inappropriate for the audience.

AI can provide material, but it does not automatically provide restraint.

The problem begins when people confuse generated completeness with finished quality.

What Worries Me Is the Surrender of Judgement

I am not opposed to artificial intelligence. Quite the opposite. I use it extensively, and I believe it is one of the most powerful productivity technologies available to us.

It can accelerate research, shorten development cycles, assist with coding, improve analysis, generate alternatives, organise information and help small teams perform work that previously required far greater resources. For entrepreneurs and SMEs in particular, this is transformative. A small business can now access capabilities that were once available mainly to large organisations with dedicated teams.

Yet there is an important difference between using AI as leverage and allowing AI to become a substitute for judgement.

That difference is becoming increasingly important because the modern workflow is dangerously easy. A business owner can ask AI to write a website, copy the result and publish it. A team can ask AI to prepare a proposal, change the company name and send it. A founder can ask AI to create a presentation, adjust the colours and present it to a customer.

Technically, the work is done. But intellectually, very little may have happened.

When this becomes normal, the human role gradually changes. Instead of thinking, shaping, challenging and deciding, the person becomes an operator who accepts or lightly edits what the machine has already proposed.

That is not efficiency. That is surrender.

Then I Started Hearing the Same Language Everywhere

The visual similarity of websites was only the first sign. The more interesting change appeared in business language.

Over the last few years, certain words have begun appearing with remarkable frequency. Operating System. Revenue OS. Business OS. Core. Centralized Control. Ecosystem. Framework. Engine. Unified Platform. Command Center.

None of these terms is inherently meaningless. Some are useful, and in the right context they describe real systems accurately. I have used some of them myself.

What becomes strange is the scale of repetition.

I have sat through presentations from different technology companies offering completely different products. One may be selling an AI platform, another a productivity tool, another an automation system, another a data solution. Yet the presentation structure often feels almost identical.

A central diagram appears. Something in the middle is labelled "Core". Several functions surround it. Another slide introduces the company's "Operating System". A later slide presents the "Ecosystem". Somewhere there is a "Framework", perhaps followed by an "Engine", a "Layer" or a "Centralized Control" concept.

After seeing this often enough, I began to experience something unexpected: instead of being impressed by the sophistication of the presentation, I became less interested.

The product might still be good. The company might be capable. But the language no longer tells me much about them.

I can see the vocabulary, but I cannot see the founder.

The More Intelligent Everyone Sounds, the Less Meaning Intelligence Carries

Artificial intelligence has made professional language dramatically more accessible. Someone who is not a natural writer can now produce elegant copy. Someone unfamiliar with presentation design can create polished slides. A small software company can describe itself using language that once belonged mainly to large consulting firms.

This democratisation is useful, but it also creates an unexpected consequence.

When everyone can sound strategic, strategic language becomes less distinctive.

When every proposal is polished, polish stops proving competence.

When every founder can produce sophisticated terminology, sophisticated terminology stops proving depth.

The result is that the market gradually begins to value something else: evidence of original thought.

A founder who has spent years solving a difficult problem tends to speak differently from someone who has only researched it. A builder who has implemented real systems usually talks differently about trade-offs, failure and limitations. Someone who has actually struggled through a business problem will often describe it with imperfect but highly specific language.

Experience leaves fingerprints.

Those fingerprints matter because they make a person credible.

Artificial intelligence, if used carelessly, can polish those fingerprints away.

AI Should Amplify Identity, Not Flatten It

I have long believed that AI amplifies what is already there.

When someone has strong experience, AI can help organise and extend that experience. When someone has good judgement, AI can help test alternatives. When someone has discipline, AI can make that person dramatically more productive. When someone is already a builder, AI can increase the speed at which ideas become systems, products and results.

But the reverse is also true.

If someone has no point of view, AI can amplify generic thinking. If someone does not understand the customer, AI can produce language that sounds persuasive but lacks insight. If someone has not developed judgement, AI can provide twenty alternatives without helping that person understand which one deserves to survive.

This is where the deeper risk of standardisation appears.

Artificial intelligence is trained on patterns, and therefore it is naturally good at producing plausible patterns. If millions of professionals rely heavily on those patterns without introducing enough of their own thinking, the output of the market will gradually converge.

More companies will become competent.

More websites will look professional.

More proposals will sound intelligent.

More presentations will appear strategic.

But more of them may also become interchangeable.

That is not progress if we lose identity along the way.

The Real Risk Is Not That Machines Become Human

Much of the public discussion about AI still revolves around machine consciousness. We imagine a future in which artificial intelligence becomes independent, develops intentions and eventually challenges human control.

That possibility receives attention because it is dramatic.

But a quieter and perhaps more immediate transformation is already happening.

AI does not need to become conscious if human beings become dependent.

There is a natural progression in how we use these tools. At first, we ask for assistance. We ask AI to help us write, summarise or improve something. Then we begin asking it what we should say. Later, we may ask what we should do. Eventually, without noticing the shift, we may begin asking what we should think.

That final transition matters enormously.

The distinctive human capacity is not merely the ability to produce text or create designs. Machines are already becoming very capable at those tasks. The more valuable capability is the ability to question assumptions, disagree with consensus, reject attractive nonsense and make decisions under uncertainty.

If we surrender that capacity, then AI does not need to defeat us.

We have voluntarily given away the most important part.

I Now Look for Evidence of Human Thinking

This has changed the way I evaluate work.

When I look at a presentation today, I am no longer impressed simply because it is polished. In fact, when the deck looks too familiar, I become more cautious.

I start asking different questions.

Does the language reflect something this company genuinely believes? Does the diagram actually describe how the product works? Can the founder explain why they chose this approach? Is there anything in the presentation that could only have come from their own experience? Is there a point of view here, or merely a collection of professionally arranged statements?

These questions matter because a presentation is not only communication. It is evidence of thinking.

When someone presents a company, I want to understand how they see the world. I want to know what they have noticed that others missed, what assumption they disagree with, what problem they understand unusually well and what difficult decision they have made.

I do not need every sentence to sound perfect.

In fact, sometimes imperfect language reveals more truth than polished language.

Human Judgement May Become the Scarce Resource

The cost of production will continue to fall. Websites will become cheaper to build. Videos will become easier to produce. Code will become faster to generate. Presentations, reports, marketing materials and research will become increasingly accessible.

As production becomes abundant, production itself becomes less valuable.

Judgement becomes scarce.

The person who can look at ten generated ideas and confidently reject nine will become valuable. The person who can distinguish between a clever sentence and a useful insight will become valuable. The person who can look at an attractive website and recognise that it does not solve the customer's problem will become valuable. The person who can remove half the content because the remaining half is stronger will become valuable.

Most importantly, the person who can tell AI, "This is not how I think," will become valuable.

That is why I do not believe the future belongs simply to people who know how to use AI. Eventually, almost everyone will know how to use it.

The advantage will belong to people who retain enough judgement to use it without becoming shaped by it.

We Should Build More With AI, Not Think Less Because of It

I want AI to help people build more ambitious businesses. I want it to help SMEs compete with much larger organisations. I want entrepreneurs to move faster, experiment more cheaply and create products that would previously have been beyond their resources.

That is the extraordinary promise of this technology.

But that promise depends on maintaining a distinction between assistance and authority.

AI should help us execute faster, but it should not become the owner of our convictions. It should help us explore ideas, but it should not become the source of our identity. It should help us see possibilities, but it should not remove our responsibility to choose among them.

This is why I continue to return to a simple principle in my own work: Dream It. Execute It. Ground It.

The dream must still come from a human understanding of what could exist. Execution can increasingly be accelerated by machines. But grounding — deciding what is useful, what is real, what is appropriate, what deserves trust and what should be rejected — remains a profoundly human responsibility.

The real threat of AI may therefore be much less dramatic than the stories we have imagined.

It may not arrive as a machine announcing that humanity is obsolete.

It may arrive quietly, through thousands of small decisions in which we stop questioning, stop editing, stop disagreeing and stop forming our own conclusions.

AI does not need to destroy humanity.

It only needs humanity to become comfortable enough to stop thinking for itself.

Synopsis

For years, the conversation around artificial intelligence has been remarkably predictable. We are told to use AI to save time, automate repetitive work, improve productivity, reduce operating costs, and free ourselves to focus on “higher-value activities.” None of this is wrong. In fact, businesses have been pursuing the same objectives through software, digitalisation and automation for decades. What has changed is the scale of what AI can now do. If our thinking remains limited to saving a few hours of work, we are underestimating the technology. I believe the more important question is no longer, “How can AI help me?” It is, “How much of me can AI replace?” If you are satisfied with protecting your current role, maintaining your present way of working, and avoiding disruption, this article may not be for you. This argument is meant for people who want to break through, even when that breakthrough requires them to dismantle parts of themselves that once made them successful.

1. The AI Conversation Has Become Too Comfortable

Much of today’s AI discussion is still based on an efficiency mindset. A company introduces AI so that employees can prepare reports faster, respond to customers more quickly, automate administrative work, or generate content in less time. The organisation celebrates because a task that previously required three hours can now be completed in thirty minutes. That is useful, but it is not yet transformation. The more disruptive question is what happens after we discover that a three-hour task only requires thirty minutes. Should the task continue to be structured in the same way? Should the same job description remain unchanged? Should the same number of people still be assigned to the same process? Should the same service continue to command the same price simply because that was how the industry operated in the past? AI forces us to confront uncomfortable questions because it does not merely make an existing process faster; it can make parts of that process unnecessary. This is why I believe we need to move beyond the language of productivity and begin discussing replacement, redesign and reinvention.

2. I Want AI to Replace What I Do Today

My personal approach is deliberately aggressive: I want to identify everything I currently do and determine how much of it can be replaced by AI, automation, software agents, knowledge systems or better processes. If I make ten decisions every day, I want to know whether five of them can be systemised. If I repeatedly answer the same questions, I want that knowledge captured so that people no longer need to wait for me. If I perform routine analysis, prepare documents, follow up with people, monitor progress or coordinate information manually, I want to know whether those activities can be handled without my direct involvement. The objective is not to make myself slightly more productive. The objective is to remove myself from work that no longer requires me. Many people are uncomfortable with this idea because their sense of professional value is closely connected to being needed. I see it differently. If a machine can take over something I currently do, then that activity should no longer be the foundation of my value. I would rather discover this myself than wait for a competitor, a younger generation, or a future technology to discover it for me.

3. There Is Value in Reaching the Point Where You Have Nothing Left to Do

One of the greatest fears surrounding AI is the possibility that people may eventually have less work to do. I understand that concern, particularly at a societal level, but at the level of personal growth I see another possibility. What happens when everything familiar has been taken away? What happens when the skills, routines and responsibilities that once occupied your entire day are no longer necessary? That moment can feel like a low point, but low points have an unusual ability to force human beings to change. When life is comfortable, there is little pressure to reinvent ourselves. When the old path disappears, however, we are forced to search for another one. I have always believed that some of the strongest growth comes after difficult falls. The deeper the fall, the more powerful the potential rebound can become, provided the person is willing to learn and rebuild. In that sense, I do not necessarily want AI to protect me from disruption. I want it to expose where I have become comfortable, where I have become dependent on yesterday’s strengths, and where I need to grow again.

4. Success Can Become a Trap When We Try to Preserve It Forever

People naturally want to protect what made them successful. A professional develops expertise and wants to preserve it. A company discovers a profitable business model and tries to extend it for as long as possible. An entrepreneur builds a process that works and becomes emotionally attached to it. The difficulty is that history does not guarantee relevance. A valuable skill can become a commodity. A premium service can become automated. A complex process can become a feature inside a software platform. A business model that once required a large team can eventually be delivered by a much smaller organisation supported by AI. This is why I do not believe in protecting a “magic sword” forever. No advantage remains permanent simply because it was once powerful. Growth requires the willingness to retire methods that still work before the market forces us to do so. In other words, the real discipline is not only learning new things. It is developing the courage to deliberately make old strengths obsolete.

5. The Higher-Level Role of Humans Is to Build Systems, Not Remain Trapped Inside Them

This principle is particularly important for entrepreneurs and leaders. In the early stages of a business, founders usually do everything themselves. They sell, manage customers, prepare proposals, solve operational problems, supervise employees, make decisions and respond to emergencies. This creates a dangerous psychological association: the more things I personally handle, the more valuable I must be. In reality, as an organisation grows, the opposite can become true. If every important process still depends on the founder, then the founder has become the organisation’s bottleneck. The next stage of leadership is therefore to convert individual capability into systems. Knowledge should become organisational knowledge. Decisions should become frameworks. Repetitive actions should become workflows. Monitoring should become automated. AI agents should be able to perform clearly defined functions within proper boundaries. The leader then moves upward, from doing the work to designing how work is done, and eventually from designing individual systems to designing an architecture of systems. That is where I see one of the most important possibilities of AI: it allows an individual to create and coordinate far more capability than one human being could personally execute.

6. If Machines Continue to Improve, Human Thinking Must Continue to Rise

The same principle becomes even more significant when we look beyond software. AI is increasingly moving into robotics, autonomous systems and physical infrastructure. Over time, the ambition will not simply be to create machines that perform isolated tasks. More advanced systems will increasingly monitor, maintain and coordinate other systems. Robots may assist in producing components used by other robots. Autonomous infrastructure may operate in environments where constant human presence is difficult or impractical. One can imagine future industrial or extraterrestrial environments in which machines draw power from available energy sources, inspect themselves, perform maintenance, manufacture tools and expand operational capacity with limited human intervention. Some people will look at such a future and see something frightening; others will see extraordinary human achievement. Either way, it raises the same philosophical question: if machines can perform an increasing share of execution, where should human value move? My answer is upward. Human beings must become better at defining purpose, creating direction, designing systems, making judgments, establishing governance and imagining possibilities that do not yet exist.

Conclusion: Breakthrough Requires the Courage to Become Obsolete

This is why I no longer find the phrase “use AI to save time so that you can focus on more valuable work” particularly inspiring. It is too safe. It assumes that our existing role should remain intact and that AI should merely make us more efficient within it. I believe we should be far more ambitious. We should use AI to challenge our current relevance. We should identify what can be automated and automate it. We should identify what can be systemised and systemise it. We should remove ourselves from activities that no longer require us and allow that temporary emptiness to force us to think again. The goal is not self-destruction for its own sake. The goal is continuous reconstruction.

My own question is simple: how much of Lukas Tan can I replace with AI today? When that version of me becomes unnecessary, I will have no choice but to create the next version. Then, one day, I should be willing to replace that version too. To me, this is what genuine growth looks like. We do not protect one version of ourselves forever. We repeatedly build, challenge, dismantle and rebuild.

That is also the kind of conversation I want to bring to organisations, businesses, universities and communities. I am not interested only in demonstrating the latest AI tools or teaching people how to complete yesterday’s work faster. Through my entrepreneurial journey, technology experience, failures, reinventions and the systems I continue to build, I want to challenge people to reconsider what makes them valuable in the first place.

If your organisation is looking for a conventional AI presentation, there are many people who can deliver one. But if you want a sharing session that challenges people to rethink their comfort zones, their careers, their organisations and the value of their own existence in an AI-driven world, that is a conversation I would be interested in having.

Because perhaps the most important question of the AI era is not how we can avoid being replaced.

It is whether, after everything replaceable has been taken away, we are capable of creating a stronger version of ourselves.

Synopsis

Many business owners today are not rejecting AI, digitalisation, or technology investment. What they are really struggling with is uncertainty. They are asking whether the system they build today will still be useful two years from now, whether AI will replace the functions they are investing in, and whether a RM20,000 or RM100,000 technology project will still make sense after the next wave of innovation arrives. I understand this concern because I have faced it myself. I have invested in systems, tested ideas, and spent months developing technology that I later decided not to continue. Yet those experiences taught me something important: in the AI era, waiting for perfect certainty can become more expensive than making a controlled mistake. The answer is not to take reckless risks. The answer is to take smaller, calculated risks, learn from them, and keep moving.

Why Business Owners Are Hesitating

The hesitation I see today is not because business owners do not want to improve. In many cases, they are very aware that AI is changing the business environment. Their real concern is whether they are investing at the right time. A business owner may look at a proposal and immediately ask whether the technology will still be relevant in three years, whether something better will appear next year, or whether the entire system may need to be rebuilt after a new AI capability becomes available. These are reasonable questions because technology is evolving much faster than before. The difficulty is that there may never be a perfect moment when all the answers become clear. If a company keeps waiting for the technology to stabilise, it may eventually discover that the market has moved on while the company is still evaluating.

I Have Paid for the Wrong Technology Decisions Too

I am not writing this from the perspective of someone who always makes the right decisions. I have made expensive mistakes and invested in systems that did not continue the way I originally expected. One of the clearest examples came from an exhibition project where we needed to process a large amount of data. We needed to scrape information, organise records, analyse leads, perform outreach, and manage follow-up. Instead of depending entirely on manual work, we decided to build an application to manage the process. Programmers worked on the system for approximately twelve months, and the project gradually became more complex. If I estimate the manpower and development investment at close to RM15,000 per month, the total exposure was approaching RM180,000. After the event, however, I had to decide whether continuing to develop the same system was still the right direction.

The Hardest Part Is Knowing When to Stop

When a company has already invested a large amount of money, the natural reaction is to continue. Management starts thinking about the time spent, the development cost, the people involved, and the fact that so much work has already been completed. Walking away can feel like admitting failure. However, previous investment does not automatically justify future investment. By the time we reviewed the system, AI had advanced significantly and new approaches were becoming possible. We could see that parts of the system we had built in a traditional way might be redesigned more efficiently with AI-driven workflows. The existing system could still function, but that was no longer the most important question. The more important question was whether continuing to invest in it would still move us toward the best future position. In the end, I decided that it would not.

Not Every Failed Investment Is Completely Wasted

From a purely financial perspective, someone could say that the RM180,000 was wasted. The original system did not continue in the way we first planned, and the long-term return was not what we expected. However, from an entrepreneurial perspective, I do not see the experience as completely wasted. Because we built the system, we learned how the entire process worked in reality. We understood where scraping became difficult, where data quality broke down, where automation became unreliable, where human intervention was still necessary, and where the architecture became too rigid. We also learned what we should not build again. Without that experience, I might still be sitting here today believing that the original approach was correct. Sometimes the value of an experiment comes from proving that a direction should not continue.

Some Answers Only Appear After You Try

I have experienced the same thing with smaller experiments. At one point, I considered using AI-generated digital humans for short-form video content. I thought about it for months before finally trying it. Once I tested it, I realised that the result did not fit the way I wanted to communicate, the style of my personal brand, or the authenticity I wanted the content to have. That experiment gave me an answer that observation alone could not provide. I did not need to keep wondering whether I should use the technology. I had tested it, understood its limitations, and moved on. This is why direct experimentation matters. You can attend conferences, watch competitors, speak to consultants, and study trends, but some business answers only become clear after you use the technology in your own environment.

The Hidden Cost of Doing Nothing

Waiting feels safe because the cost appears to be zero. If a company does not spend RM20,000, the money remains in the bank. If it does not build a system, there is no development failure. If it does not test a new AI platform, there is no risk of choosing the wrong one. However, the cost of inaction is usually hidden. A company that waits for one year may also lose one year of learning, one year of process improvement, one year of staff development, and one year of understanding how AI can or cannot help the business. It may also lose the opportunity to make small mistakes while the cost of those mistakes is still manageable. The money that was not spent is easy to see, but the capability that was never developed is much harder to measure.

A Practical AI Action Plan for SMEs

For SMEs, I do not believe the starting point should be a massive AI transformation programme. The first step should be to identify one business problem that is already costing the company time, money, manpower, or missed opportunities. It may be slow quotation preparation, repetitive customer enquiries, manual reporting, lead follow-up, document processing, internal knowledge search, or data entry. Start from the business pain, not from the AI tool. Once the problem is clear, choose one small experiment that can be completed within a defined budget and time frame. An SME should be able to answer three questions before starting: what problem are we solving, how much are we willing to risk, and what evidence will tell us whether the experiment is working?

The second step is to place a ceiling on the experiment. A company that is uncertain about a RM100,000 project should not begin by signing a RM100,000 commitment. It can begin with a RM2,000, RM5,000, or RM10,000 pilot, depending on the size of the business. The experiment should be narrow enough that failure will not damage the company, but meaningful enough that management can learn something from the result. Give the test thirty, sixty, or ninety days. Measure whether it saves time, reduces manpower, generates leads, improves customer response, or produces better information. At the end of the test, management should make a deliberate decision to stop, improve, or scale.

The third step is to keep what works and remove what does not. SMEs do not have the luxury of maintaining technology simply because management is emotionally attached to it. If the experiment works, expand it gradually. If it only works partially, redesign the weak areas. If it does not work, stop and record what was learned. The objective is not to prove that every AI project succeeds. The objective is to make each experiment improve the next decision. Over time, a company builds not only technology, but internal judgment about what AI can genuinely do for the business.

Risk-Taking Should Be Controlled, Not Reckless

For me, risk-taking has never meant gambling. It means entering uncertainty with a clear limit on what I am willing to lose and a clear idea of what I want to learn. Before making an investment, I still look at the downside, question whether there is a cheaper option, and ask whether the technology is mature enough. But there comes a point when analysis must become action. If the risk is small enough and the potential learning is meaningful enough, I would rather test the idea than spend years wondering whether it might have worked. Good risk-taking also requires the discipline to stop when the evidence says the direction is wrong.

Moving Forward Without Perfect Certainty

The AI era is unlikely to give business owners the certainty they are looking for. New models will continue to appear, platforms will continue to change, and business processes will continue to evolve. The companies that perform well may not be the ones that predict every technology correctly. They may simply be the companies that are willing to test earlier, learn faster, stop bad ideas sooner, and scale good ideas with greater confidence.

My own approach has always been to move, learn, adjust, and move again. I do not believe every business needs to take a large risk, but I do believe every business should take some risk that it can afford to learn from. For SMEs, that may mean starting with one problem, one team, one process, and one manageable budget. The objective is not to become an AI company overnight. The objective is to develop the ability to experiment, make better decisions, and adapt before change becomes unavoidable.

In the AI era, the danger is not only making the wrong move. The greater danger may be spending so long waiting for the perfect move that the organisation never develops the experience required to make the next one.

Synopsis

Artificial intelligence is making it easier than ever for businesses to automate reports, summarize emails, analyze data, generate documents, monitor operations and deliver information instantly. Yet there is a growing danger hidden inside this convenience: companies may become faster without becoming better.

The biggest mistake businesses can make in the AI era is to take an outdated business process and simply add AI on top of it.

If a company still operates through the same meetings, approvals, emails, spreadsheets, reports and information flows it used ten years ago, adding AI will not necessarily transform the business. In many cases, it will simply accelerate the existing process. The company may receive information faster, produce more reports and automate more tasks, yet management may still spend the same amount of time reading, checking, responding and making decisions.

Real AI transformation begins before automation. It begins by redesigning how work should flow in the first place.

AI Can Make a Bad Process Faster

There is a dangerous assumption emerging in many organisations: if a process is automated, it must have improved.

That is not necessarily true.

Imagine a company where management receives twenty reports every week. Before AI, employees spend hours preparing those reports manually. After introducing AI, the same twenty reports can be generated automatically within minutes.

From a technology perspective, this looks like progress. The company has saved manpower and reduced preparation time. But there is another question that is far more important: does management still need to read all twenty reports?

If the answer is yes, then the company has automated report production without redesigning decision-making.

The bottleneck has simply moved.

Before AI, employees were overloaded with preparing information. After AI, executives may become overloaded with consuming information.

That is not transformation. It is faster information production.

Information Is Not the Same as Intelligence

AI makes information extremely cheap to produce.

A company can now generate daily summaries, weekly dashboards, customer reports, operational updates, market intelligence, sales analyses, meeting notes and recommendations almost automatically.

This sounds powerful, but more information does not automatically produce better decisions.

In fact, when organisations are not disciplined about how information reaches people, AI can make the situation worse. Managers may wake up every morning to ten automated reports, dozens of notifications, several dashboards and multiple AI-generated summaries.

Each report may be useful individually. Together, they can create a new form of corporate noise.

The purpose of AI should not be to make humans read faster. The purpose should be to reduce the amount of unnecessary information humans need to process in the first place.

True intelligence is not about showing decision-makers everything. It is about ensuring that the right person sees the right thing only when a human decision is genuinely required.

The Email Example Reveals the Problem

Email is one of the easiest examples.

Many people proudly say that they use AI to organize their inbox. The AI categorizes messages, summarizes long email threads, highlights important emails and prepares suggested replies.

This is certainly useful.

But it is still solving the problem at the surface level.

Imagine receiving 300 emails a day. AI may successfully classify those emails into categories and tell you that only 20% are important. That sounds impressive until you realize that you still have 60 important emails to review.

The better question is not, "How can AI help me read my email?"

The better question is, "Why does so much of my business depend on email in the first place?"

Perhaps internal approvals should happen inside a workflow system. Customer service issues may belong inside a ticketing platform. Sales activities should be recorded in a CRM. Project updates may belong inside a project management system. Routine operational information may not need to reach management at all unless something falls outside an agreed threshold.

Once the process is redesigned, email becomes the exception rather than the operating system of the company.

That is a much more meaningful transformation.

A Good AI Redesign Should Reduce Human Attention

I believe one of the simplest ways to measure successful AI transformation is not by asking how many tasks have been automated.

Ask how much human attention has been returned.

Suppose a business owner currently checks email from morning until night. After redesigning the workflow and introducing AI, the owner only needs to review email once a day.

That is progress.

If the system is redesigned further and the owner only needs to review email every two or three days, that is even better.

If routine communication, approvals, operational updates and internal workflows are handled through properly designed systems, and the owner only needs to review email once a week for exceptional cases, the organisation has achieved something much more important than email automation.

It has redesigned the way information reaches the leader.

The same principle applies to meetings, reports, customer follow-ups, internal approvals and operational monitoring.

The objective is not to make humans interact with AI more often. It is to reduce the number of unnecessary interactions humans need to have with the business.

Do Not Automate A-to-B-to-C If Humans Are Not Needed

Many traditional business processes look something like this: Department A prepares information and sends it to Department B. Department B reviews it and forwards it to Department C. Department C then consolidates everything into a report before management receives it.

When AI arrives, many companies automate each individual stage.

Department A uses AI. Department B uses AI. Department C uses AI.

The organisation celebrates because everyone is now "using AI."

But the more important question is whether B and C are still necessary steps.

Perhaps the information can move directly from the source system into an automated workflow. Perhaps validation can happen automatically. Perhaps approval is only required if the transaction exceeds a certain amount. Perhaps management only needs to be notified when a defined exception occurs.

In that case, the correct transformation is not to make A, B and C faster.

The correct transformation may be to redesign A-to-B-to-C entirely.

That is the difference between digital automation and business transformation.

AI Should Manage Exceptions, Not Manufacture Reports

Traditional management relies heavily on reporting because systems were historically unable to understand context.

Managers therefore asked teams to prepare reports so that they could identify what required attention.

AI changes this possibility.

Instead of producing a 30-page report every Monday and expecting management to find the problem, an intelligent system should continuously monitor the underlying data and notify management only when an agreed condition is triggered.

For example, a sales leader may not need a daily report listing every salesperson and every opportunity. The system should instead identify customers who have not been followed up within the agreed period, deals whose probability has changed significantly, unusual declines in conversion, or opportunities above a strategic value threshold.

Management should not be receiving more information.

Management should be receiving more exceptions.

That is a fundamentally different way of designing an organisation.

Start With Process Redesign, Not AI Tools

When businesses discuss AI transformation, conversations often begin with tools.

Should we use ChatGPT? Claude? Gemini? An AI agent? Automation software? An AI CRM?

These questions matter, but they are not the first questions.

The first questions should be operational.

Why does this process exist?

Why does this person need to approve it?

Why does this report need to be produced?

Why does this information need to reach management?

Why are we using email for this?

Why does information travel through three departments before reaching the customer?

Which decisions actually require human judgment?

Which decisions can be governed through clearly defined rules?

Once these questions are answered, the role of AI becomes much clearer.

AI should enter a redesigned organisation with a defined responsibility, not be attached randomly to every existing process.

AI Should Remove Work, Not Decorate Work

There is a difference between using AI and becoming an AI-enabled organisation.

A company may use dozens of AI tools and still operate fundamentally the same way it did before.

Employees generate documents faster. Managers receive better summaries. Reports look more professional. Meetings are automatically transcribed. Emails are drafted instantly.

These are useful improvements, but they can easily become cosmetic productivity.

AI becomes a digital accessory attached to the old organisation.

The deeper opportunity is to remove work.

Remove unnecessary reports. Remove unnecessary meetings. Remove unnecessary approvals. Remove repeated data entry. Remove unnecessary information transfers. Remove human involvement where clear rules already exist.

If AI merely helps employees perform the same twenty steps more quickly, we should question whether twenty steps were necessary in the first place.

The Goal Is Not More AI. The Goal Is Less Friction

The most successful companies in the AI era may not be the companies with the largest number of AI agents.

They may be the companies that require the least unnecessary human effort to operate.

Their leaders are not flooded with dashboards. Employees are not constantly producing reports. Departments are not forwarding information back and forth simply because "that is how we have always done it."

Instead, the company becomes increasingly event-driven.

Normal operations happen automatically.

Systems communicate with systems.

AI monitors patterns.

Workflows execute predefined actions.

Humans enter when judgment, creativity, relationship, negotiation, accountability or strategic decision-making is genuinely required.

That is a far more mature vision of AI.

If AI Is Giving You More to Read, Something May Be Wrong

This leads to a simple test.

After implementing AI, ask yourself:

Do you have fewer things to read?

Fewer meetings to attend?

Fewer reports to review?

Fewer approvals to make?

Fewer routine decisions?

Fewer repetitive conversations?

If the answer is no, your organisation may have introduced AI without redesigning work.

You may be producing information faster while remaining trapped inside the same operating model.

AI should not become another employee who sends the CEO more reports.

It should help redesign the company so the CEO needs fewer reports.

Redesign the Company Before You Automate It

Every organisation considering AI should resist the temptation to automate immediately.

First, map the process.

Then challenge it.

Remove what is unnecessary.

Combine what can be combined.

Move structured work into structured systems.

Define decision thresholds.

Define exceptions.

Define where human judgment is truly necessary.

Only after that should AI be introduced.

Otherwise, businesses risk spending money to automate inefficiency.

AI is extraordinarily powerful, but it cannot compensate for a poorly designed organisation. In fact, because AI can operate at extraordinary speed and scale, it can amplify poor design just as easily as it can amplify good design.

The question is therefore no longer simply, "How can we use AI?"

The more important question is:

"If we were designing this company today, knowing that AI exists, would we still design the process this way?"

For many organisations, the answer will be no.

Call To Action: Stop Automating the Old Company

If your organisation is currently rushing to introduce AI agents, automate email, generate more reports, connect more dashboards or push more information to management, stop for a moment and look carefully at the company underneath the technology.

Do not automate a business process simply because AI can automate it.

Redesign it first.

Challenge every approval, every report, every email, every handover, every meeting and every piece of information that travels through your organisation. Ask what can disappear completely before asking what can be automated.

The companies that win in the AI era will not simply be companies that use AI everywhere.

They will be companies that have redesigned themselves around a new reality: machines can execute, systems can communicate, AI can monitor, and humans should only be pulled into the moments where human judgment genuinely creates value.

If you are serious about AI transformation, do not begin by buying another AI tool.

Begin by looking directly at your company.

Redesign the process. Redesign the information flow. Redesign the decision flow. Redesign the business before AI redesigns it for you.

That is where the real work begins.

For many years, I thought about Corporate Social Responsibility in much the same way many SME owners probably do. CSR was important, but it also looked expensive. It seemed to require a dedicated budget, people to organise activities, partnerships to coordinate, events to manage, reports to prepare and enough management attention to keep everything moving. Large corporations may have dedicated sustainability or CSR teams to handle this work. An SME usually does not.

This creates an uncomfortable situation. Many SME owners genuinely want to contribute to society, but the business itself is already consuming most of their resources. There are customers to serve, employees to manage, products to improve, sales targets to meet and cash flow to protect. When CSR is designed as another large project sitting on top of all those responsibilities, it becomes difficult to sustain.

I began wondering whether the problem was not CSR itself, but the way we were designing it.

What if a CSR initiative could consume relatively few additional resources while still creating meaningful impact? What if it could use capabilities that already exist inside the company instead of requiring an entirely new operation? What if we could design it once, improve it through experience and repeat it many times? And what if the impact could continue travelling even after our direct involvement ended?

Over time, through our work in scam-prevention education, I began to see a pattern.

I would describe it today as a lean, repeatable CSR model: start with something close to what you already know, reduce the resources required to deliver it, create a repeatable method, allow the beneficiaries themselves to carry the message further, and eventually build content, intellectual property and partnerships around the model so that impact can grow without resources growing at the same rate.

That sounds like business thinking because, in many ways, it is.

And I believe SMEs should apply more of it to CSR.

CSR Should Not Exhaust the Business Creating the Impact

A social initiative is not sustainable simply because its purpose is good. If every activity requires extraordinary effort, large budgets and constant founder involvement, eventually the organisation will struggle to continue it.

This is something entrepreneurs understand instinctively in business. If every customer requires a completely different process, the business becomes difficult to scale. If every sale depends entirely on the founder, there is a bottleneck. If costs increase at exactly the same rate as growth, there are limits to how far the business can expand.

We respond by building systems. We simplify processes. We create templates. We automate where appropriate. We document what works. We turn individual efforts into repeatable operations.

I began asking myself why CSR should be completely different.

The objective should not be to minimise resources simply for the sake of spending less. The objective should be to improve the ratio between resources consumed and impact created.

If ten hours of preparation are required every time we conduct a one-hour activity, can we redesign it so that the preparation is done once and the same framework can be used repeatedly? If every programme requires new materials, can we create reusable materials? If impact stops the moment we leave the room, can we create something that participants take home and share with others?

These questions gradually shaped the way I approached our scam-prevention initiative.

The Starting Point Was Not CSR

Interestingly, I did not begin by deciding that we needed a CSR programme.

I began with a problem that bothered me.

Scams were becoming increasingly visible in Malaysia. Every few days there seemed to be another story about someone losing money through impersonation, fraudulent investments, phishing, fake jobs, fake purchases or social engineering.

Coming from a technology background, I was naturally interested in the digital side of the problem. But the more I studied scams, the more I realised that technology was only one part of the equation.

The tools change, but the human vulnerabilities remain remarkably consistent.

Scammers exploit urgency. They exploit fear, trust, greed, loneliness, curiosity and love. They convince people to act before thinking. Technology makes the message faster, cheaper and increasingly convincing, but the final target is still a human decision.

That led me to a different question: if judgment is one of our defences against scams, why do we wait until adulthood to teach it?

That question eventually brought us into schools.

Initially, the idea was straightforward. We would share scam awareness with students and help them recognise risky situations. But once we began doing the work, I started applying the same questions I would ask when developing a product or business process.

What is the minimum that a child really needs to remember?

What part of the message creates the greatest effect?

What can be removed?

What can be repeated?

What can be standardised?

What can continue after we leave?

Without intentionally setting out to build a CSR framework, we were beginning to create one.

The First Principle: Start Close to What You Already Know

I believe one reason CSR becomes resource-heavy is that businesses sometimes choose initiatives far removed from their existing capabilities.

The company then has to build almost everything from zero: knowledge, content, processes, networks and sometimes even credibility.

For SMEs, I believe there is another approach.

Start close to your existing strengths.

Our company works in technology, software, digitalisation and education. I spend time speaking, training and explaining technology to different audiences. Scam prevention sits naturally beside those capabilities.

That meant we did not need to create an entirely separate organisation before contributing. We could use knowledge, communication skills, technology experience and resources that already existed.

This is the first part of the model:

Use existing capability before adding new resources.

An accounting company could contribute financial literacy. A technology company could contribute digital awareness. A restaurant could contribute food education. A creative agency could help communities communicate. An engineering business might contribute technical or safety knowledge.

Every company accumulates expertise while doing business.

That expertise has social value too.

If CSR begins with something adjacent to what the organisation already knows, the additional resources required can be dramatically lower.

The Second Principle: Reduce the Message to What Actually Matters

When we started thinking about scam education for children, it would have been easy to create a comprehensive programme covering every known category of scam.

But comprehensive does not always mean effective.

Children do not need to memorise 30 types of scams. Even adults cannot keep up with every new technique. The moment we finish teaching today's list, new variations will emerge.

Instead, I began reducing the message to three behaviours:

Slow down. Ask questions. Tell an adult.

If somebody creates urgency, slow down.

If something feels strange or unusually attractive, ask questions.

If someone asks for secrecy, especially around money or an online interaction, tell a parent, teacher or trusted adult.

These three behaviours require very little technical knowledge. More importantly, they remain useful even when the scam changes.

One technique I share is extremely simple: pause for three seconds when someone is pushing you to act immediately.

That tiny pause introduces friction between emotion and action.

Once there is a pause, there is space for a question: Why is this urgent? Why must I do it now? Why can I not tell my parents? Why am I being offered this?

In a world where technology is designed to remove friction from everything—clicking, purchasing, sharing, transferring and responding—sometimes adding a little friction back into a decision is protective.

This became the second principle of the model:

Simplify the intervention until the important part becomes easy to remember and easy to deliver.

Complexity consumes resources. Simplicity travels.

The Third Principle: Build a Repeatable Unit

The next question was operational.

If we wanted to visit schools, we could not reinvent the programme for every school. That would make the initiative dependent on too much preparation and too many people.

So we began thinking in terms of a repeatable unit.

A school. A session. A defined duration. A consistent core message. Reusable materials. A simple operating process.

Then repeat.

Each school still has its own environment and students, of course, but the underlying model does not need to be rebuilt each time.

This sounds obvious, yet I think it represents an important shift in how SMEs can approach CSR.

Instead of thinking only in terms of campaigns, we can think in terms of systems.

A campaign is designed to happen.

A system is designed to happen again.

The distinction is important because social impact often comes from accumulation rather than one spectacular event.

One school may feel small. Twenty schools are no longer so small. Thousands of students reached through a repeatable process begin to represent something meaningful.

The resources required do not need to increase at the same rate as the impact because much of the thinking, content and preparation has already been done.

That is the third principle:

Design one unit of impact that can be repeated without rebuilding the programme every time.

The Fourth Principle: Let Impact Travel Beyond the Direct Beneficiary

This was probably the most interesting part of the model for me.

When we educate one student, have we reached one person?

Initially, the obvious answer is yes.

But children go home.

They talk.

They repeat interesting things they learned in school. They tell their parents about unusual stories. Sometimes they correct adults.

A child who learns that scammers create artificial urgency may later see a parent responding to a suspicious message and say, "Wait. Let's check first."

Suddenly, the impact of educating one child has travelled beyond the person sitting in front of us.

This changed the way I thought about the initiative.

We normally imagine adults as the guardians. Parents protect children. Teachers protect students. Society protects young people.

But information can move in both directions.

A child can also become a small guardian inside the family.

I am not suggesting that children should carry adult responsibilities. They should not. What we can give them is permission to notice, question and speak up.

If a child sees something suspicious and feels comfortable telling a parent, that itself is protection. If a child brings home a simple scam-prevention principle and the family discusses it over dinner, the classroom has extended into the home.

This became the fourth principle:

Do not only measure the people you directly reach. Design the intervention so that the message can travel through them.

That is leverage.

And leverage is one of the reasons a relatively small CSR activity can produce a larger social footprint.

The Fifth Principle: Turn Repeated Knowledge Into Intellectual Property

There was still a weakness in the model.

A talk ends.

No matter how good the speaker is, everyone eventually leaves the room. Memories fade.

After visiting schools and repeating the programme, however, something valuable begins to accumulate: knowledge.

We learn which examples children understand. We learn what makes them laugh. We learn which questions they ask. We learn which explanations are too complicated. We learn what teachers notice. We learn which messages children remember.

In business, accumulated knowledge like this should not remain only inside one person's head.

It should become intellectual property.

That thinking eventually contributed to ScamAlert Jr.

The idea was not simply to publish another book about scams. The book became a way of capturing what we were learning from the initiative and turning it into something that could travel without us.

Instead of depending entirely on a speaker standing in front of students, stories and characters can carry the message.

A child can take a book home. A sibling can read it. A parent may pick it up. A teacher can return to it later.

The model begins to evolve:

School → Student → Home → Family.

And the role of the organisation changes as well.

At the beginning, impact depends heavily on our time.

Later, content begins doing some of the work.

This is the fifth principle:

Convert repeated experience into reusable content and intellectual property so that impact becomes less dependent on your physical presence.

For an SME, I think this is particularly powerful.

We may not have thousands of employees to deploy into communities. But we can create knowledge, frameworks, books, videos, tools, software or educational materials that continue working after we have left.

The Sixth Principle: Build an Ecosystem, Not a Larger Internal Team

There is another trap when an initiative begins growing.

The instinct is to build a larger internal team.

Sometimes that is necessary. But every additional layer also creates cost and management complexity.

An alternative is to build an ecosystem.

Schools already have students, teachers and communication channels. Corporate partners may have CSR budgets and community networks. Educators understand children. Industry organisations have expertise. Bookstores have distribution. Publishers and content creators understand how ideas travel.

The SME does not necessarily need to own every part of the system.

Our role can be to build the core model and then work with partners who already possess the infrastructure required for the next stage.

This is again very similar to entrepreneurship.

Strong businesses do not necessarily own every component of their value chain. They identify where they create the most value and collaborate elsewhere.

CSR can work the same way.

The sixth principle therefore is:

Scale through partnerships before scaling internal overhead.

This keeps the organisation lighter while allowing the initiative to travel further.

The Model: Less Resource, Greater Impact

Looking back, I can now see the pattern more clearly.

Our approach can be summarised as a simple progression:

Existing Capability → Simple Intervention → Repeatable Process → Beneficiary Multiplier → Intellectual Property → Partner Distribution

Each stage attempts to increase impact without requiring resources to increase at the same rate.

We start with what we already have.

We simplify what we deliver.

We make the delivery repeatable.

We encourage the people we reach to carry the message further.

We convert experience into reusable intellectual property.

Then we work with partners to expand distribution.

This is the model I am increasingly interested in developing.

I do not claim that it is appropriate for every CSR initiative. Some social problems genuinely require significant capital, specialised expertise and large institutions. Nor should "low resource" ever become an excuse for low quality.

The point is different.

Resource efficiency should be part of CSR design.

If two approaches can create comparable social value, but one requires substantially fewer recurring resources, the more efficient model has a better chance of surviving.

And longevity matters.

Impact Per Unit of Resource

Businesses constantly measure efficiency.

Revenue per employee. Cost per acquisition. Output per hour. Return on investment.

Perhaps CSR deserves a similar—but not purely financial—way of thinking.

I have started thinking about something I would call Impact Per Unit of Resource.

The concept is simple.

For every hour, ringgit and person committed to an initiative, how much useful and sustainable impact are we creating?

This should not become an excuse to reduce social contribution to a spreadsheet. Human impact cannot always be quantified accurately. But the question itself is useful because it forces us to examine the design of the programme.

Can one trainer reach several hundred students using a well-designed session?

Can those students carry the message into hundreds of homes?

Can one piece of educational content be reused across many schools?

Can a book continue delivering the message after the original programme ends?

Can corporate partners sponsor distribution rather than requiring us to finance everything ourselves?

Can teachers eventually use parts of the material without our presence?

Each time the answer becomes yes, the impact-to-resource ratio improves.

For an SME, that ratio may determine whether CSR remains an occasional activity or becomes something the company can sustain for years.

The Business Must Be Sustainable Too

There can sometimes be discomfort around discussing efficiency, intellectual property, partnerships or commercial mechanisms in the context of CSR.

I understand why.

We do not want social initiatives to become disguised marketing exercises.

But I also believe we need to be realistic.

Social impact requires resources.

Books need to be written, illustrated, printed and distributed. Programmes require people. Technology requires development. Travel costs money. Content requires time.

If the organisation providing all of this is continually depleted by the initiative, eventually the initiative stops.

Sustainability must therefore work in both directions.

The social mission must be sustainable, but so must the organisation supporting it.

That does not mean every CSR activity must generate revenue. It means we should be willing to design ecosystems in which free education, corporate sponsorship, commercial products, partnerships and intellectual property can coexist where appropriate, provided the economic mechanisms support rather than compromise the mission.

A commercially available book, for example, can extend the reach of an educational initiative. Corporate sponsorship can fund distribution to communities. Paid products can help support free activities elsewhere.

The relevant question is not simply whether money exists somewhere in the system.

The more important question is whether the system allows the impact to continue.

Why Scam Prevention Is Really About Judgment

As the model developed, my understanding of the mission also changed.

I started with scam awareness.

Today, I increasingly think we are teaching judgment.

Scam techniques will continue evolving, especially with artificial intelligence. Synthetic voices will become more convincing. Images and videos will become easier to manipulate. Messages will become increasingly personalised. It will become harder to judge authenticity simply by looking for obvious mistakes.

We cannot prepare children for that world by giving them a static list of today's scams.

We can prepare them by developing habits.

Pause.

Question.

Verify.

Discuss.

Ask who benefits.

Ask why something is urgent.

Ask whether the information can be confirmed through another channel.

These are not only anti-scam skills.

They are skills for navigating an information environment in which increasingly convincing content can be generated cheaply and at scale.

That makes the mission larger than I originally imagined.

The objective is not to create a generation that is frightened of scams.

It is to contribute, in our own small way, to a generation that thinks before reacting.

What Other SMEs Can Take From This

I am sharing this model because I believe many SMEs underestimate what they can contribute.

You do not necessarily need a CSR department.

You do not necessarily need a large annual CSR budget.

And you do not need to copy what multinational corporations are doing.

Start by looking inside your own organisation.

What knowledge have you accumulated?

What problem do you genuinely care about?

Where does that problem overlap with your existing expertise?

What is the smallest useful intervention you could create?

Can you turn it into a repeatable unit?

Can the people you help carry part of the impact forward?

Can repeated experience become reusable content or intellectual property?

Can partners eventually help distribute it?

Those questions can produce a very different type of CSR programme.

Instead of starting with resources and asking how much impact they can buy, start with a model and ask how efficiently impact can travel.

For me, that is the difference between simply conducting CSR activities and designing a CSR engine.

From One School to a Model

Our own model is still developing.

We continue going into schools. We continue learning from students and educators. We continue simplifying the message and improving the process. We are learning how to turn what began as individual awareness sessions into something more structured and more capable of travelling beyond us.

The next step is ScamAlert Jr.

ScamAlert Jr is planned for launch in Q4 2026, with availability targeted at major bookstores in Malaysia. The book is part of our attempt to convert what we have learned through school engagement into stories that children can carry home and families can discuss together.

But I do not see the book as the destination.

It is another component in the model.

A talk reaches the room.

A repeatable programme reaches more rooms.

A child carries the message into a home.

A book allows the message to stay there.

A partner helps it reach another community.

Each layer increases reach without requiring our internal resources to expand at exactly the same rate.

That is the pattern I want to continue exploring.

Perhaps the future of SME CSR is not about doing bigger projects.

Perhaps it is about designing better multipliers.

Use what you already know. Reduce unnecessary complexity. Build something repeatable. Turn experience into intellectual property. Work with people who already have the infrastructure you lack. And continually ask whether the impact is growing faster than the resources required to create it.

That is how I now think about CSR.

Not simply as giving back.

Not as an annual activity.

Not as a large cheque or a photograph in an annual report.

But as a system that can be designed, tested, improved and repeated.

For our scam-prevention initiative, the unit may begin with something as small as one child learning to pause before clicking.

If that child takes the lesson home, reminds a parent, starts a conversation and one day prevents a rushed decision, the impact has already travelled further than the original classroom.

That is the kind of CSR model I want to build:

less resource-intensive, more repeatable, and capable of creating impact far beyond the organisation that started it.

And we are only at the beginning.

By Ts. Lukas J. Tan | 22 September 2026

From a Small File Problem to a Long-Term R&D Journey in Secure Document Processing

When we first started thinking about PDF-X, the idea looked almost too simple.

People have PDF problems.

A file is too large to upload. Someone needs only a few pages from a document. Several PDFs need to become one. A document needs a password before it can be sent.

There are already many PDF tools on the Internet, so at first glance there seems to be very little left to invent.

But that was exactly what made this project interesting.

The more we studied the market, the more we realised that the problem was not simply whether a PDF tool already existed.

The more important questions were:

• Why are people still struggling with these problems if so many tools already exist?
• Why do simple document tasks still require users to understand technical settings?
• What happens behind the scenes when a public website processes a document uploaded by a stranger?
• How much of the existing experience is designed around what the software can do, rather than what the user actually needs?

Those questions changed PDF-X from a small utility project into something much more interesting to us from a research and development perspective.

Today, I see PDF-X not as the end product of an idea, but as the beginning of a much longer exploration into document processing, secure execution, user experience, infrastructure efficiency and eventually the future relationship between people, documents and intelligent software.

It Started With the Market, Not the Technology

Our first step was not to decide which programming language or PDF library to use.

We started by looking at how people currently solve document problems.

There are large international PDF platforms with dozens of tools. There are desktop applications. There are free websites supported by advertising. There are paid subscription products. There are developer APIs.

Technically, the market is already mature.

But mature does not necessarily mean finished.

What we saw was a gap between technical capability and human intention.

For example, a user may be asked whether they want low, medium or high compression.

But that may not be the user's real question.

Their real question may be:

"The government portal says my PDF must be below 2 MB. Can you make it fit?"

That difference looks small, but from a product-design perspective it is significant.

The user should not need to understand DPI, JPEG quality, image recompression, object streams or PDF optimisation algorithms.

The software should understand those things.

The user should simply be able to communicate the outcome.

That became one of the earliest principles behind PDF-X:

Tell us what you need. Let the system handle the technical complexity.

This principle later influenced almost every decision we made.

We Deliberately Reduced the Product Before Expanding It

Early in the research process, it was very easy to imagine a large document platform.

PDF to Word. Word to PDF. Images to PDF. OCR. Signing. Watermarks. Rotation. Extraction. Conversion. Compression. And dozens more.

But we eventually moved in the opposite direction.

Instead of asking, "How many tools can we launch?", we asked:

What are the few problems worth solving first?

The initial public focus became four functions: Reduce PDF Size. Split PDF. Merge PDF. Protect PDF.

That reduction was intentional.

R&D is not only about adding capability. Sometimes R&D is also the process of discovering what not to build yet.

Word-to-PDF is a good example.

Technically, it is possible. But document conversion introduces another class of complexity: fonts, layout fidelity, images, headers, tables, office formats, rendering engines and additional execution risk.

Rather than releasing it simply because we could, we decided that it should wait until we were satisfied with the processing and isolation model.

That decision represents an important philosophy we developed through the project:

A feature is not finished merely because it works. It is finished when we understand how it behaves, fails, scales and affects the rest of the system.

That is a very different way of looking at product development.

"Reduce PDF" Became a Research Problem

Compression initially sounds straightforward. Take a large PDF. Compress it. Return a smaller PDF.

But once we looked more deeply, we realised the user's expectation is different from a generic compression function.

If someone asks for a PDF below 1 MB, reducing a 10 MB file to 3.5 MB is technically successful compression, but it has failed the user's task.

So the engineering problem becomes:

Given a PDF and a target maximum size, can we produce the highest practical quality result that fits within that limit?

That changes the problem. Now we are dealing with optimisation rather than a simple command.

Different PDFs behave differently.

• A text-heavy document is different from a scanned document.
• A document containing photographs is different from one containing vector graphics.
• An already optimised PDF behaves differently from one containing oversized embedded images.
• A document may not be reducible to the requested target without unacceptable quality loss.

Suddenly, a very ordinary button, Reduce PDF Size, becomes a technical research problem involving content analysis, iterative optimisation, quality trade-offs and honest communication with the user.

This is where PDF-X became particularly interesting to me.

The simpler we wanted the user experience to become, the more sophisticated the engineering underneath sometimes needed to be.

That is a pattern I believe will become increasingly important in software.

Complexity should move away from the user and into the system.

Then We Reached the Security Question

The biggest change in our thinking came when we started looking at the processing architecture itself.

A public PDF platform has a fundamental characteristic: it accepts files from people it does not know.

From a security perspective, that changes everything.

An uploaded PDF cannot simply be treated as a document. It must be treated as untrusted input.

PDF parsers and document-processing engines are complex pieces of software. They process compressed data, fonts, images, metadata, object structures and many different variations of the format.

Software can contain vulnerabilities.

So we asked a new question:

If a document-processing engine is ever compromised by a malicious file, what would that process be able to access?

This question became one of the most important R&D directions in the entire PDF-X project.

Normally, a PHP application may start an external document-processing program under the same Unix account as the application.

Without additional isolation, that child process may inherit much more access than it actually needs:

• Application files
• Environment variables
• Other temporary directories
• Network connectivity
• Other resources visible to that account

But a document processor may only need:

/work/input.pdf
/work/output.pdf

Why should it see anything else?

That simple question eventually led us to investigate process isolation on Linux.

From PDF Processing to Sandbox Engineering

We studied how we could create a smaller execution boundary around external document-processing programs.

That led us to Bubblewrap, a Linux sandboxing technology based on namespaces and filesystem isolation.

The design gradually became very clear.

• Each processing job should have its own workspace.
• The external processor should see only the files required for that job.
• It should not inherit the application's full environment.
• Network access should be unavailable unless explicitly required.
• Commands should be invoked as structured argument arrays rather than assembled into shell strings.
• Processing should have time limits and resource controls.

And perhaps most importantly:

If the sandbox cannot be created, the system should fail rather than silently run without it.

That last principle became especially important.

A security feature that disappears without telling you can be more dangerous than having no security feature at all, because it creates false confidence.

So the approach became fail closed. If the containment environment is unavailable, processing stops.

Security Research Also Taught Us to Be More Precise

One of the most valuable lessons from this project was learning what not to claim.

It would be easy to say: "Our PDF processing is secure."

But security does not work as a simple yes-or-no state.

• The sandbox isolates the spawned processing process.
• It does not automatically sandbox the entire PHP application.
• It does not sandbox the queue worker that started it.
• It does not replace operating-system security.
• It does not remove vulnerabilities from Bubblewrap or the Linux kernel.
• It does not make output files trustworthy simply because they were produced inside a sandbox.

Some resource controls also require capabilities outside the library itself.

The deeper we went into security engineering, the more careful our language became.

Instead of saying "This makes document processing safe", the more accurate statement is:

This reduces the attack surface and limits what a compromised child process can reach.

That distinction matters.

And I believe responsible technology companies need to become much more comfortable communicating limitations.

Trust should not come from claiming perfection. Trust should come from explaining the boundaries honestly.

The Internal R&D Became an Open-Source Project

At this stage, something unexpected happened.

The sandboxing work was originally just one part of PDF-X. But we realised that the problem was not actually specific to PDF-X.

Many PHP systems execute external programs against untrusted input: OCR engines, image converters, Office-document processors, media tools, archive utilities, analysis binaries.

They all face a similar architectural question:

What is the minimum this external process needs to access?

So we extracted that work into a separate open-source project: PDF-X Secure Runner.

The package became independent from the private PDF-X application. It is framework-independent PHP. It can be used with Laravel, but Laravel is not required. It does not bundle the PDF-processing engine itself.

Its purpose is narrower: provide a controlled execution boundary around an external process.

That work was released publicly through Composer, Packagist, GitHub documentation and automated Linux containment testing.

And that created another dimension to the project. PDF-X was no longer only producing a user-facing tool. It was producing reusable infrastructure.

Open Source Changed the Nature of the Research

Once something becomes open source, the engineering mindset changes.

Internal code only has to satisfy the team maintaining it. Public infrastructure has to explain itself.

• What does it protect?
• What does it not protect?
• What assumptions does it make?
• What operating systems does it require?
• What happens when dependencies are unavailable?
• How can another developer verify that the containment model is actually functioning?

This led us to build documentation around architecture, security boundaries and integration. It also led to containment tests and a self-check mechanism rather than relying entirely on assumptions.

This is an important part of R&D that is sometimes overlooked.

Research is not complete when something works on the developer's machine. It becomes much more valuable when the assumptions behind the result can be tested and understood by other people.

That is one reason I am increasingly interested in open-source work.

Public review creates pressure for clarity. And clarity improves engineering.

We Also Had to Study the Reality of Infrastructure

Another lesson came from deployment.

Engineering cannot happen in isolation from business reality. It is easy to design the perfect architecture if budget, infrastructure and operating constraints do not exist. In the real world, they always exist.

We studied how much isolation could realistically be achieved on our existing Linux hosting environment.

We looked at process ownership, file permissions, shared server behaviour, queue workers, temporary storage, cleanup, memory, disk availability, request admission, rate limits and operational monitoring.

Some things could be improved through application design. Some things could be isolated through Bubblewrap. Some things ultimately depend on the host architecture itself.

And there is an important lesson here:

Application security has boundaries that application code alone cannot cross.

If strict host-level isolation is required, infrastructure may eventually need to change. Recognising that limitation is part of engineering maturity.

The answer is not always another function or another package. Sometimes the answer is architectural.

Reliability Became Part of Security

Our research also reinforced something I believe strongly: security and reliability are connected.

If a processing system runs out of memory, fills disk space or accumulates thousands of abandoned jobs, that is not only a performance problem. It can become a security and availability problem.

So we introduced controls around processing jobs:

• Temporary job directories and automatic cleanup
• Queue-based processing
• Signed status and download access
• Rate limiting
• Disk and memory admission checks
• Process timeouts
• Maximum file sizes and workspace controls

The goal was to prevent a simple document-processing feature from becoming an uncontrolled resource consumer.

Once again, something that looks like a small utility on the frontend becomes a systems-engineering problem behind the scenes.

The Market Research Changed Our Definition of Innovation

When people hear the word "innovation", they often expect something dramatic. AI. Robotics. Blockchain. A completely new technology.

But working on PDF-X has reminded me that innovation can also come from reframing an existing problem.

PDF compression is not new. Splitting a PDF is not new. Sandboxing is not new. Linux namespaces are not new. PHP is certainly not new.

But innovation can happen in the way those pieces are combined.

• Can an ordinary office worker use a technically sophisticated document-processing pipeline without having to understand any of it?
• Can a free online utility be designed around user outcomes instead of technical settings?
• Can the security work developed for one product become reusable infrastructure for other developers?
• Can a document-processing platform become a laboratory for exploring secure execution, optimisation and intelligent automation?

Those questions are far more interesting to me than simply asking: "Can we build another PDF website?"

PDF-X Is Beginning to Show Us a Larger Opportunity

This is where I think the long-term R&D journey becomes interesting.

A document is one of the most common interfaces between people and organisations. Invoices. Reports. Applications. Contracts. Statements. Certificates. Forms. Purchase orders. School documents. Government submissions. Corporate paperwork.

For decades, we have focused mainly on creating, storing and displaying these documents.

The next stage may be different. Software will increasingly need to understand the user's intention around a document.

Not "Choose compression level 1, 2 or 3." But: "Make this acceptable for my application portal."

Not "Select pages 17-22." But eventually: "Give me only the pages containing the invoice and payment details."

Not "Merge file A, B and C." But: "Prepare these documents in the correct order for submission."

This is where document utilities may eventually meet intelligent systems.

But there is an important condition. AI should not be added merely because AI is fashionable. It should appear only when it reduces the amount of thinking required from the user.

The intelligence should remain underneath. The simplicity should remain on top.

Privacy Will Become More Important, Not Less

There is another future direction we are watching carefully.

As software becomes more intelligent, more user data is likely to be processed. Documents may contain some of the most sensitive information people handle: financial information, personal identification, contracts, business records, internal correspondence.

So future document intelligence cannot be developed independently from privacy engineering.

This may lead to different architectural models. Some processing may remain server-based. Some may eventually move closer to the browser or user device. Some organisations may require private deployments. Some workflows may need isolated workers. The right architecture will depend on the sensitivity of the task.

For us, this means privacy is not simply a legal page at the bottom of the website. It is an R&D topic.

We Are Also Beginning to See PDF-X as an Engineering Platform

The public sees four tools. From an engineering perspective, we now see several deeper research layers underneath them: document optimisation, untrusted-file handling, secure execution, temporary storage, resource governance, asynchronous processing, user intention, privacy, developer infrastructure, and potentially later, intelligent document understanding.

This is why I say PDF-X is only beginning.

The product may remain visually simple. But the technology behind it can continue evolving for years.

Some of that technology will remain part of PDF-X. Some may become standalone open-source components. Some may become services. Some experiments may fail completely.

That is normal R&D. The objective is not to pretend that we already know the final destination. The objective is to continue asking useful questions.

Build, Observe, Learn, Then Build Again

One of the mistakes technology companies can make is to treat launch day as the finish line. For us, launch is closer to the beginning of the experiment.

Now we can observe real behaviour.

• Which file sizes are common?
• Which operations are used most?
• Where do users abandon the process?
• Which PDF types create problems?
• What do people ask for that we did not anticipate?
• What security assumptions change when usage increases?
• What becomes expensive at scale?
• What should remain free?
• Which infrastructure needs to be separated?
• What should never be automated?

Those answers cannot come entirely from planning documents. They require real systems and real usage.

This is why I like building. You discover things by moving.

What I Hope PDF-X Becomes

I do not want to define PDF-X too narrowly today. At the moment, it is a simple online PDF utility. That is what users should see.

Behind it, however, we are building knowledge: how people interact with documents, secure document processing, file optimisation, resource management, infrastructure boundaries, and how much complexity can be hidden from the user without hiding important truth.

Over time, that knowledge may become more valuable than any individual button on the website.

That is often how meaningful technology develops. The first product solves a problem. The process of solving that problem reveals a deeper problem. Solving the deeper problem produces reusable technology. That technology creates the next opportunity. And the cycle continues.

This Is Why I Call It R&D

Research and development is not only something that happens inside a laboratory. For a software company, it can happen while solving very ordinary problems.

You research the market. You observe the user. You study existing technology. You test assumptions. You discover limitations. You redesign. You fail. You isolate the failure. You improve the architecture. You document what you have learned.

Then sometimes you discover that a small component of one product can become something useful on its own.

That is exactly what happened with PDF-X Secure Runner. And I suspect it will not be the last thing to come out of PDF-X.

The Beginning, Not the Conclusion

When we started, we were trying to build a useful PDF website. Today, I see something larger. Not necessarily a larger website. A larger field of exploration.

• How can document processing become simpler for humans while becoming more disciplined underneath?
• How can intelligent automation understand outcomes rather than force users to understand settings?
• How can untrusted document processing be isolated more effectively?
• How can privacy and security remain part of product architecture rather than being added after the product is built?
• And what other reusable technologies will we discover while trying to solve these ordinary problems properly?

I do not know all the answers yet. That is exactly why this is interesting.

PDF-X is live as a product. PDF-X Secure Runner is now open source. But from an R&D perspective, both are still at the beginning.

We built something. Then we looked underneath it. And underneath that simple PDF tool, we found a much larger area worth exploring.

That is where I believe the next chapter starts.

• PDF-X: pdf-x.co
• PDF-X Secure Runner: open-source infrastructure developed from the engineering work behind PDF-X.

And from here, we continue to build, study, test and discover.

Because sometimes innovation does not begin with trying to invent the future. Sometimes it begins by taking one ordinary problem seriously enough to ask:

"Can this be done better?"

Ts. Lukas J. Tan
Founder & CEO, OPERION Ecommerce & Software Sdn Bhd
R&D | Secure Document Processing | AI & Business Systems

By Ts. Lukas J. Tan | 16 September 2026

Why I Am Paying More Attention to Practical AI Governance

Whenever I learn a new technology, I rarely stop at understanding what it is or watching other people demonstrate what it can do. I have always preferred to use technology myself, push it into real work, test its limits, connect it with other tools, and see how far it can actually go. Sometimes this approach creates efficiency. Sometimes it exposes weaknesses. But more importantly, when you use something deeply enough, you begin to notice things that are difficult to see from the outside.

Artificial intelligence has been no different for me. Over the past few years, AI has gradually become part of how I think, write, research, analyse information, develop software, communicate and operate a business. I have watched tasks that once required hours become tasks that can be completed in minutes. Research can be accelerated. Documents can be analysed almost immediately. Software can be developed faster. Ideas can be explored from multiple directions without assembling a large team. An individual equipped with the right AI tools can now perform work that would once have required several different skills or people.

I am excited by that development. I want AI to become more capable, not less. I want businesses to discover how much more productive they can become when AI is used properly.

Yet the deeper I use AI, the more I find myself thinking about something other than productivity.

Everyone talks about how fast AI is becoming. What concerns me is not simply that AI is fast. What concerns me is the possibility that AI is becoming faster than our ability to control what we are doing with it.

This difference matters.

For decades, computing technology has continued to accelerate. Moore’s Law became one of the best-known descriptions of how rapidly computing capability developed over time. Every generation of technology has given us greater processing power, greater connectivity and faster access to information. AI is adding something different to that acceleration because computers are no longer only storing and processing information. Increasingly capable AI systems are now participating directly in knowledge work: interpreting information, generating content, writing software, analysing documents and supporting decisions.

Consider something as ordinary as preparing a business proposal. In the traditional workflow, someone gathers information, thinks about the problem, prepares a draft, reviews it, makes corrections, discusses it with colleagues and eventually sends it to the customer. That process may take several hours or even several days. Today, an employee can provide AI with some information and receive a professionally written proposal within minutes.

That sounds entirely positive until we look at what happened to the control process.

The speed of generation increased dramatically, but did the speed and quality of human review increase at the same rate? The employee can generate faster, copy faster, analyse faster, upload faster and send faster. But management still has to review, approve, protect, verify and take responsibility.

This is what I increasingly see as the governance gap.

The issue is not that AI is doing something wrong simply because it is fast. The issue is that our organisational controls may still have been designed for a much slower world.

There are much larger debates about what happens if increasingly autonomous AI systems eventually exceed meaningful human control. Some people talk about AI controlling humanity or even posing an existential threat. I do not think anyone can state with certainty today how those scenarios will develop. They deserve serious research and discussion, but we do not have to travel that far into the future to understand why governance matters.

There is a much simpler question that every business can ask today:

Can your company control the AI that is already being used inside your company?

That question is no longer theoretical.

The Employee Leaves. What Happens to the AI?

One of the simplest examples is something that almost every business owner understands: employee turnover.

Imagine an employee who uses AI every day for company work. Perhaps the employee works in marketing, sales, administration, software development or management. The company pays the employee’s salary. The employee works with company customers and company information. Over time, AI becomes deeply integrated into that person’s workflow.

The employee may use AI to analyse customers, develop proposals, write reports, create marketing campaigns, solve technical problems, develop software, summarise meetings, research competitors and structure ideas. After one or two years, the AI environment may contain hundreds or thousands of conversations. Inside those conversations may be prompts, templates, customer context, project knowledge, instructions, research, workflows and many small pieces of organisational knowledge accumulated through daily work.

Then the employee resigns.

Most established companies already know what to do next. The laptop is returned. The company email account is disabled. CRM access is removed. Cloud storage permissions are revoked. Internal systems are locked. The employee exit checklist is completed.

But what happens if all that AI work was performed using the employee’s personal AI account?

Who owns the account? Who controls the conversation history? Where are the prompts? Where are the custom instructions and workflows? Can the company retain the knowledge that was created during employment? Can another employee continue the work?

Suddenly, what initially looked like an AI productivity issue becomes an ownership and business continuity issue.

The employee leaves, and potentially part of the company’s working knowledge leaves as well.

This is why I have increasingly returned to one very simple principle:

Keep Personal Personal. Keep Company Company.

This is not an entirely new management idea. Businesses went through similar transitions with email. We learned why company communication should not depend entirely on an employee’s personal Gmail account. We developed company servers, company databases, company cloud storage, company accounting systems and company-managed access because organisations eventually understood that business information needed ownership and continuity.

AI requires us to revisit the same principle in a new environment.

If an AI account is being used substantially for company work, management should at least know whose account it is, who controls it, what happens to access when the employee leaves, and how important organisational knowledge will be retained.

The Question Is Not Only Whose Account. It Is What Goes Inside.

Account ownership is only the beginning.

The more useful AI becomes, the more context we tend to give it. If we want AI to prepare a better proposal, we provide information about the customer. If we want AI to analyse a contract, we upload the contract. If we want it to understand a technical problem, we may provide source code. If we want it to analyse a business situation, we may give it meeting notes, financial information or internal strategy.

This creates an uncomfortable relationship between usefulness and governance.

The more context we give AI, the more useful it can become. But the more information we give AI, the clearer our information boundaries need to become.

What are employees currently putting into AI systems?

Customer information? Contracts? Internal meeting minutes? Financial information? Employee information? Source code? Business plans? Confidential documents? Strategic discussions?

The correct answer is not simply to declare that every AI platform is unsafe, nor is it reasonable to assume that every AI service handles information in exactly the same way. Different tools, subscriptions, enterprise environments and configurations can provide different levels of data control.

For management, however, there is an even more basic question.

Has the company itself decided what employees are allowed to put into AI?

If one employee thinks a customer contract is acceptable, another thinks it is prohibited, and a third has never considered the question, then the problem is not necessarily the AI platform. The organisation itself has not established the boundary.

If employees have to guess the boundary, management has not defined one.

That is a governance issue.

AI Wrote It. But Who Approved It?

There is another side to AI Governance that has less to do with what goes into AI and more to do with what comes out.

Imagine an AI system preparing a sales proposal. The proposal is beautifully written. It sounds professional, confident and complete. Somewhere in the document, however, the AI states that the project can be delivered within 30 days. The company’s actual operational capability requires 60 days.

The salesperson reads the document quickly, trusts the quality of the writing and sends it to the customer.

The customer accepts the proposal.

Now there is a problem.

Who is responsible?

The company cannot realistically resolve the customer dispute simply by saying, “The AI wrote it.”

AI can draft. AI can suggest. AI can analyse. AI can recommend. But the organisation still needs to establish who reviews important outputs, who approves them and who remains accountable for the decisions and commitments that follow.

This does not mean every AI-generated sentence needs to pass through three levels of management. That would defeat much of the productivity AI creates. Governance should be proportional to impact.

A brainstorming idea for an internal discussion may require only a light review. A customer proposal, financial analysis, contractual statement, engineering recommendation or other high-impact output deserves much stronger human verification.

The principle is straightforward:

The greater the potential consequence, the stronger the human review should be.

That is how governance supports speed rather than destroys it.

AI Amplifies What You Already Have

The more I think about these issues, the more they return me to another principle that has shaped my view of AI:

AI amplifies what you already have.

If an organisation already has clear processes, disciplined information management, responsible employees and clear ownership, AI can amplify those strengths. Good people become more productive. Good processes become faster. Knowledge becomes easier to use. Small teams can accomplish significantly more.

But amplification works in both directions.

If access is messy, AI can make messy access operate faster. If information management is poor, employees can move information outside the organisation faster. If accountability is unclear, decisions can be produced and acted upon faster without anyone knowing exactly who owns the consequence. If the underlying process is broken, automating it does not necessarily repair it. Sometimes it simply allows the broken process to operate at greater speed.

This is why I do not see AI Governance as an attempt to stop AI adoption.

Quite the opposite.

I want businesses to use AI aggressively where it creates value. But if we want to accelerate, we also need to improve the steering, the brakes and the rules of the road.

Practical AI Governance, particularly for SMEs, does not have to begin with a hundred-page document. It can begin with a few very practical areas: Account and Access, Data and Privacy, People and AI Usage, Output and Accountability, and Governance and Continuity.

From there, management can begin asking straightforward questions.

Which AI tools are actually being used inside our company? Are employees using company-managed accounts or personal accounts? What information are they putting into those systems? Do employees understand what should not be uploaded? Which AI-generated outputs require human review? Who remains accountable for the final result? Who oversees AI usage? And when an employee leaves, what happens to the company’s AI-related knowledge?

These are not futuristic questions.

They are operational questions that companies can ask today.

Before Governing the Future, Understand the Present

My growing interest in AI Governance does not come from wanting to become pessimistic about AI. It comes from the opposite direction. I have used AI deeply enough to appreciate just how powerful it is becoming.

I still want AI to become faster. I still want businesses to use more of it. I still believe that AI can dramatically amplify what individuals, SMEs and larger organisations are capable of accomplishing.

But the faster technology becomes, the more important it is that our ability to govern its use develops alongside it.

We cannot continuously upgrade the engine while ignoring the steering wheel and the brakes.

For that reason, I think the question business owners should ask is changing.

A few years ago, the question might have been:

“Should our company use AI?”

Then it became:

“How can our company use AI?”

Today, I think there is another question that deserves equal attention:

“Do we actually know how AI is being used inside our company, and are we still in control of it?”

Before we worry about governing some distant future in which AI becomes extraordinarily powerful, perhaps we should first understand what is happening inside our organisations right now.

That is where practical AI Governance begins.

Not with fear.

Not with banning technology.

Not necessarily with complicated regulation.

It begins with visibility.

Know which tools are being used. Know whose accounts they are. Know what information is going inside. Know what important outputs require review. Know who is responsible. Know what happens when people leave.

Once management can answer those questions, governance becomes something practical rather than abstract.

And if management cannot answer them yet, that does not mean the company has failed.

It simply means it is time to start looking.

A Practical Starting Point

At OPERION, we have developed a Practical AI Governance Readiness Assessment to help businesses begin that process. The assessment looks at five practical areas: Account & Access, Data & Privacy, People & AI Usage, Output & Accountability, and Governance & Continuity.

It is not a certification. It is not an audit, and it is not a legal opinion or declaration of regulatory compliance. Its purpose is much simpler: to help management see what is happening today, identify areas that may deserve attention and decide what should be examined next.

Businesses that want to understand their situation more deeply can also invite OPERION to conduct a complimentary preliminary AI Governance assessment with their management team. The objective is not to arrive with a predetermined solution. It is to understand the existing environment first.

I believe strongly in one sequence:

Assessment first. Prescription second.

AI will continue to develop. It will become more capable, more integrated into everyday work and, very likely, much faster.

We should embrace the opportunity.

But as we accelerate, we should make sure our governance can accelerate with it.

Because AI amplifies what you already have.

The question is whether we understand what we are allowing it to amplify.

Ts. Lukas J. Tan
Founder & CEO, OPERION Ecommerce & Software Sdn Bhd
Practical AI Governance | Digitalisation | AI & Business Systems

By Ts. Lukas J. Tan
Written on 6 September 2026 | Penang, Malaysia

Technology has always changed the value of human labour. Machines reduced the need for physical labour, software reduced the need for certain administrative work, and artificial intelligence is now beginning to reduce the amount of human effort required for many forms of knowledge work. I do not believe this means that human beings will become unnecessary. But I do believe that many things we once considered difficult, specialised or expensive will become easier to accomplish with fewer people. When that happens, we should not only ask what AI will do to jobs. We should also ask what it will do to the institutions that were built to prepare people for those jobs.

This brings me to universities.

The Degree Became the Product

For a long time, the role of a university was relatively clear. Universities educated people, developed specialised knowledge and issued recognised qualifications. Students went to university because knowledge was concentrated there, employers valued degrees, and a certificate provided evidence that a person had completed a certain level of education. For many families, particularly in countries such as Malaysia, the degree also represented something larger. It was associated with social mobility, professional status and the hope of a more secure future.

Over time, however, something gradually changed. Education remained important, but the certificate itself became increasingly important. Students did not necessarily enter university only because they wanted knowledge. They needed the qualification because the labour market asked for it. Employers used degrees as filters, parents regarded them as a form of security, and young people naturally followed the pathway society had created for them. A degree became both an educational experience and a ticket into parts of the employment market.

There is nothing inherently wrong with this system. Universities have contributed enormously to human development, and I would never argue that education is unnecessary. But the assumptions supporting this model deserve to be reconsidered because the environment around universities is changing very quickly.

When Industry Becomes the University

One change I have been observing in Malaysia is the growing involvement of industry in education. More companies and industrial groups are establishing their own academies, training centres and education programmes. Some have gone further into colleges and university-level education. I cannot speak for the motivation of every organisation, and there are certainly different reasons behind each institution. But from an industry perspective, one reason is easy to understand. Companies need talent that can actually function in their environment. When graduates do not arrive with the exact capabilities an industry requires, companies naturally begin to train people themselves.

In some ways, this is a sensible development. A manufacturer understands its machinery, processes and workforce requirements better than an outsider. A technology company understands the systems and tools its people need. An industry can therefore design training around actual problems instead of waiting for a general curriculum to catch up.

But when more industries begin becoming education providers themselves, another question appears. How many universities, colleges and academies does a country ultimately need?

Malaysia's Numbers Tell Two Stories at Once

Malaysia already has a substantial higher-education ecosystem. According to the Malaysia Higher Education Blueprint 2026–2035, using 2024 higher-education statistics, Malaysia had 544 higher-education institutions and approximately 1.35 million enrolled students. The private higher-education landscape alone included 64 universities, 36 university colleges, 271 colleges and 11 foreign university branch campuses.

At the same time, Malaysia is moving through an important demographic transition. According to the Department of Statistics Malaysia (DOSM), Malaysia’s total fertility rate stood at 1.6 children per woman in 2024, below the replacement level.

I believe those two developments deserve to be considered together.

If the supply of education continues expanding while future generations become smaller, competition for students will inevitably intensify. AI could add another layer of pressure by changing how young people think about learning itself.

The Competition for Students Is Already Visible

We can already see signs that higher education has become a much more competitive market. Twenty years ago, I do not remember universities competing for attention in quite the same way they do today. Now university advertisements are everywhere. We see them along roads, on social media, through digital advertising, at education fairs and through increasingly sophisticated student recruitment campaigns.

There is nothing wrong with a university advertising. Every institution needs to communicate with its market. But the intensity of recruitment tells us something important. Universities are increasingly competing for student numbers.

That competition may become much more difficult in the coming years, because AI is changing one of the fundamental reasons people historically needed educational institutions: access to knowledge.

What AI Changed for Me

This is where my view is influenced strongly by my own recent experience.

I have managed a technology company for more than a decade. Yet I have never considered myself the strongest technical person in my company. I understand business logic, system architecture, processes, how different components connect and what a system ultimately needs to achieve. But there have always been technical areas where my programmers knew considerably more than I did. That was normal. They spent years developing those skills, while my role required me to focus on a different level of the business.

Then AI changed something for me.

After spending an intensive period working deeply with AI, I found myself understanding areas that had remained outside my practical capability for years. In roughly a month, I was able to explore programming concepts, infrastructure, deployment, automation and technical workflows at a speed I had never experienced before. By September 2026, I found myself able to oversee multiple client projects while using several computers and AI systems to assist different parts of the work.

The Distance Between Not Knowing and Knowing Enough

I want to be careful about what this experience means. One month with AI did not magically give me the depth of an engineer who has spent ten or twenty years mastering a discipline. Experience still matters. Deep technical judgement still matters. Security, architecture, reliability and understanding what happens when things go wrong still require expertise.

But something significant did change.

The distance between “I don’t know how to do this” and “I can understand this well enough to make it work” became dramatically shorter.

That is the part that should interest universities.

For centuries, knowledge was scarce. If you wanted to understand an advanced subject, you needed to find the right books, the right teacher, the right institution or the right expert. Today, a person can begin with almost no knowledge of a subject and have an AI system explain it, simplify it, challenge them, answer questions, generate examples and help them apply what they have learned immediately.

The AI can be wrong, of course. That is precisely why judgement and critical thinking become even more important. But the cost and speed of acquiring practical knowledge have nevertheless changed.

Four Years, Measured in Time, Not Just Money

This leads to a question that I believe students and parents will increasingly ask: if I spend three or four years obtaining a degree, what exactly am I receiving in exchange for those years?

We normally calculate the cost of university in money. Perhaps we should also calculate it in time.

Four years is a significant portion of a young person’s life. Imagine an 18-year-old who enters university and graduates at 22. Now imagine another 18-year-old who spends the same four years intensely studying one field using AI, working with industry, building products, doing research, creating a company, failing, learning from those failures and producing real evidence of what he or she can do.

At 22, who is ahead?

The answer is not automatically the second person. A strong university student may have developed deeper theoretical understanding, powerful friendships, professional networks, exposure to research and intellectual discipline. Certain professions also cannot responsibly be reduced to self-learning. I would certainly not want doctors, civil engineers or other safety-critical professionals qualifying themselves simply because an AI told them they understood the subject.

But for many other areas, the comparison is becoming legitimate.

If one person can show a certificate while another can show four years of actual work, products, research, clients, experiments and results, employers will increasingly have more than one way to judge capability.

The degree is no longer the only signal.

What University Still Gives You

This is why I do not believe the correct conclusion is that university will become useless. My own experience tells me otherwise. University provides things that are difficult to measure on a transcript. It gives people an environment in which to grow. It creates friendships and networks. It exposes young adults to people from different backgrounds. It provides structure, discipline, mentors and intellectual challenges.

Most importantly, good education develops the ability to think.

I can often see the difference between someone who has learned how to analyse a problem and someone who simply knows how to repeat information. The ability to structure an argument, question assumptions, evaluate evidence and make a judgement remains extremely valuable.

People Who Know How to Learn vs. People Waiting to Be Taught

But here again AI creates an interesting challenge.

A person who knows how to use AI properly can also develop these capabilities outside a traditional classroom. AI can challenge an argument. It can present opposing positions. It can become a tutor. It can explain a subject at different levels. It can help someone experiment and immediately turn an idea into something tangible.

The important distinction in the future may therefore not be between people who went to university and people who did not. It may be between people who know how to learn and people who are waiting to be taught.

The Risk of a Higher-Education Bubble

This is why I believe there is a risk of a higher-education bubble.

By “bubble,” I do not mean that universities will suddenly collapse or that degrees will have no value. I mean that we may be creating more educational capacity based on assumptions about student demand and the value of traditional qualifications that could change faster than institutions expect.

Several forces are moving at the same time. Birth rates are declining. Industries are developing their own talent pipelines. Online education continues improving. Alternative credentials are becoming more accepted. People can work and earn money across borders without physically moving. AI is dramatically reducing the friction involved in self-learning and creation. Meanwhile, more institutions are competing for the same young people.

If these trends continue, something eventually has to adjust.

Why Government Still Has a Role

This is also why government has a role to play. Higher education cannot be treated purely as an ordinary commercial market where unlimited supply is always assumed to create healthy competition. When an educational institution fails, the consequences affect more than shareholders. Students may lose years. Parents may lose savings. Staff lose careers. Qualifications can become uncertain. Communities can be affected.

The question for government should therefore not simply be how many universities a country has. The more important questions are what outcomes those universities produce, whether graduates genuinely develop useful capabilities, whether programmes respond to changing economic realities, and whether institutions are financially and academically sustainable.

Access to Knowledge Is Not Access to Opportunity

At the same time, we need to be socially conscious about the alternatives we promote.

It is easy for someone with a laptop, reliable internet access, business experience and confidence to say that everyone can simply learn with AI. Reality is more complicated. Not every young person has the same environment. Some need the structure of university. Some need access to laboratories and equipment. Some need teachers because they have never learned how to teach themselves. Some need university networks because their families have no professional networks of their own.

For these students, university can still be an extraordinary engine of social mobility.

AI may make knowledge more accessible, but access to knowledge is not the same as access to opportunity.

How Universities Could Evolve

That is why the solution cannot simply be to close universities or tell young people not to study. The more constructive question is how universities should evolve.

Perhaps universities should stop seeing themselves primarily as places that deliver information and qualifications. Information is becoming abundant. Instead, universities could become environments that transform information into judgement, experience, relationships and capability.

Students could spend less time reproducing answers in examinations and more time solving real problems. Industry projects could become part of education rather than something students encounter only after graduation. AI could provide personalised tutoring while professors spend more time challenging assumptions, mentoring students and developing deeper thinking. Students could graduate not only with transcripts, but with portfolios demonstrating what they have actually built, researched, solved and contributed.

The university might also become less of a one-time four-year destination and more of a lifelong platform. People could move between employment and education repeatedly, learning what they need when they need it instead of attempting to predict at 18 everything they will need for the next 40 years.

Industry academies could also have an important role, but they should complement rather than simply duplicate universities. Industry understands immediate workforce needs; universities should retain the ability to think beyond the immediate needs of a particular employer. Society needs both.

This balance is important because education has a responsibility beyond employability. Universities also develop researchers, preserve knowledge, challenge society, study problems that have no immediate commercial return and provide spaces where ideas can be explored independently. If education becomes only training for today’s jobs, we may prepare people perfectly for industries that disappear tomorrow.

The Real Question for 2026

The deeper issue, therefore, is not whether AI will kill universities.

I do not think it will.

What AI may destroy is the assumption that universities have a monopoly over advanced learning.

That monopoly is already weakening.

Knowledge can come from almost anywhere. Skills can increasingly be demonstrated directly. Companies can train their own people. A teenager with the right tools can create something that once required an entire technical team. An experienced businessperson can use AI to enter technical areas that previously seemed inaccessible. A person with curiosity, discipline and judgement has access to learning capabilities that previous generations could hardly imagine.

Universities still have enormous value, but increasingly that value must be demonstrated rather than assumed.

Perhaps the most important question for a university in 2026 is therefore no longer, “What courses should we offer?”

The more difficult question is:

“What can a young person become after spending four years with us that he or she could not become after spending four years learning, building and creating with AI?”

If universities can answer that question convincingly, they have a powerful future.

If they cannot, the greatest threat may not be another university opening across the road.

It may be an 18-year-old sitting at home with a laptop, an AI system, four years of time and a very clear idea of what he or she wants to build.

And that is why, writing this in September 2026, I believe the discussion about the future of universities should begin now. Not because education is becoming less important, but because learning is becoming more accessible than at any other point in human history.

The institution that once controlled access to knowledge now has to compete in a world where knowledge is everywhere.

Its future will depend on what it can offer beyond knowledge.

I just shipped my first open-source project — a small thing, an animated row-deletion pattern for web apps. Nothing world-changing. But building it with an AI coding agent sitting next to me the whole time made me want to understand something I’d been taking for granted: where did these tools actually come from? What are they trained on? Who built them, and why? This is my attempt to trace that history — partly for my own understanding, partly because I think more builders should know the story of the tools they now depend on every day.

Before the agents: a foundation laid in 2017

Almost every AI coding tool in use today — Copilot, Codex, Claude, Gemini — traces back to one research paper: “Attention Is All You Need,” published by a team at Google Brain in August 2017. It introduced the Transformer architecture, which replaced the older, slower recurrent neural networks with a mechanism called “attention” — letting a model weigh the relationships between every word (or token) in a sequence simultaneously, rather than processing text one piece at a time.

This sounds abstract, but the practical effect was enormous: Transformers could be trained in parallel, at far larger scale, on far more data, than anything before them. Nearly every large language model since — GPT, BERT, Claude, Codex — is built on this same architectural foundation. The paper wasn’t about code at all; it was about machine translation. But the architecture turned out to generalize to almost any sequence of symbols, including programming languages.

The raw material: where does the “code knowledge” come from?

Before any model can write code, it has to learn from code that already exists. And overwhelmingly, that code comes from one place: public repositories on GitHub, supplemented by GitLab and a handful of other sources.

The most direct example is a dataset called The Stack, built by the BigCode Project (a collaboration between Hugging Face and ServiceNow). The Stack v1 contains over 6TB of permissively-licensed source code across 358 programming languages; The Stack v2 scaled that to over 3 billion files across 600+ languages. It exists specifically to train open, transparent code-generation models — and, notably, it lets developers request their code be removed from it, an acknowledgment of the ongoing debate around consent and public code being used this way.

OpenAI’s own Codex paper (2021) was explicit about its sourcing: the model was trained on 159 gigabytes of Python code pulled from 54 million public GitHub repositories, plus substantial amounts of JavaScript, TypeScript, Go, Ruby, C++, C#, Java, PHP, Swift, and more.

This is the uncomfortable-but-important fact at the center of this whole story: the reason today’s AI can write code fluently is that millions of developers, over nearly two decades, wrote code in public and explained it in READMEs, comments, and commit messages — not knowing, in most cases, that it would eventually become training material for machine intelligence. GitHub, with over 630 million repositories today (395 million of them public), is functionally the largest library of “how humans write and explain software” that has ever existed. GitLab contributes to this too, at meaningfully smaller scale, since GitHub remains the dominant home for public open-source work.

From autocomplete to Codex (2021)

The first real bridge between “a language model” and “a tool a developer actually uses” was OpenAI Codex, published as a research paper in July 2021 and released as an API that August. Codex was essentially GPT-3, fine-tuned specifically on code. It became the engine behind GitHub Copilot, which launched in technical preview in June 2021 and to the public in October 2021 — the first mainstream “AI pair programmer,” living directly inside your editor, suggesting completions as you typed.

This was a genuinely new category of tool. Before Codex/Copilot, code intelligence meant autocomplete based on syntax rules and static analysis — useful, but fundamentally mechanical. Copilot could suggest an entire function based on a comment describing what it should do. It felt, to a lot of developers in 2021 and 2022, like a genuine step-change.

By March 2023, the original Codex model itself was quietly retired — superseded by GPT-3.5 and GPT-4, which had absorbed vastly more code training data at greater scale and no longer needed a separately fine-tuned “code model” to be good at code.

A different lineage: why Anthropic exists at all

Claude comes from a different origin story entirely — one rooted less in “let’s build the best product” and more in a disagreement about how fast and how carefully AI should be developed.

Anthropic was founded on January 26, 2021, by siblings Dario Amodei and Daniela Amodei, along with five other researchers — all of whom had left OpenAI a few months earlier. Dario had been OpenAI’s VP of Research; Daniela had been VP of Safety and Policy. The group’s departure and the founding of Anthropic were driven by a belief that AI capability was scaling faster than the industry’s understanding of how to keep it safe and steerable. Anthropic was built, from day one, as an “AI safety company” — its research agenda (interpretability, alignment, constitutional AI) has always been positioned as core to the product, not an afterthought bolted onto a capabilities race.

Claude, Anthropic’s model family, launched publicly not long after, and the company has since scaled Claude into a full family of models (the naming conventions have shifted over time — Claude 3, Claude 4, and now the Claude 5 family, including the very model that helped write and structure this article).

The agentic turn: from suggesting code to doing the work

For a few years, both lineages — Copilot/Codex and Claude — mostly did the same basic thing: suggest code, complete a line, answer a question in a chat window. The human stayed in the driver’s seat for everything else: running commands, navigating files, testing, committing, deploying.

That changed with what’s now called agentic coding. Claude Code, Anthropic’s terminal-based coding agent, is a useful case study in how fast this shift happened. It reportedly started as one engineer’s side project during his first month at Anthropic, in September 2024. It launched as a limited research preview on February 24, 2025. Less than a year later, it had reportedly passed a $1 billion annualized revenue run rate — one of the fastest revenue ramps in software history.

What changed technically wasn’t just a bigger model — it was giving the model tools: the ability to read a whole codebase, run shell commands, execute tests, edit multiple files, and iterate on failures, all in a loop, with much less moment-to-moment human steering. The AI stopped being an autocomplete engine and started being something closer to a junior engineer you could hand a task to.

OpenAI moved the same direction with Codex — not the 2021 model anymore, but a 2025-era agentic coding product carrying the same name, repositioned entirely around autonomous task completion rather than line-by-line suggestion.

The lines blur: competitors become co-dependents

One detail that surprised me researching this: GitHub — Microsoft’s platform, and historically OpenAI’s closest coding-AI partner — now also ships Claude. Starting in October 2024, GitHub Copilot added Claude 3.5 Sonnet as a selectable model alongside OpenAI’s own, explicitly framed as “developer choice.” By February 2026, GitHub had Claude and Codex both available as coding agents inside Copilot, and in November 2025, Microsoft committed to continued Claude access across its entire Copilot family.

In other words: the platform most associated with OpenAI’s Codex now also distributes its safety-focused rival’s models, because customers wanted the choice. The AI coding landscape in 2026 isn’t really “Team OpenAI vs. Team Anthropic” — it’s a layered stack where the same underlying platforms (GitHub, GitLab) host the training data, the code, and increasingly the AI tools themselves, often from multiple competing labs at once.

Why this history matters to me right now

I didn’t write this because I think anyone’s waiting for another “history of AI” article. I wrote it because I just spent a session shipping a small open-source library with an AI agent doing a large share of the actual work — writing the backend, catching a privacy mistake I made, walking me through GitLab and GitHub settings I’d never touched, even helping me submit a pull request to a 35,000-star community project.

That whole experience only exists because of the chain this article traces: a 2017 research paper about language translation, that turned into an architecture general enough to learn code, trained on the accumulated public work of millions of developers who never expected their GitHub commits to become raw material for a machine’s understanding — built by two different companies with two different philosophies about how fast to move, now converging on the same category of tool: an agent that doesn’t just suggest code, but does the work.

I’m not a machine learning researcher. I’m someone who builds things — in software, and now, apparently, in the open-source world too. But understanding the tools I use, not just using them, feels like the right instinct for whatever comes next in this industry. This is a start.

Sources referenced in this piece

• Attention Is All You Need (Wikipedia)
• OpenAI Codex (language model) — Wikipedia
• GitHub Copilot — Wikipedia
• The Stack dataset — Hugging Face / BigCode Project
• Anthropic — Wikipedia
• Dario Amodei — Wikipedia
• What Is Claude Code? Full History, Timeline & How It Works — Taskade
• Bringing developer choice to Copilot with Anthropic’s Claude 3.5 Sonnet — GitHub Blog
• Microsoft, NVIDIA and Anthropic Announce Strategic Partnerships

By Ts. Lukas J. Tan | 6 September 2026

This morning, 6 September 2026, I came across a social-media post about China’s progress in the global brain-computer interface (BCI) race. It immediately reminded me of a conversation that Elon Musk helped bring into the mainstream through Neuralink: the possibility that the boundary between the human brain and computers may one day become increasingly thin. Not very long ago, putting a chip into the human brain belonged largely to science fiction. Today, brain-computer interfaces are being tested on humans, governments are treating the field strategically, and the conversation is gradually shifting from whether such technology is possible to how far it should go.

Social-media headlines should always be treated carefully, particularly when they declare that one country or company has become the “world’s first”. What matters to me is not whether China, the United States, Neuralink or another organisation can claim technological leadership today. The more important signal is that brain-computer interfaces are moving from imagination towards reality, while some of the world’s most powerful governments, researchers and entrepreneurs now regard human-machine integration as a serious technological frontier.

There is also a governance question hidden inside that technological race. When technology begins interacting directly with the human brain, the discussion can no longer be limited to innovation, investment and national competitiveness. Questions of consent, privacy, neural-data ownership, medical safety, cybersecurity, accessibility and human autonomy become equally important. If a computer can one day interpret signals from our brains, who owns that information? Who may store it? Can it be transferred to another company? What protection should exist against discrimination based on neurological data? And if such technologies eventually enhance human capabilities rather than merely restore lost functions, will access be determined by medical need or by the ability to pay?

These questions may sound premature, but governance is most useful when it develops alongside innovation rather than after society has already become dependent upon it. We have seen this pattern before with social media, personal data and artificial intelligence. Technology often develops faster than the rules, institutions and social norms required to manage its consequences.

Yet strangely, after reading about the brain-chip race, my thoughts travelled somewhere completely different.

I started thinking about the funeral industry.

At first, the connection sounds almost absurd. What does a brain chip have to do with funeral homes, crematoriums, burial grounds or memorial services? But this is precisely what interests me when thinking about the future. When a technology emerges, we naturally concentrate on its immediate market. We ask which companies will win, what products will emerge and which jobs might disappear. The consequences that interest me more are often further away: the second-, third- and fourth-order effects that appear only after technology begins changing human behaviour and social structures.

If technology changes how we work, it changes how we use our time. If it changes how we use our time, it can influence relationships, caregiving and family formation. When families change, demographics change. And when demographics change for several generations, almost every institution and industry eventually feels the effect—including industries that appear to have nothing whatsoever to do with technology.

That was the chain of thought that began with a brain chip.

A Demographic Change Is Also a Social Change

Long before brain chips become commonplace, another enormous transformation is already happening around us: the world is producing fewer children.

The United Nations’ World Population Prospects 2024 estimated that global fertility has fallen substantially over recent generations, from approximately 3.3 births per woman in 1990 to around 2.25 today. More than half of the world’s countries and territories are already below the replacement fertility level of approximately 2.1 births per woman. Low fertility is therefore no longer an isolated demographic problem belonging only to Japan, South Korea or a handful of European economies. It is becoming a structural issue across a growing part of the world.

It would be easy to look at these numbers purely as statistics. I think that would miss the human story behind them.

People do not decide whether to have children according to a demographic chart. They make those decisions within the realities of their lives: whether housing is affordable, whether employment feels secure, whether childcare is available, whether they have time to care for ageing parents, whether a career can coexist with parenthood, and whether raising a family feels economically and emotionally sustainable.

For women especially, the question can involve difficult trade-offs between professional opportunities, caregiving expectations and motherhood. For younger generations generally, delaying marriage or parenthood may not simply represent changing values; it may also reflect the economic environment they have inherited.

Therefore, falling fertility should not automatically be framed as young people “refusing” to have children. It should also prompt governments, employers and communities to ask whether the societies we are building make family life realistically sustainable.

China is particularly important because of its scale, but the issue extends much further. Demographic change moves slowly through society, almost like a wave travelling from one institution to another. Fewer births eventually mean fewer pupils entering schools. Later, universities compete for a smaller student population. Eventually, fewer young people enter the labour market. Housing demand changes, consumption patterns change, healthcare requirements change and a smaller working population may have to support a larger retired population.

A child who is not born today does not change the labour market tomorrow morning. But that missing person will never enter the workforce twenty years from now.

The same delayed effect eventually reaches the funeral industry.

We tend to regard funeral services as one of the few businesses with permanent demand because death itself cannot disappear. Every person alive today will eventually die. From a demographic perspective, however, there is an important distinction between the certainty of death for an individual and the number of deaths occurring within an entire society.

In the near and medium term, ageing populations could actually create greater demand for funeral and memorial services. Therefore, I would not argue that declining fertility means funeral businesses are about to decline tomorrow. The demographic lag could take decades.

My question concerns what happens afterwards.

Imagine a country remaining significantly below replacement fertility for thirty, forty or fifty years. Each generation becomes smaller than the one before it. Eventually, the large older generations pass away. Behind them are smaller middle-aged generations, followed by even smaller younger generations. Unless migration or a meaningful recovery in fertility compensates for that decline, the total population eventually contracts.

At that point, even the business of death encounters demographic mathematics.

Fewer births today can eventually mean fewer deaths decades later.

But this should not be viewed merely as a prediction about market size. A shrinking and ageing society creates much broader responsibilities. There may be fewer working-age adults caring for more elderly people. More people may grow old without children. More people may live alone. Governments may face greater pressure on healthcare, pensions and long-term care, while communities confront questions about loneliness, social isolation and who takes responsibility when family support is no longer available.

The future of the funeral industry is therefore only one small part of a much larger social transformation.

AI May Save Time Without Giving Us More Life

This is where artificial intelligence enters my thinking.

One of AI’s strongest promises is productivity. Work that previously required hours can increasingly be completed in minutes. Research can be accelerated, documents drafted, information analysed, software developed faster and repetitive administrative work automated. As AI agents become more capable, one person may eventually perform an amount of work that previously required several people.

Logically, greater productivity should mean that human beings become less busy.

I am not convinced that this will necessarily happen.

History suggests that when technology increases human capacity, society frequently responds by increasing its expectations. Email made communication faster, yet it did not necessarily reduce the amount of communication expected from us. Smartphones enabled us to work from almost anywhere, but they also made us reachable almost everywhere. Cloud technology made information accessible twenty-four hours a day, while simultaneously allowing work to follow us beyond the office.

AI could take this pattern much further. If someone becomes twice as productive with AI, the economic outcome may not be that the person works half the day and spends the remaining hours with family. The organisation may simply redefine what one employee is expected to accomplish. What once required five people might be assigned to two. What once took a week may be expected tomorrow.

This is not merely a productivity question. It is a governance and leadership question.

If AI creates enormous productivity gains, we will eventually need to ask who receives the benefit. Does it appear only as higher output and lower labour costs, or can some of that productivity be returned to human beings in the form of better work, greater flexibility, more family time, lifelong learning and improved quality of life?

Technology itself cannot answer that question. Leaders, organisations and public policy will.

This matters because decisions about having children are influenced by far more than biology. Housing, financial security, working hours, childcare, education, relationships, career expectations and the distribution of caregiving responsibilities all contribute to the environment in which people decide whether parenthood is possible.

It would therefore be too simplistic to say that AI will reduce fertility. But it is reasonable to ask whether an AI-enabled economy could unintentionally intensify conditions already making family formation difficult.

This creates what I see as one of the great paradoxes of the coming AI era: we may invent machines specifically to save human time, yet create an economic system that immediately consumes every minute those machines save.

The real measure of AI progress should therefore not be productivity alone. A society that produces more but leaves people with less time for family, community, health and human relationships may be technologically efficient without necessarily becoming more human.

When Technology Moves From Our Hands Into Our Bodies

The brain-chip conversation, made globally visible in large part by Elon Musk and Neuralink, introduces an even more fundamental governance challenge. Until recently, most digital technology existed outside us. Computers sat on desks, smartphones moved into our pockets and smartwatches onto our wrists. Brain-computer interfaces represent a much more intimate frontier: technology interacting directly with the human nervous system.

This naturally raises questions about long-term health and biological exposure, but here we should be careful about separating evidence from speculation. Current scientific evidence does not justify stating as fact that AI devices, ordinary wireless technologies or brain-computer interfaces cause declining human fertility. Researchers have investigated radiofrequency electromagnetic fields and reproductive indicators, including sperm motility and oxidative stress, but findings remain mixed and do not establish a simple causal relationship.

For me, however, the absence of a proven answer does not make the question irrelevant. It tells us where further research and governance will be needed.

The technological environment surrounding a human being in 2050 or 2070 could be fundamentally different from today. We may live continuously alongside intelligent environments, autonomous systems, wearable AI, augmented-reality devices and perhaps implanted interfaces. What are the biological, psychological and social consequences of living within such an environment for fifty or seventy years? We cannot yet answer that confidently.

The responsible approach is neither to create fear without evidence nor to assume that every innovation is harmless until proven otherwise. It is to continue research, establish appropriate safeguards and ensure that commercial competition does not move faster than our ability to protect human wellbeing.

Brain-computer interfaces make this particularly important because brain data is unlike ordinary personal data. A password can be changed. A credit card can be cancelled. Neural information may reveal something far more intimate about an individual. As these technologies develop, societies may eventually need concepts such as neural privacy, cognitive liberty and explicit rights over brain-generated data.

The technological race therefore should not simply be about who becomes first.

There is another race that matters just as much: who can build the governance capable of making the technology trustworthy?

From the Funeral Industry to the Question of Human Dignity

Following these trends further changed my original question. Perhaps the future challenge for funeral businesses is not simply whether there will eventually be fewer funerals. A deeper transformation could come from the changing structure of the family itself.

Funeral traditions were developed around families and communities. This is especially visible across Asian cultures. When a person dies, children, grandchildren, siblings, relatives and friends participate in the process. Someone organises the funeral, someone handles burial or cremation, someone maintains the grave or memorial, and someone carries family memories into the next generation.

But what happens after several decades of very low fertility?

A family with five children and fifteen grandchildren has a very different support structure from a family with one child. A couple without children has another structure entirely. As more people grow old alone or without descendants, society will face questions extending far beyond the funeral ceremony itself.

Who supports someone through the final years of life? Who makes decisions when that person loses capacity? Who arranges the funeral? Who maintains the memorial? Who protects their possessions and records? And who makes sure that a person without descendants receives the same dignity at the end of life as someone surrounded by a large family?

These are not simply commercial opportunities. They are social responsibilities.

Governments, healthcare providers, communities and businesses may eventually need new systems for people ageing without traditional family support. Funeral providers could become part of that ecosystem, but their future role may extend beyond handling death towards protecting dignity, memory and legacy.

The digital dimension makes this even more significant. People already leave enormous digital footprints: photographs, videos, emails, social-media accounts, cloud files, messages, voice recordings and years of written communication. AI could eventually organise these materials into detailed personal histories and interactive memorials. People may begin planning their digital legacy before death in much the same way they prepare wills or insurance today.

This could transform part of the funeral industry into something broader: a legacy industry.

Yet this transformation will also require governance. Who owns a deceased person’s data? Should a company be allowed to create an AI representation of someone who never consented to it? Who has the right to deactivate such a representation? Can someone’s voice or likeness continue to be commercially exploited after death? Should an AI simulation of a deceased parent be available indefinitely to a child?

The technology to do some of these things may arrive before society has decided whether they should be done.

That is why innovation and governance cannot be separated.

The future funeral provider may eventually preserve not only physical remains but digital identity and human memory. If that happens, the industry will inherit an enormous responsibility: to protect dignity after death in the same way that other institutions are expected to protect dignity during life.

The Future Is Not Only About What We Can Build

I am deliberately recording these thoughts on 6 September 2026 because observations about the future are easy to make after the future has arrived.

I do not know whether the funeral industry will ultimately shrink. I do not know whether global fertility will remain low for the rest of this century. Governments may develop more effective family policies. Migration may reshape national populations. Medical science could extend healthy lifespan substantially. AI could ultimately give people greater freedom rather than increasing work pressure. Technologies we cannot yet imagine could change every assumption in this article.

Nor am I suggesting a simple relationship of brain chips causing lower fertility and lower fertility causing the funeral industry to collapse. Human society is far too complex for such a straight line.

What interests me is the chain of signals.

Brain-computer interfaces tell us that technology is moving closer to the human body. Artificial intelligence tells us that the relationship between labour and productivity is changing. Falling fertility tells us that family formation and population structures are changing. Ageing societies tell us that responsibility between generations will become increasingly difficult. Digital identity tells us that what a person leaves behind after death is becoming much larger than physical possessions.

Individually, none of these signals tells us exactly what society will look like in 2050 or 2070. Together, however, they encourage us to ask questions earlier.

When Elon Musk helped bring brain chips into mainstream conversation, the obvious question was what a brain-computer interface could enable. As China accelerates its own ambitions, another obvious question is who will lead the technological race.

I increasingly believe there is a more important question: what kind of society are we creating if all of this succeeds?

Technology changes human capability. Capability changes expectations. Expectations influence behaviour. Behaviour affects families. Families shape demographics. Demographics reshape economies and industries. At every stage of that chain, however, there is also a governance decision. We can decide how technology is regulated, how productivity gains are shared, how families are supported, how ageing populations are cared for, how personal data is protected and how dignity is preserved after death.

That is why technological progress should not be measured only by what becomes technically possible.

A country can win a technology race and still face profound social challenges. A company can achieve extraordinary productivity while its people struggle with time and family. An industry can successfully digitise itself while failing to protect the dignity and privacy of the people it serves.

The future I am interested in is therefore not simply a more advanced future.

It is a future in which innovation, society and governance advance together.

Perhaps decades from now, the funeral industry will remain largely as we know it today. Perhaps population decline will eventually reduce its traditional volume. Perhaps it will evolve into an industry centred as much on memory, identity and legacy as on death itself. I cannot know which outcome will prevail.

What I can do is record what I saw from where I was standing.

On 6 September 2026, a story about China and the brain-chip race reminded me of a conversation Elon Musk helped bring into public consciousness years earlier. But instead of making me think only about the future of computers, it made me think about the future of people: how we work, how we build families, how we age, how we care for one another, and eventually how we preserve dignity when a human life comes to an end.

Whenever I encounter a new technology today, I try not to stop at the most immediate question: what can this technology do?

I try to follow it further and ask: if this becomes normal, what else will change—and are our society and governance ready for what follows?

Because perhaps the most important measure of technological progress will not be how closely we can connect humans to machines.

It will be whether, after doing so, we still know how to put human beings first.

We Used to Build. Then AI Changed the Equation

Over the past year, my team and I have built many internal systems to make our business operations smoother, faster and more efficient. Some of these systems were created for email management, message polishing, data scraping, email blasting, proposal writing and other repetitive business tasks that, at the time, genuinely required dedicated tools. We built them because they solved real problems. They reduced manual work, gave us greater control over our processes and allowed us to operate more efficiently. Like many technology companies, we believed that building our own systems was a sign of progress. If there was a business problem, we would design a workflow, write the code and create a solution around it.

Then AI arrived, and the equation changed far more quickly than most of us expected.

Many tasks that previously justified building an entire internal system can now be completed through AI with dramatically less effort. Writing and polishing business messages no longer requires the same kind of dedicated workflow. Proposal writing can be accelerated with AI. Research, content drafting, data processing and even parts of software development can now be handled in ways that would have sounded unrealistic only a few years ago. When the technology around us changes this quickly, the question is no longer simply, “What else should we build?” The harder and more important question becomes, “What should we stop maintaining?”

The Weight of What We Never Deleted

That was the question I found myself confronting this year.

We had several systems and projects sitting on our servers that had not been actively used for a long time. Some were internal tools that had been replaced by better solutions. Others were old client projects, dummy environments or discontinued applications that remained there simply because nobody wanted to delete them. They were not necessarily causing an immediate problem, but they occupied space, consumed attention and represented another layer of complexity inside our technical environment. More importantly, they carried a strange emotional weight. Anyone who has spent time building software will understand this feeling. You remember the effort that went into a project. You remember the nights spent debugging it, the ideas behind it and the moment it finally worked. Even when the system has become irrelevant, deleting it can feel like throwing away part of your own history.

For years, some of these projects remained untouched because of the same familiar thoughts: perhaps we might need them one day; perhaps there was something useful hidden inside; perhaps we should keep a backup just in case; perhaps it was safer not to touch anything. This is how digital clutter accumulates. One inactive project becomes five. Five become twenty. Old databases sit beside new ones. Forgotten backups remain in folders. Temporary files become permanent. Nobody remembers which version is important anymore. Eventually, a server begins to resemble a storeroom that has not been cleaned for ten years.

This Year, I Decided Enough Was Enough

This year, I decided that enough was enough.

Some of those projects had been sitting not only on our servers, but also in my mind, for several years. I knew they were no longer useful, yet I still felt reluctant to remove them. This year, and especially over the past few days, we finally deleted them completely. Not moved into another folder. Not renamed as “OLD”. Not archived somewhere simply to avoid making a decision. Deleted.

The feeling was unexpectedly liberating.

Transformation Is Not Always About Adding

It reminded me that digital transformation is not always about adding something new. Sometimes transformation begins with the courage to remove what no longer belongs. In business, we often celebrate expansion. We talk about adding new platforms, new automation, new software, new AI tools and new systems. Very rarely do we celebrate subtraction. Yet every new digital layer creates another responsibility: another login, another database, another integration, another renewal date, another potential security exposure and another system that somebody eventually has to understand.

AI is making this issue even more important. Because software can now be created faster and more cheaply, companies may end up creating even more digital clutter than before. An employee can use AI to develop a small application. A department can automate a workflow independently. A team can build an AI agent to connect different services. All of this is powerful, but the lower cost of creation does not eliminate the future cost of ownership. Someone still has to know what the system does, where the data is stored, who owns it, whether it is secure, whether it should still be running and what happens when it fails.

In other words, AI makes creation easier, but it makes digital discipline even more important.

Playing “Digital Doctor”

That thought became especially clear to me over the past two days, when I unexpectedly found myself playing a role that I now jokingly describe as a “digital doctor”.

The first situation involved a system that we had developed for a client some time ago. The application had been stable for a long period and therefore had not required much maintenance. Like many business systems, it continued operating quietly in the background until one day something went wrong. When the client contacted us, we had to return to code that we had not looked at seriously for years.

That experience was almost like digital archaeology.

Digital Archaeology

When you are actively developing a system, the logic feels obvious. You remember why each module exists, how different functions are connected and why certain technical decisions were made. Years later, that context disappears. The source code is still there, but the human memory surrounding it is gone. You look at an old function and ask yourself why it was written that way. You trace one module into another. You examine the database structure, follow the application flow and try to reconstruct the thinking of the developer who built it — even when that developer may have been your own team.

We spent almost the entire day doing exactly that. We reviewed the old logic, traced the issue, tested different possibilities, repaired the affected components and made sure that the fix did not create another problem somewhere else in the system. By night, the application was functioning correctly again and had been deployed.

There is a particular kind of satisfaction that comes from solving this type of problem. Building something new is creative. Repairing a legacy system is investigative. You are not starting with a blank page. You are entering an environment filled with previous decisions, forgotten assumptions and technical history. You have to diagnose before you can treat.

The Second Case: A Server That Kept Failing

The second case was significantly larger.

This client had been operating a critical business application on a server environment that had been causing problems for years. The server would become unavailable two or three times a year. Each time it happened, the impact on the business was serious because the company relied heavily on the system for its daily operations. When the server went down, the company’s ability to function was affected. Staff could not access what they needed, work slowed down and everyone waited anxiously for the system to recover.

For almost two years, I had been encouraging the client to move to a more reliable environment.

The answer was always complicated. A new server costs money. Migration takes time. Moving a large system carries risk. There may be downtime. Something may break during the transition. The existing setup, although unreliable, was familiar. This is one of the most common challenges in digital transformation: companies often know that something is risky, but as long as it is still working today, the urgency to change disappears.

Every outage created pain. Once the system came back online, the pain was forgotten.

Eventually, I told the client very directly that if they continued refusing to migrate, there was little more I could do. I had been following the issue for almost two years. At some point, a business has to decide whether the cost of change is greater than the cost of continued risk.

This time, the client finally decided to move.

What We Found Inside

Once we began the migration, it became clear that this was not simply a matter of copying files from one server to another. The environment included multiple applications and around six subdomains, together with a large database. The overall data volume was approximately 40 to 50 gigabytes. Even downloading, transferring and organising that amount of material was already a significant exercise.

But the real problem was not the size. It was what we discovered inside.

There were old application files, unused folders, historical backups, temporary files, unnecessary logs and remnants from previous development work. Over the years, different people had worked on the system. Different things had been added. Very little had been removed. The application had continued running, but the technical environment around it had gradually become more difficult to understand and manage.

This is more common than many business owners realise.

A business system may survive for ten or fifteen years. During that time, developers change, vendors change, employees resign, operating systems are upgraded, hosting providers change and business requirements evolve. Every generation adds something. Very few generations take responsibility for cleaning up what came before. Eventually, the system still works, but nobody has a complete picture of how everything fits together.

Cleaning the Digital House

At that point, a server migration becomes more than a technical exercise. It becomes an opportunity to clean the digital house.

That is exactly what we are doing now. Instead of simply moving all the old files into a new server and carrying years of unnecessary baggage with us, we are reviewing the application, removing what is no longer needed, organising the source code, cleaning the environment and preparing the project to be properly managed through GitLab. Once that process is completed, the cleaned and organised application can be deployed into the new server environment with a much clearer technical structure.

As I write this article, the work is roughly halfway completed.

The Real Cost of Neglect

It has been tiring, messy and at times painfully slow. Moving tens of gigabytes of data is not glamorous work. Searching through old folders is not the kind of technology story that normally appears in marketing material. There are no dramatic AI demonstrations, no shiny dashboards and no impressive product launches.

Yet this kind of work may be far more important to a business than another new AI tool.

When a legacy application fails, the consequences can be immediate. A business may lose access to customer information, inventory records, financial processes, internal workflows or operational data. Employees may be unable to continue their work. Management may suddenly realise that nobody knows where the latest source code is stored. The developer who originally built the system may no longer be available. Passwords may be scattered across different people. Backups may exist, but nobody knows whether they can actually be restored.

Technology problems rarely arrive at a convenient time.

A Digital Housekeeping Problem

This is why I increasingly believe that many companies do not necessarily have a technology problem. They have a digital housekeeping problem.

The first question should not always be, “What new system should we buy?” Sometimes the better questions are much simpler. What systems do we already have? Which of them are critical? Who owns the domains? Where are the databases? Where is the latest source code? Who has access to the server? When was the last backup tested? Which applications are still being used? Which systems are no longer necessary? What would happen if a key server stopped working tomorrow?

These questions may not sound innovative, but they determine how resilient a company really is.

The arrival of AI does not make these fundamentals less important. It makes them more important.

Innovation Needs Discipline, Not Just AI

As AI becomes embedded in more business processes, companies will connect more systems, generate more data and automate more decisions. Without discipline, the technology environment will become increasingly complicated. If companies simply add AI on top of years of technical debt, they may create faster systems without creating healthier systems.

A healthy digital organisation requires both innovation and maintenance. It needs the courage to experiment, but also the discipline to clean. It needs the ability to build new systems, but also the wisdom to retire old ones. It needs AI, but it also needs governance. Most importantly, it needs people who are willing to examine the messy parts of the business that nobody else wants to touch.

Why I Enjoy These Messy Problems

This is where I realised something important about myself.

I enjoy these messy problems.

Give me a straightforward software project and I can work through it. But give me a system that nobody understands anymore, a server that keeps failing, an old database that has grown out of control, an application left behind by a previous vendor or a problem that everyone has been avoiding for years, and I become genuinely interested.

I want to know what happened.

I want to understand how everything is connected.

I want to identify what is unnecessary.

I want to repair what still matters.

I want to organise the environment properly.

And I want to see the business regain control over something that had become a source of frustration or risk.

Becoming an “Enterprise Digital Doctor”

That is when the idea of being an “Enterprise Digital Doctor” suddenly began to make sense to me.

A doctor does not begin treatment by prescribing random medicine. The first responsibility is diagnosis. A patient may describe one symptom, but the real cause may be something completely different. Digital problems are similar.

A company may say its website is slow, but the real issue may be poor server architecture. A business may say it needs a new system, when the real problem is that three existing systems are doing overlapping jobs. Management may say it needs AI, when the company actually needs cleaner data and better processes first. A team may believe it needs a bigger server, when the real problem is years of unmanaged files and inefficient application design.

The visible problem is not always the real problem.

Diagnosis must come before development.

The Right Technology, in the Right Place, for the Right Reason

For many years, companies like ours were mainly expected to build things: websites, ecommerce platforms, internal systems, applications and digital tools. We still do that, and building will remain an important part of our work. But I increasingly believe that the greater value lies in understanding what the business truly needs before another system is created.

Sometimes the correct prescription is a new application. Sometimes it is AI. Sometimes it is migration. Sometimes it is restructuring. Sometimes it is better governance. Sometimes it is simply cleaning up years of technical debt.

And sometimes, the best solution is to delete something.

That may be one of the most important lessons the AI era is teaching me.

Transformation is not always about having more technology. It is about having the right technology, in the right place, for the right reason.

Companies that learn how to let go of unnecessary systems, protect the systems that still matter and introduce new technology with discipline will be in a much stronger position to survive the next wave of change.

As for me, I think I have found one part of my work that I genuinely want to do more of.

When a business has a digital problem that has become too complicated, too old, too messy or too difficult for anyone to understand, I want to be the person who comes in, examines the symptoms, identifies the real cause and helps bring the system back to health.

Perhaps “Enterprise Digital Doctor” sounds unconventional.

But after the past few days, it feels surprisingly accurate.

Beyond AI-Generated Code

Over the past few months, I have worked extensively with Claude, ChatGPT and Codex on real software development projects. The result has been more than a collection of AI-generated code. I have gradually developed a practical method for helping AI understand a software project, follow its rules, execute tasks and improve the system—without allowing the process to drift out of control.

The Question Behind the Work

A large part of my time has been spent trying to answer one deceptively simple question: How do I communicate with AI so that it truly understands what I want?

Easy Answers, Difficult Systems

Chatting with AI is easy. Getting an answer is easy. Generating code is becoming easier every day. Building a dependable system that people can safely use, however, is a completely different challenge.

A Software Engineer's Perspective

Coming from the software industry, I naturally brought my usual concerns into the process. Is the architecture stable? Is the database designed correctly? Who can access each function? What happens when something fails? How is the data protected? These questions remain essential, regardless of whether the code is written by a person or generated by AI.

Control, Quality and Accountability

I also had to consider how the system would preserve a complete history, who would be responsible for checking quality and which decisions could safely be made by AI. Just as importantly, I needed to identify the decisions that still required human judgement and determine whether the entire process could be repeated consistently.

Teaching AI How to Think With Me

The deeper I went, the more I realised that this was no longer simply about using AI to write software. It was about teaching AI how I approach problems, structure systems, evaluate risks and define an acceptable result.

Working Is Not the Same as Reliable

AI can produce a feature remarkably quickly. The screen may look correct, the button may work and the system may even pass a basic test. But none of these things guarantees that the underlying system has been designed properly.

The Problems Beneath the Surface

A working interface does not prove that the database is well structured. A successful test does not guarantee that access controls are secure. A feature that works today may still introduce weaknesses that cause another part of the system to fail later.

The Three-Month Test

The real measure of software is not simply whether it works at launch. It is whether the system remains understandable, maintainable and safe to change months or years later. Something that functions perfectly today can still become a system that nobody dares to touch three months from now.

Confidence Without Understanding

This is one of the greatest dangers of AI-assisted development: AI may not fully understand the requirements, yet it can still complete the task with remarkable confidence. The result can look convincing enough that important design flaws remain unnoticed.

A Challenge Across Every AI Platform

This is not a problem unique to Claude. The same issue appears when working with ChatGPT, Codex and other AI agents. Different tools may have different strengths, but all of them depend on the quality of the context, rules and boundaries they receive.

Code Is No Longer the Main Question

The real challenge is no longer whether AI can write code. It clearly can. The more important question is whether we can provide enough context and guidance for AI to produce work that genuinely meets our technical, operational and business standards.

Building Structure Around AI

To address this, I began placing more structure around the development process. This included requirement records, database rules, access controls, issue tracking, version control, testing checklists, audit logs and clearly defined human approval points.

Creating Organisational Memory

I also needed the project’s knowledge to survive beyond a single conversation, computer or AI session. Important decisions cannot remain trapped inside temporary chat histories or in the memory of one person.

Preparing for the Next AI

If another AI takes over the project later, it should be able to understand what was built, why certain decisions were made and which parts of the system must not be changed without proper review. Continuity becomes essential when multiple people and AI agents contribute to the same system.

Software Engineering Matters More Than Ever

This experience has made me appreciate software engineering even more. AI can accelerate development, but speed does not remove the need for architecture, security, governance, documentation and disciplined decision-making.

The Most Valuable Skill in the AI Era

In the AI era, the most valuable person may not be the one who writes code the fastest or produces the longest prompt. It will be the person who understands the industry, translates real business needs into clear system rules and knows how to judge whether AI has delivered the right outcome.

Industry Knowledge Cannot Be Replaced

AI cannot replace industry understanding. It amplifies it.

AI Amplifies What Already Exists

When you understand your industry well, AI can amplify your experience, judgement and ability to solve problems. But when processes are unclear, data is disorganised and responsibilities are undefined, AI will amplify those weaknesses too.

Turning Knowledge Into Systems

At OPERiON, we help businesses transform their industry knowledge into structured systems and practical AI solutions—supported by the right processes, controls and human judgement.

Moving Beyond Experimentation

If you are ready to move beyond experimenting with AI and begin applying it meaningfully to your business, let’s have a conversation.

Your Business, Amplified

Your knowledge. Your systems. Your business—amplified.

Technology Professionals Know That Some Things Can Be Said—and Some Cannot

Those of us in the technology industry understand how quickly the market is changing. If a software company openly tells every client, “Most of your project was developed using AI,” the client’s first reaction may not be excitement. Instead, the client may ask: “If AI can do it, why should I pay a software company?”

However, even if we choose not to talk about it, the market will eventually discover the truth. AI web coding, vibe coding and automated development tools are already transforming the software industry. They can generate websites, dashboards, system modules and applications faster than ever before.

The real question is no longer whether we should use AI. The more important question is this: when almost anyone can use AI to generate code, what is the real value of a professional programmer or software company?

AI Can Write Code, but It May Not Understand the Business

AI can quickly produce a website, an API, a backend module or even an application that appears complete. However, a system that can run is not necessarily a system that is suitable for the business. It may also be unable to support the organisation over the long term.

A company does not simply need attractive screens and working buttons. It needs a solution capable of handling real business processes, operational exceptions, data accuracy, security risks and future growth.

What are the company’s actual business rules? Which processes should be automated? Which decisions must remain under human control? What happens when the number of customers, transactions or system users increases tenfold? Who should be allowed to view, edit, approve or export sensitive information?

These questions cannot be answered reliably through a single prompt. They require business understanding, technical experience and human judgement.

Foundational Knowledge Determines How Far a System Can Go

As we use AI to perform more programming work, foundational technical knowledge becomes more important—not less.

How should the data be collected? What information should be mandatory? How should the fields be defined? How should the database be structured? What should be used as the primary key? How should foreign keys connect different tables? Which data should be stored separately, and which information should be linked?

AI may suggest an answer, but a human professional must determine whether that answer is appropriate.

If the foundation is wrong, AI will simply help us produce the wrong system faster. A system may appear to work when it contains only a small amount of test data. Problems may emerge later when the data volume grows, multiple users operate the system simultaneously or the application must integrate with other platforms.

AI can accelerate development, but a knowledgeable technical professional must still decide whether the system is moving in the right direction.

The Real Expertise Lies Between Raw Data and the Final Result

Many people assume that once a large amount of data is given to AI, it can automatically generate valuable answers. In reality, there is a long and complicated journey between raw data and a trustworthy result.

The data may need to be cleaned, categorised, verified, linked and interpreted. Duplicate records must be identified. Missing information must be handled properly. Different access levels must be established. Exceptions and unusual cases must be investigated.

Which data can be trusted? Which records are incomplete? Should missing information be removed, corrected or retained? Does the same measurement carry the same meaning across different departments? Is the final result technically accurate but commercially misleading?

Without industry knowledge and domain expertise, a large dataset may produce an answer that looks convincing but is fundamentally incorrect.

The value of a technology professional is not limited to processing data. It also comes from understanding why the data appears in a particular way, recognising what may be missing and determining whether the result can be used responsibly by the business.

Programmer, Where Does Your Value Truly Lie?

Every programmer should now ask a difficult but necessary question: if AI can already generate most basic code, what additional value do I provide?

Knowing how to write code remains useful, but “I can programme” may no longer be enough to create a sustainable competitive advantage.

Your value may come from system architecture, database design, cybersecurity, software integration, performance optimisation or business analysis. It may come from your ability to transform an unclear business request into a structured and practical solution.

Your value may also come from recognising risks before they become expensive problems. It can be found in your ability to communicate with clients, coordinate with a technical team, make responsible architectural decisions and respond calmly when a live system fails.

The most valuable technology professional of the future may not be the person who writes the largest amount of code. It may be the person who understands what should be built, why it should be built that way, what could go wrong and how to recover when something fails.

Ten Programmers Do Not Automatically Create Ten Different Levels of Value

Imagine a company with ten programmers who possess similar knowledge, perform similar tasks and produce similar results. Once the organisation establishes a mature AI development framework, proper governance, reusable components and standard operating procedures, work that previously required ten people may be completed by a much smaller team.

This may be uncomfortable to hear, but avoiding the discussion will not stop the change from happening.

Some positions will be reduced. Some responsibilities will be combined. Some programmers may leave employment and start their own businesses. Others may move into entirely new technical roles.

The future may create greater demand for solution architects, AI workflow specialists, data specialists, system auditors, product owners and technical leaders who can review and govern AI-generated work.

The goal should not be to preserve an old job title forever. The goal is to develop capabilities that remain valuable even as the tools, workflows and size of development teams continue to change.

People Who Have Completed—and Rescued—Real Projects Remain Rare

At OPERiON, we are not only interested in how many websites or systems someone has built. We value people who understand the complete project lifecycle.

This means being involved in gathering requirements, planning the architecture, designing the database, developing the solution, testing it, launching it and maintaining it after deployment. It also means taking responsibility when real users begin using the system and unexpected problems appear.

Even more valuable are professionals who have taken over troubled or failed systems. They know how to investigate an unfamiliar codebase, identify structural weaknesses, repair damaged data, correct business logic and stabilise the system without causing further disruption.

Building a new system requires technical ability. Maintaining a live system requires discipline and responsibility. Rescuing a failing system requires experience, patience, sound judgement and the courage to make difficult decisions.

These capabilities will not disappear because of AI. In an environment where software can be produced faster than ever, the ability to evaluate, govern, maintain and rescue systems may become even more valuable.

Job Loss Is Not the End—It Can Be the Beginning of a New Direction

Whether the future brings a career transition, a smaller development team or an unexpected job loss, technology professionals must continue moving forward with a positive and practical mindset.

OPERiON will be opening new opportunities through an IT Specialist talent initiative. We are looking for experienced professionals who have spent at least seven years in the technology field, managed projects from beginning to completion, and remained involved during the maintenance stage.

We are particularly interested in people who have repaired, recovered or rescued systems that were failing. We want professionals who can do more than generate code—people who can understand business requirements, make sound technical decisions, take ownership and solve difficult problems.

If your career is currently going through a major change, do not immediately conclude that your experience has become irrelevant. The knowledge you accumulated through real projects, system failures, difficult clients and operational challenges may now be your greatest professional asset.

You are not necessarily being replaced by technology. You may simply have arrived at a point where you must redefine your value.

For capable, responsible and experienced technology professionals who are willing to keep learning, OPERiON hopes to offer more than another job opportunity. We want to become a new source of hope—and the beginning of the next chapter in your professional journey.

Synopsis

A company may own several domains, use different hosting providers, purchase SSL certificates separately and manage multiple renewal dates—yet still have no clear picture of how everything connects. This is not merely a technical inconvenience. It is a business continuity, security and governance risk. As AI introduces even more platforms and solutions into the workplace, leaders must resist the temptation to keep adding. The priority should be to simplify, consolidate and regain control.

The Conversation Started With a Website

During a recent client discussion, we began with what appeared to be a straightforward topic: the company’s website.

As the conversation progressed, however, the client explained that one domain had been registered with one provider, while another domain was managed through a different platform. The website was hosted elsewhere, and its SSL certificate came from yet another provider.

The client knew these services existed, but could not clearly explain which domain was connected to which server, where the SSL certificate was managed or which account controlled each component.

Every service also had a different renewal date.

From the client’s perspective, everything was technically operating. From a governance perspective, however, the entire arrangement had become dangerously unclear.

When Digital Assets Become Invisible

Many companies face the same problem. Their websites, domains, email systems, hosting accounts and security services were not necessarily planned as one complete architecture.

Instead, they were accumulated over time.

One provider registered the first domain. Another vendor developed the website. Someone else purchased the hosting package. A former team member created an account for the SSL certificate. Years later, nobody has a complete record of what the company owns, where it is located or who has access to it.

This creates a form of invisible operational risk. The website may be functioning today, but a missed renewal, expired credit card, inaccessible email account or departed team member could suddenly interrupt the business.

The company owns the digital assets, but it may not truly control them.

The First Recommendation Was Consolidation

Our advice to the client was simple: consolidate wherever practical.

If the company does not need two hosting servers, reduce them to one. If there is no strategic reason to manage domains across several registrars, consider transferring them to one trusted provider. If multiple services perform the same function, eliminate the duplication.

Most domain names can be transferred from one registrar to another, subject to the domain extension’s policies, transfer eligibility and security requirements. A domain is not normally locked permanently to the company where it was first registered.

The objective is not to force everything into one platform at any cost. The objective is to reduce unnecessary fragmentation.

Every additional provider creates another account, password, renewal date, invoice, support channel and potential point of failure. Consolidation gives management a clearer view of its digital assets and reduces the effort required to protect them.

We Drew the Architecture on the Spot

During the meeting, I drew a simple diagram for the client.

It showed where the domains were registered, which domain was connected to which server, where the website was hosted, how the SSL certificate was applied and which accounts provided administrative access.

That simple diagram immediately changed the conversation.

What had previously been stored as fragmented information in different people’s memories became visible on one page. The client could finally see the relationship between the domain, DNS, SSL, server, website and account access.

Every company should maintain this type of digital asset record. It should include the provider, account owner, administrator access, renewal date, payment method, responsible team member and recovery information for every critical service.

Documentation is not paperwork for its own sake. It is part of security, continuity and governance.

Not Every Website Needs an Expensive SSL Package

The client then asked whether a separate paid SSL certificate was necessary.

The answer depends on the website, its technical environment and the organisation’s compliance requirements. For a relatively straightforward information-based corporate website, a separately purchased premium SSL certificate may not always be required.

A properly configured Cloudflare setup, for example, can provide SSL/TLS capabilities together with DNS management, content delivery, traffic filtering and protection against certain forms of malicious activity.

This does not mean that Cloudflare automatically solves every security issue. The configuration must still be correct, and the connection between Cloudflare and the origin server must also be protected. However, it can reduce the number of separate products that a company needs to purchase and manage.

Again, the principle is not simply to choose the cheapest service. It is to select an appropriate level of protection without introducing unnecessary complexity.

Cloudflare Can Add a Protective Layer

Without an intermediary layer, a domain may point directly to the web server. Depending on the configuration, this can expose the server’s origin IP address and allow traffic to reach it directly.

With Cloudflare acting as a proxy, visitors first connect through Cloudflare before their requests are forwarded to the origin server. This can help mask the server’s IP address, filter unwanted traffic and provide an initial protective layer.

However, masking the IP address is only effective when the origin server is also configured to prevent unauthorised direct access. Cloudflare should be treated as one layer within the security architecture, not as a replacement for server hardening, access control, patching, backups and monitoring.

Security becomes stronger when each layer is understood and intentionally managed.

Security Must Match the Business Risk

The client then asked how far website security should go.

For an information-based website with no customer accounts, online payments or sensitive personal data, the security architecture does not necessarily need to be excessively complicated. It still requires proper protection, but the solution should be proportionate to the actual risk.

The situation changes when a company handles sensitive information, processes transactions or supplies services to multinational corporations and regulated industries.

I once worked with a client serving an American corporation that required monthly security audits—not only of the website, but also of the company’s email environment, domains, servers and overall external security posture.

It was the first time I had encountered such a demanding monthly requirement.

For that situation, we recommended UpGuard, a security-rating and third-party risk-management platform. It is not a low-cost solution, but some large organisations require their vendors to demonstrate formal, continuous and independently measurable security controls.

The right level of security is therefore determined not only by the website itself, but also by the expectations of the customers, industries and markets that the company serves.

A Working Website Is Not the Same as a Governed Website

Many business owners assume that if a website is online, everything must be under control.

That is not necessarily true.

A website can remain online while its domain is registered under a former vendor’s account. Its hosting subscription may be charged to an unknown credit card. Its DNS could be managed through an account that nobody can recover. Its SSL certificate may expire without anyone receiving the notification.

Technical functionality tells us whether something is working today. Governance tells us whether the company can understand, control, secure and recover it tomorrow.

This is why the real conversation is not only about websites. It is about digital ownership.

AI Must Not Amplify Our Existing Complexity

We are now entering an era in which companies can access more AI platforms, cybersecurity tools, cloud services and digital solutions than ever before.

The temptation will be to keep adding.

One team subscribes to an AI writing platform. Another adopts an automation service. A third connects a new customer system. Every solution appears useful individually, but together they can create an increasingly fragmented and ungovernable environment.

AI will amplify whatever already exists. If our processes are clear, AI can amplify efficiency. If our systems are fragmented, AI can amplify confusion. If our access controls are weak, AI can amplify risk.

We should not allow AI to amplify our complexity.

Before adopting the next solution, companies should ask: Can we consolidate what we already have? Can we eliminate duplication? Can we reduce the number of providers, accounts and renewal dates? Can everyone clearly see who owns and manages each digital asset?

Simplification Is Now a Management Discipline

The most important improvement may not be adding another platform. It may be removing one.

If we are currently managing ten separate components, can we reduce them to five? If we are managing five overlapping services, can we consolidate them into one well-governed environment?

Simplification does not mean sacrificing capability or security. Done correctly, it improves visibility, accountability, continuity and control.

This perspective comes from our years of practical experience helping businesses manage websites, domains, hosting environments, email systems, cybersecurity requirements and digital transformation.

In the AI era, companies will certainly need better technology. But they will also need the discipline to reduce, cut and simplify.

Do not begin by asking what else you can add.

Begin by asking what you no longer need to manage.

Lukas Insight | By Ts. Lukas J. Tan

After completing PDX2026, I decided to go all-in on artificial intelligence.

Nearly three weeks into this journey, I have moved beyond simply using AI tools. I am exploring how AI can learn, build, analyse, automate and operate alongside me.

My biggest discovery is simple: AI enables us to learn independently and create exactly what we need at extraordinary speed.

One person can now research a market, analyse data, prepare a strategy, develop software and automate workflows. This represents a major productivity breakthrough, particularly for small and medium-sized businesses.

But the deeper I go into AI, the more I find myself asking one uncomfortable question:

Do you know whether there is a devil inside your AI?

What Is the “Devil” Inside AI?

The devil is not AI itself. It is the hidden risk created by poor data, excessive access, unclear instructions and uncontrolled automation.

An AI system may generate a convincing answer based on inaccurate information. It may reveal confidential data because it was given the wrong permissions. An AI agent may perform an unintended action because nobody clearly defined its boundaries.

The risk becomes greater when AI moves from answering questions to operating business systems.

A human mistake usually develops at human speed. An automated AI mistake can affect thousands of records, messages or transactions before anyone detects it.

Business leaders must therefore understand three things clearly:

• What AI can access
• What AI can decide
• What AI can execute

Lessons From the Age of Hacking

I come from a generation shaped by computer viruses, hacking, data scraping, software cloning and system vulnerabilities.

That experience trained me to examine technology from two perspectives: what the system is designed to do and how someone could manipulate it.

Convenience can create an entry point. Connectivity can create exposure. Automation can multiply efficiency, but it can also multiply errors.

Traditional cybersecurity focuses on protecting devices, networks, passwords and databases. AI introduces another layer that organisations must protect: the information and context influencing its behaviour.

AI does not merely store information. It interprets information, identifies patterns, generates recommendations and increasingly completes tasks.

Securing the system is no longer enough. We must also secure the decision-making process.

Can Someone Manipulate AI Data?

Yes. AI can be influenced by inaccurate, outdated or deliberately manipulated information.

The internet can be flooded with fabricated articles, fake reviews, synthetic identities, altered images and misleading statistics. Internal databases can also contain duplicate records, incorrect labels and biased historical decisions.

If AI relies on compromised information, it may produce an answer that appears professional and logical but is fundamentally wrong.

This creates a new category of cyber risk.

In the past, attackers mainly attempted to steal information or disrupt systems. In the AI era, they may attempt to influence what an AI system believes, how it reasons and what it recommends.

An attacker may not need to change the final decision directly. Manipulating the information used to reach that decision could be enough.

A company may successfully prevent outsiders from accessing its database and still make poor decisions because the data inside cannot be trusted.

Cybersecurity protects access to data. AI governance protects how that data becomes a decision.

What Is AI Governance?

AI governance is the framework that determines how an organisation selects, uses, monitors and controls artificial intelligence.

It establishes responsibilities for data protection, system access, human approval, output verification and accountability.

Without governance, every team member may create their own rules. Confidential information could be uploaded to unapproved platforms. AI-generated recommendations might be accepted without verification. Automated actions could happen without proper authorisation.

That is not a sustainable AI strategy. It is unmanaged business risk.

AI governance turns individual experimentation into a controlled organisational capability.

What Should an AI Governance Framework Include?

A practical framework should address five core areas.

1. Data. Define what information AI may access, process and retain. Personal, confidential and commercially sensitive information requires stronger protection.
2. Permission. Set boundaries around the systems AI can access and the actions it can perform. Access should be based on necessity—not convenience.
3. Verification. Establish how AI-generated work will be reviewed for accuracy, relevance, bias and potential harm.
4. Human Approval. Identify which decisions must remain under human control. Financial transactions, legal commitments, customer data changes and other high-impact actions require appropriate safeguards.
5. Accountability. Assign clear ownership. Every AI system should have someone responsible for its purpose, performance, monitoring and risks.

The strength of these controls should correspond to the potential impact. Using AI to correct grammar does not require the same governance as allowing an AI agent to modify customer records, approve payments or deploy software.

Does AI Governance Restrict Innovation?

AI governance should not stop innovation. It should enable organisations to innovate with greater confidence.

When the boundaries are clear, the team can experiment without creating unnecessary exposure. Leaders can approve automation while maintaining visibility. Customers and partners can trust that their information is being handled responsibly.

Governance is not about controlling every prompt or slowing every project. It is about creating clear authority, traceability and accountability around AI activities that can materially affect the organisation.

The winners of the AI era will not simply be the companies using the most AI tools. They will be the companies capable of using AI reliably, explaining important decisions, protecting their data and taking responsibility for the outcomes.

The Question Every Leader Must Answer

Your organisation may already be using ChatGPT, Claude, AI agents or automated workflows—even without an official AI strategy.

Members of the team may be uploading documents, analysing customer information, generating business recommendations or using AI-created code inside company systems.

The first leadership question should therefore be:

Do we know where and how AI is being used across our organisation?

An AI Governance Assessment can identify existing tools, data exposure, access permissions, approval gaps and accountability risks. The organisation can then establish a practical governance framework aligned with its operations and level of risk.

I remain strongly positive about AI. Its potential to improve productivity, strengthen decisions and help smaller organisations compete is enormous.

But opportunity without control can quickly become liability.

AI should not be feared. It should be governed with clarity, discipline and confidence.

Do not wait for the devil to appear before creating the rules.

The Era When Computer Viruses Were Everywhere

When I first started using computers, we were still living through the eras of DOS, Windows 95, Windows 98, Windows Millennium, Windows 2000, and eventually Windows XP.

At that time, almost every computer user experienced a virus infection. Computers would suddenly slow down, files would disappear, browsers would be hijacked, and sometimes the entire operating system had to be reinstalled.

The one I remember most clearly was the ILOVEYOU virus, which appeared in 2000. Disguised as an email carrying the subject line “ILOVEYOU,” it persuaded recipients to open an attachment before spreading rapidly through their contact lists.

Technically, it was a computer worm rather than a conventional virus. Within a very short time, it affected millions of computers worldwide and made the world realise something important: the more widely a technology is adopted, the greater the potential damage caused by even a small weakness in its foundation. Source: EBSCO, “ILOVEYOU Virus Attacks Computers.”

How Much Has Microsoft Spent Protecting Windows?

As Windows became one of the world’s most widely used operating systems for individuals and businesses, it naturally became one of the most valuable targets for attackers.

Microsoft does not only have to protect its operating system. It must also consider different computer brands, enterprise systems, legacy software, hardware drivers, third-party applications, and decades of compatibility requirements.

We have all encountered Windows security updates and software patches. Sometimes, just as we are preparing to shut down the computer, Windows begins installing an update and asks us to wait. From a user’s perspective, this can be frustrating. From a security perspective, however, it represents a battle that never truly ends.

Microsoft previously announced a US$20 billion investment over five years to advance cybersecurity. Its published materials also indicated that the company was investing more than US$1 billion annually in security, data protection, and risk management. These figures demonstrate how expensive it is to protect a large, open ecosystem that must continue supporting countless legacy systems. Source: Microsoft’s Cybersecurity Investment; Microsoft Cyber Defense Operations Center.

This does not necessarily mean that Windows was built on a weaker foundation. Windows faces more attacks partly because of its enormous user base, complex operating environments, and obligation to support a vast range of enterprise systems and third-party hardware and software. For cybercriminals, attacking a platform with a larger market share can offer a much greater return.

Why Do Many Mac Users Not Install Antivirus Software?

Many years later, I started using a MacBook. I noticed that many Mac users did not install separate antivirus software, yet their computers continued operating normally. Like many people, I wondered whether Macs simply could not get viruses.

Strictly speaking, that is incorrect.

macOS can still be affected by malware, ransomware, phishing, and system vulnerabilities. The difference is that Apple has integrated many protective mechanisms directly into the operating system, so users may not even notice that these protections are running.

macOS includes technologies such as XProtect, Gatekeeper, and App Notarization. Gatekeeper checks whether software comes from an identified developer, has been notarised by Apple, and has not been altered. XProtect is Apple’s built-in anti-malware technology, designed to detect, block, and remove known threats.

Apple organises its malware defence into three layers: preventing malicious software from launching, blocking it from running, and remediating it if it has already been executed. Source: Apple, “Protecting Against Malware in macOS”; Apple, “Gatekeeper and Runtime Protection.”

Apple has therefore not avoided spending money on security. A more accurate explanation is that Apple has placed much of that investment into its underlying architecture, hardware-software integration, application review process, permission controls, and automatic updates.

The fact that users do not install antivirus software themselves does not mean that there is no major security investment behind the system.

Apple also maintains greater control over its hardware and software ecosystem. It can determine which devices run macOS, how applications access system resources, and which security policies are enabled by default. This controlled environment reduces some complexity.

However, Apple’s approach cannot simply be copied and applied to Windows because the two platforms serve different markets and carry different compatibility responsibilities.

Will AI Cause Computer Viruses to Decline?

As we enter the AI era, I initially had a thought: if AI can automatically detect unusual activity, analyse malicious code, predict attack patterns, and allow firewalls to respond automatically, will traditional computer viruses gradually decline?

Part of this observation is correct.

AI can help security teams identify threats more quickly, detect phishing messages, close detection gaps, and respond at machine speed. Microsoft is already developing AI security systems designed to turn threat signals into real-time protection. Source: Microsoft, “Rethinking Security for the Age of AI.”

However, we cannot conclude that viruses will disappear simply because AI has arrived. Defenders can use AI, but attackers can use it too.

Cybercriminals can use AI to search for vulnerabilities, generate malicious code, create more convincing scam messages, and attack many more targets simultaneously. Microsoft’s security research also warns that AI adoption benefits both defenders and threat actors. Source: Microsoft Digital Defense Report 2025.

What may decline is the visible experience we once described as “my computer has caught a virus.” What may increase instead are less visible threats: identity theft, data theft, ransomware, supply-chain attacks, manipulated AI agents, and scams designed to exploit human behaviour.

Viruses may not disappear. They may simply evolve into different forms.

Was Microsoft’s Past Security Investment Wasted?

If AI can eventually automate a large part of cybersecurity work, does that mean the money, manpower, and time Microsoft invested in the past have all gone to waste?

My answer is no.

Those investments created the vulnerability databases, threat intelligence, authentication systems, security standards, update infrastructure, and defensive experience that we rely on today.

Without that foundation, AI would not have enough reliable information or established rules to distinguish normal behaviour from a genuine threat. AI is not a security expert that suddenly appeared from nowhere. Its capabilities are built upon decades of knowledge accumulated by people and organisations.

What may become obsolete is not the previous investment in security, but some of the repetitive ways security work was performed.

Security professionals may no longer need to inspect every alert manually. However, they will still be needed to design policies, supervise AI, make high-risk decisions, and ensure that the automated security systems themselves are not compromised.

Microsoft’s recent direction is also not limited to using AI to patch vulnerabilities. It has renewed its emphasis on Secure by Design, Secure by Default, and Secure Operations—placing security at the centre of design, default configurations, and everyday operations.

This tells us that even with powerful AI, everything eventually comes back to the quality of the foundation. Source: Microsoft Secure Future Initiative.

What the AI Era Has Truly Taught Me

This article is not written to criticise Microsoft or to prove that Apple is necessarily better.

It is simply a reflection from someone who lived through the eras of DOS, Windows 95, Windows 98, Windows Millennium, Windows 2000, and Windows XP—and who is now observing how computer viruses, security updates, and cyber defence are evolving in the AI era.

Different operating systems carry different historical responsibilities, user bases, levels of ecosystem openness, and security risks. We cannot judge the quality of a technology simply by asking which platform appears to suffer fewer virus infections.

However, this history has given me one important insight:

The foundation is the most important part of any good system.

If the architecture is unclear, permissions are poorly designed, data is disorganised, and responsibilities are not properly assigned, even the most advanced technology will spend its life repairing gaps.

Every time the world changes, the organisation will need more technical people, more knowledge, and more money just to keep compensating for a foundation that was never properly established.

Today, this principle does not apply only to operating systems. It applies to every organisation preparing to implement AI.

AI can help us move faster. But if our foundation and direction are wrong, it will also help us create problems at a much greater speed.

In the AI era, true competitiveness will not be determined by how many tools we own, how many technical people we employ, or how much security software we install. It will depend on whether we have designed the right architecture, governance, permissions, and accountability from the very beginning.

Technology will continue to change. Threats will continue to evolve.

But a strong foundation will never become obsolete.

Why Every Organisation Needs a Governance Strategy Before Scaling AI

Artificial Intelligence has moved beyond experimentation. What began as individual employees using AI to draft emails, summarise documents, or generate ideas has rapidly evolved into organisations embedding AI across customer service, finance, human resources, operations, software development, marketing, and executive decision-making. For many businesses, AI is no longer a future initiative—it is already part of daily operations. Yet while investment in AI continues to accelerate, governance has not kept pace. Most organisations have established policies for finance, cybersecurity, procurement, and data privacy, but relatively few have developed a comprehensive framework that governs how AI should be deployed, managed, monitored, and continuously improved.

This imbalance creates a significant leadership challenge. AI is fundamentally different from traditional enterprise software. Conventional systems execute predefined business rules, whereas AI learns from context, interacts with organisational knowledge, and increasingly influences decisions. As organisations connect AI to customer databases, accounting systems, cloud storage, communication platforms, and operational workflows, they are no longer managing software alone. They are managing a digital workforce capable of accessing, interpreting, and acting upon business information. This requires a new discipline. AI Governance should not be viewed as another compliance exercise. It is a leadership framework that ensures AI remains aligned with organisational objectives, business values, operational controls, and risk management. In many ways, AI Governance will become as essential to modern organisations as financial governance and cybersecurity governance are today.

AI Governance Begins With Visibility, Not Policies

One of the most common questions I receive from business leaders is, “Can you help us write an AI policy?” My answer is usually the same: not yet. Policies are important, but they should not be the starting point. An effective policy can only be written after an organisation understands how AI is currently being used. Surprisingly, many companies cannot answer basic questions. Which AI tools are employees already using? Which departments have connected AI to business systems? What information is being uploaded into external platforms? Which workflows have already been automated? Without visibility, any governance document quickly becomes theoretical rather than practical.

The first objective of AI Governance is therefore awareness. Organisations should begin by creating a comprehensive inventory of AI across the business. This inventory should identify every AI platform, every AI agent, every workflow automation, every system integration, and every business owner responsible for its operation. Once visibility exists, leadership can begin classifying AI according to business impact. Some AI applications may simply generate marketing copy or summarise meeting notes. Others may analyse financial reports, access confidential customer information, recommend purchasing decisions, or interact directly with clients. Different levels of responsibility require different levels of governance. Just as organisations classify financial approvals according to authority limits, AI capabilities should be classified according to operational impact and organisational risk.

Ownership Requires More Than Technology—It Requires Operational Discipline

Many discussions surrounding AI focus on selecting the right platform. While technology selection is important, ownership is ultimately determined by operational discipline rather than software features. Organisations often assume that implementing an AI solution automatically creates capability. In reality, capability emerges from the combination of people, processes, governance, and technology working together. AI should therefore be treated as part of the operating model rather than simply another digital tool.

One practical way to achieve this is by documenting how AI interacts with organisational systems. Every AI capability should have a clearly defined purpose, an identified business owner, and documented permissions. For example, an AI assistant responsible for preparing management reports may require read-only access to operational dashboards but should not be able to modify financial records. A customer service AI may retrieve product information but should not automatically approve refunds above a defined threshold. A marketing AI may generate content but should not publish communications without human review. These governance decisions are not technical limitations; they are management decisions that define accountability.

As organisations deploy multiple AI solutions, documenting these permissions becomes increasingly important. A simple governance register can include which systems each AI can access, whether it has permission to read, create, update, or delete information, which departments approve those permissions, and how often those permissions are reviewed. Such documentation may appear administrative, yet it forms the foundation of responsible AI operations. Governance is built through disciplined documentation, not assumptions.

AI Workforce Requires Governance Just as Human Workforce Does

One concept I believe organisations should begin embracing is the idea of an AI Workforce. Many businesses still think of AI as a collection of software applications. I believe this perspective is becoming outdated. As AI agents become increasingly autonomous, collaborate with one another, and support multiple departments simultaneously, they begin resembling a workforce rather than a toolset. Just as organisations define roles, responsibilities, reporting structures, performance expectations, and codes of conduct for human employees, they will eventually need equivalent governance structures for digital workers.

Imagine an organisation operating twenty specialised AI agents. One supports finance, another assists human resources, another manages customer enquiries, another analyses operational performance, while others contribute to procurement, legal review, project management, and executive reporting. Individually, each agent may perform a specific function. Collectively, however, they form an operational ecosystem. Leadership therefore needs visibility not only into each AI agent individually but also into how information flows between them. Can one agent trigger another? Can sensitive information unintentionally move between workflows? Which human manager ultimately approves decisions generated by AI? Governance should answer these questions before operational complexity makes them difficult to control.

For this reason, I encourage organisations to establish what I describe as an AI Workforce Register. Similar to an employee directory, this register should document every AI agent’s role, purpose, owner, connected systems, permissions, review schedule, and business value. This transforms AI from an invisible collection of technologies into an accountable organisational resource.

From Strategy to Implementation: Building Governance Step by Step

One misconception surrounding AI Governance is that it requires a large transformation programme before meaningful progress can begin. My experience suggests the opposite. The most effective governance frameworks evolve incrementally. Organisations should resist the temptation to produce lengthy policy documents before understanding operational reality. Instead, governance should mature alongside AI adoption.

A practical roadmap begins with six progressive stages. The first stage is establishing an AI Inventory to understand what already exists. The second stage involves classifying business information according to sensitivity and determining which categories of information may be accessed by different AI capabilities. The third stage documents permissions using a simple access matrix that specifies whether AI systems may read, create, update, or delete information within each connected platform. The fourth stage introduces governance policies covering approval processes, acceptable use, human oversight, and accountability. The fifth stage implements periodic governance reviews to verify that AI continues operating within approved boundaries. Finally, the sixth stage integrates AI Governance into broader corporate governance alongside cybersecurity, enterprise architecture, risk management, and strategic planning.

Importantly, governance should remain a living management system rather than a static document. As AI capabilities evolve, governance must evolve with them. New integrations, new regulations, changing business priorities, and emerging risks all require continuous review. Organisations should therefore view AI Governance as an ongoing leadership discipline rather than a one-time compliance exercise.

The Future Belongs to Organisations That Understand Their AI

Every major technological transformation eventually shifts from innovation to discipline. During the early Internet era, organisations focused on getting online. Later they learned the importance of cybersecurity. During the data revolution, businesses concentrated on collecting information before recognising the need for governance and privacy. Artificial Intelligence is following the same pattern. Today’s excitement around AI capabilities will gradually be matched by a greater appreciation for governance, accountability, transparency, and operational maturity.

The organisations that succeed in this next phase will not simply possess the most advanced AI models. They will possess the clearest understanding of how AI operates within their business. They will know which digital workers exist, what they can access, how they support decision-making, and who remains accountable for their performance. They will recognise that governance is not a barrier to innovation but an enabler of sustainable innovation. Responsible governance builds trust, improves operational resilience, strengthens executive confidence, and allows AI to scale safely across the enterprise.

Executive Diagnostic

Before expanding AI across your organisation, ask your leadership team these questions:

• Do we have a complete inventory of every AI tool and AI agent currently operating within the business?
• Have we documented what each AI system is allowed to read, create, update, or delete?
• Is every AI capability assigned to a business owner rather than only an IT administrator?
• Do we understand how information flows between different AI systems?
• Have we established review processes for AI permissions and governance?
• Does our leadership team discuss AI Governance with the same seriousness as financial governance or cybersecurity?

If the answer to several of these questions is “no,” your organisation’s next investment should not necessarily be another AI platform. It should be stronger governance.

Executive Action Plan

Within the next 90 days, every organisation can begin building practical AI Governance.

Create an inventory of all AI tools currently in use. Develop an AI Workforce Register identifying each AI agent’s purpose, owner, permissions, and connected systems. Build a simple access matrix defining which AI capabilities may read, create, update, or delete business information. Establish executive ownership for AI Governance rather than delegating responsibility entirely to technical teams. Finally, review governance quarterly as AI capabilities continue evolving.

Artificial Intelligence will undoubtedly reshape every industry, but governance will determine whether that transformation creates long-term competitive advantage or unmanaged operational complexity. The future belongs not simply to organisations that use AI, but to those that understand it, govern it, and integrate it responsibly into the fabric of their business.

Every Technological Revolution Creates a New Leadership Challenge

Over the past three decades, businesses have experienced several waves of technological transformation. Each wave has fundamentally changed how organisations operate, compete, and create value. During the early Internet era, success depended on connectivity. Companies invested heavily in network infrastructure because simply being connected to the digital world represented progress. As the Internet matured, the focus shifted from connectivity to digitalisation. Businesses began redesigning workflows, introducing enterprise systems, and integrating information across departments. Eventually, the conversation evolved once again. Data became one of the world’s most valuable business assets, forcing organisations to invest in cybersecurity, privacy, governance, and regulatory compliance. Every technological revolution introduced extraordinary opportunities, but it also demanded a new level of leadership responsibility.

Artificial Intelligence represents the next stage of this evolution. Yet many organisations continue to evaluate AI using the same performance metrics that shaped previous technology investments. Boardroom discussions are dominated by productivity, efficiency, automation, and cost reduction. These are undoubtedly important outcomes, but they are no longer the defining question of enterprise AI adoption. The organisations that will lead over the next decade will not necessarily be those that deploy AI first or purchase the largest number of AI tools. Instead, they will be the organisations that understand how AI changes the ownership of organisational knowledge and that build the governance required to manage that knowledge responsibly.

This shift requires executives to rethink AI from a leadership perspective rather than simply a technology perspective. AI is not another software application that automates repetitive tasks. Unlike traditional enterprise systems, AI interacts directly with organisational knowledge. Every prompt, document, meeting transcript, customer conversation, operating procedure, and business decision that enters an AI environment carries context about how an organisation thinks and operates. That context is becoming one of the most valuable corporate assets of the AI era. Productivity remains important, but ownership is rapidly becoming the more strategic question.

Organisations Are Measuring the Wrong Success Indicator

Most AI success stories begin with impressive productivity statistics. Marketing teams generate campaigns in minutes rather than days. Software developers accelerate coding. Customer service departments respond more quickly. Managers summarise lengthy reports within seconds. These improvements are real, measurable, and valuable. However, they represent only one side of the equation.

Every AI interaction consists of two equally important components: output and input. Organisations naturally celebrate the quality of AI-generated outputs because they are immediately visible. Far less attention is given to the organisational knowledge that makes those outputs possible. Every uploaded proposal reveals commercial thinking. Every financial spreadsheet explains business performance. Every internal procedure documents operational experience accumulated over many years. Every prompt teaches AI something about how the organisation approaches decisions, solves problems, and serves customers.

This distinction is critical because knowledge differs fundamentally from data. Data records what has happened. Knowledge explains why it happened, how decisions were made, and what should happen next. Competitive advantage has never existed solely within databases or enterprise systems. It exists inside the experience of leadership teams, the judgement of managers, the expertise of employees, and the operational methods that competitors cannot easily replicate. AI has created the first environment in which organisations voluntarily convert this knowledge into machine-readable context every single day. Consequently, the conversation should extend beyond productivity and begin examining ownership. Business leaders should ask not only whether AI is improving performance, but also how organisational knowledge is being governed, protected, and managed as AI becomes embedded within daily operations.

The New Competitive Advantage Is Organisational Intelligence

For many years, organisations described data as the “new oil.” While data remains important, I believe the next competitive advantage lies elsewhere. The true strategic asset of the AI era is organisational intelligence. Organisational intelligence is the collective understanding of how a business creates value. It includes leadership judgement, operational workflows, customer relationships, pricing philosophy, risk management, quality standards, decision-making processes, and institutional experience accumulated over time. Unlike software or hardware, organisational intelligence cannot simply be purchased. It is developed through years of learning, experimentation, and continuous improvement.

Artificial Intelligence is uniquely capable of interacting with this organisational intelligence. Modern AI systems no longer process only structured information. They interpret meeting discussions, analyse policy documents, summarise technical manuals, assist with strategic planning, and recommend business decisions. This capability creates tremendous opportunities for productivity, but it also raises an important leadership responsibility. Organisations should understand what knowledge is being shared with AI systems, which systems have access to sensitive information, how permissions are managed, and how institutional knowledge is protected throughout its lifecycle. These questions are not expressions of distrust towards technology providers. Rather, they reflect good executive governance. Responsible leadership has always required visibility into the assets that create long-term competitive advantage. AI simply expands the definition of those assets.

Ownership Requires Visibility Before It Requires Technology

Many AI discussions quickly move towards selecting platforms, comparing models, or evaluating new capabilities. While technology selection is important, ownership begins much earlier. It begins with visibility. Before organisations can govern AI effectively, they must first understand how AI is already being used across the business. In many companies, employees independently adopt different AI tools, upload documents, connect cloud services, automate workflows, or integrate external applications without any central visibility. This phenomenon is understandable because AI tools are increasingly accessible and easy to use. However, accessibility should not replace management.

Business leaders do not need to become AI engineers, but they should understand the questions that define responsible adoption. Which AI applications are officially approved? What categories of information may be uploaded? Which systems can AI access? Who authorises those permissions? What governance exists when multiple AI services interact with one another? These questions represent leadership responsibilities rather than technical responsibilities. Organisations have long established governance for finance, cybersecurity, procurement, and legal compliance. AI deserves the same level of executive attention because it increasingly influences knowledge, decisions, and operations rather than simply automating repetitive work.

Building Capability Instead of Depending Entirely on Convenience

One observation has become increasingly clear throughout my own work with organisations exploring AI transformation. Many businesses focus their attention on acquiring AI solutions, yet comparatively few invest in developing internal AI capability. Purchasing AI technology is often the fastest way to improve productivity. Building internal capability, however, provides something equally important: understanding.

This does not imply that organisations should avoid third-party AI platforms. Enterprise AI providers offer significant innovation, robust security investments, and valuable capabilities. The more important consideration is whether the organisation itself understands how AI fits within its operating model. Leadership teams should know how information flows between systems, what permissions exist, who remains accountable for AI-driven processes, and where organisational knowledge resides. Over time, I believe every medium and large organisation will develop some form of internal AI capability—not necessarily to replace external platforms, but to ensure that strategic knowledge, operational processes, and governance remain aligned with business objectives.

This is also why I believe the concept of an AI Workforce will become increasingly important. Rather than viewing AI as a collection of disconnected tools, organisations should begin viewing AI as a managed workforce operating alongside human employees. Just as every employee has defined responsibilities, reporting structures, access rights, and performance expectations, every AI capability should eventually operate within clearly defined governance boundaries.

Leadership Must Move Beyond AI Adoption Towards AI Ownership

Artificial Intelligence will undoubtedly become one of the defining technologies of our generation. Every industry will adopt it. Every profession will be influenced by it. Every organisation will discover new opportunities to automate work, improve decisions, and enhance customer experiences. Yet technology alone has never determined long-term competitive advantage. Leadership has always been the deciding factor.

The next generation of business leaders will therefore need to ask a different set of questions. Instead of asking only how AI can improve productivity, they must also ask how AI affects ownership of organisational intelligence. Instead of measuring only efficiency gains, they should evaluate governance maturity. Instead of celebrating automation alone, they should ensure visibility, accountability, and responsible management accompany every implementation. Organisations that combine innovation with disciplined governance will build greater resilience than those pursuing speed without structure.

Executive Diagnostic

Before introducing AI into more business functions, every executive team should honestly consider the following questions:

• Do we know every AI platform currently being used across our organisation?
• Have we defined what information employees may and may not upload?
• Do we understand which AI systems can access our core business applications?
• Is there a documented approval process for granting AI access to sensitive information?
• Have we identified who is accountable for AI governance at the leadership level?
• Are we treating organisational knowledge as a strategic asset rather than simply another collection of files?

If several of these questions cannot yet be answered confidently, the priority may not be adopting more AI. The priority may be establishing greater visibility into the AI that already exists.

Executive Action Plan

Over the next thirty days, leadership teams can begin strengthening AI ownership without waiting for a major transformation programme.

First, create an inventory of every AI platform currently used within the organisation. Second, classify the types of information each platform is permitted to access. Third, define approval rules for future AI integrations. Fourth, begin documenting AI-related policies and decision-making responsibilities. Finally, appoint a business leader—not only a technical leader—to oversee the organisation’s AI governance journey.

Productivity may be the most visible benefit of Artificial Intelligence, but visibility, governance, and ownership will ultimately determine whether AI becomes a sustainable competitive advantage. The organisations that thrive in the coming decade will not simply use AI more effectively than their competitors. They will understand it more deeply, govern it more responsibly, and retain ownership of the organisational intelligence that truly differentiates them.

Sometimes, we spend years searching for the right answer, only to discover that the answer was never meant to be created. It was meant to reveal itself when the mission became clear.

When people see the PDX mascot in the future, they may simply see an octopus. Some may think it looks friendly. Others may think it represents technology or artificial intelligence. Few will know that behind this little character lies years of conversations, hundreds of meetings, thousands of kilometres travelled, and one simple question that has shaped everything we do: How do we help businesses transform successfully in the digital era?

The story of our mascot did not begin with a design brief. It began with a problem. And like many meaningful discoveries, it appeared only after we stopped searching for it. Looking back today, I realise the octopus was never just a mascot. It became a reflection of what PDX had quietly evolved into—a platform built not around technology, but around people, collaboration, and a connected ecosystem. This is the story behind why an octopus became the face of PDX.

1. Seeing the Problem Beyond Technology

Long before PDX was established, I spent years meeting business owners across different industries. Every meeting sounded familiar. Companies wanted to digitalise. They wanted to embrace AI, automate operations, improve productivity, and remain competitive. Yet despite the growing number of software solutions, government initiatives, grants, and technology providers available in Malaysia, many businesses were still unsure where to begin. The challenge was never a lack of technology. Instead, it was a lack of clarity and coordination. Business owners struggled to translate operational challenges into digital requirements. Technology companies spoke in technical language that many business leaders found difficult to understand. Universities were producing graduates, but employers still complained about talent shortages. Funding opportunities existed, yet many businesses were unaware of them or lacked the confidence to apply. Every stakeholder was working hard within their own area of expertise, but they were rarely connected. The more conversations I had, the more convinced I became that Malaysia did not need another technology exhibition. What we truly needed was an ecosystem where every stakeholder could understand one another, collaborate, and move in the same direction.

2. PDX Was Never Meant to Be Just Another Event

That belief became the foundation of Penang Digitalisation and AI Conference & Exhibition (PDX). From the very beginning, my vision was never to organise the biggest conference or exhibition. Events last for a few days, but ecosystems continue growing long after the exhibition halls become empty. Every decision we made was driven by one question: “How do we create meaningful connections?” We wanted business owners to meet solution providers who genuinely understood their challenges. We wanted universities to hear directly from industries about future workforce requirements. We wanted government agencies to engage businesses beyond policy announcements. We wanted investors to discover innovation before it became mainstream. We wanted students to experience the opportunities waiting for them in the digital economy. Slowly, year after year, more organisations joined the journey. Government agencies, multinational corporations, startups, educational institutions, technology providers, investors, and industry associations all became part of something much larger than a conference. Without realising it, PDX was no longer just an annual event. It was becoming a living ecosystem where different communities could finally come together with a shared purpose.

3. Searching for a Mascot That Didn't Exist

As PDX matured, our team began discussing something many established organisations eventually consider—a mascot. It sounded simple at first. We organised brainstorming sessions, explored different concepts, and experimented with various designs. We sketched futuristic robots, AI-inspired characters, digital avatars, and technology icons. We even tried incorporating Penang's iconic blue, white, and yellow colours into the design. Every concept looked professional. Every illustration was creative. Yet every time we reviewed the proposals, something felt incomplete. None of them represented who we really were. Looking back today, I understand why. We were trying to create an identity before we had fully understood our own story. A mascot is not simply a marketing tool. It should represent a mission, a culture, and a belief that people can immediately recognise. At that stage, we were searching for a character. What we truly needed was a symbol that reflected the ecosystem we had spent years building. The answer could not be found in a design studio because it had not yet revealed itself in our journey.

4. The Conversation That Changed Everything

The breakthrough came in the most unexpected place—not during a branding workshop, but during a yacht networking session organised before PDX2026. There were no keynote speeches, presentation slides, or sales pitches. Instead, everyone simply shared their stories. Around the table were business strategists, AI educators, cybersecurity experts, software developers, infrastructure providers, investors, government representatives, university leaders, and entrepreneurs. Each person spoke passionately about the role they played in helping businesses succeed. As I listened carefully, I stopped seeing individual organisations. I began seeing an interconnected ecosystem. Every participant represented a different capability, yet none could create meaningful digital transformation alone. Strategy required execution. Technology required talent. Talent required education. Innovation required investment. Infrastructure enabled everything else. Government created the environment for progress. One conversation naturally connected to another, and another after that. It was one of those rare moments where the entire vision of PDX became visible—not on a presentation screen, but through the people sitting around the table.

5. The Moment I Looked at the Octopus Differently

As the evening continued, my eyes rested on a small orange octopus sitting quietly on the yacht. Until that moment, it had simply been a decorative toy. Then something unexpected happened. I no longer saw a toy—I saw the ecosystem sitting right in front of me. The brain represented strategy and leadership, providing direction for transformation. Every tentacle represented a specialised capability, from AI and cybersecurity to software development, cloud infrastructure, automation, and digital consulting. The nervous system reminded me of education and talent development, ensuring knowledge reached every part of the ecosystem. The flow of nutrients throughout the octopus symbolised funding and investment, sustaining innovation and growth. Each arm could perform independently, yet every movement remained coordinated because they were connected to the same central purpose. Suddenly everything made sense. We had spent two years searching for a mascot when, in reality, our ecosystem had quietly created one for us. The octopus was not chosen because it looked memorable. It was chosen because it perfectly represented what PDX had become.

6. The Real Meaning Behind the PDX Octopus

Today, the octopus represents far more than branding. It symbolises intelligence, adaptability, collaboration, and resilience—qualities that every organisation needs in an AI-driven economy. More importantly, it reminds us that successful digital transformation is never achieved by one company alone. No software provider can transform an organisation without leadership commitment. No consultant can succeed without technology partners. No AI solution creates value without skilled people. No innovation scales without investment, infrastructure, and policy support. Every stakeholder matters. Every contribution matters. The role of PDX has never been to become the centre of attention. Instead, our mission is to become the platform that connects every stakeholder so they can create greater value together. When businesses stop viewing digital transformation as a technology purchase and start seeing it as an ecosystem, their chances of success increase dramatically. That philosophy is what the octopus now represents.

7. A Mascot That Will Continue to Grow With the Ecosystem

People have asked me what the PDX octopus will look like in the years ahead. My honest answer is that I don't know—and that uncertainty excites me. Perhaps it will evolve into different characters. Perhaps it will inspire educational programmes for students. Perhaps it will become recognised across Malaysia as a symbol of collaboration in the digital economy. Whatever form it takes, one thing will never change. It will always represent the belief that transformation happens when people work together rather than apart. Every exhibitor, every speaker, every student, every policymaker, every investor, and every entrepreneur who joins PDX becomes another connection within this ecosystem. The mascot will continue growing because the community behind it continues growing. Its story is still being written, and every new partnership adds another chapter to that story.

8. Building the Next Chapter Together

When I reflect on the journey of PDX, I realise that the greatest achievement was never organising a successful event or introducing a mascot. The greatest achievement has been bringing together people who genuinely believe Malaysia can build a stronger, smarter, and more connected digital future. The octopus simply reminds us of that responsibility. As AI reshapes industries and digital transformation accelerates, businesses can no longer afford to navigate the journey alone. They need a clear roadmap, trusted partners, practical strategies, and an ecosystem that supports long-term growth. That has always been the mission of PDX, and it continues to be my personal mission as well.

Your Digital Transformation Journey Starts With the Right Roadmap

If your organisation is exploring digital transformation, AI adoption, automation, or long-term technology strategy, don't start by asking “What software should we buy?” Start by asking “What roadmap do we need?”

Technology is only one part of the equation. Success comes from aligning leadership, people, processes, funding, talent, and the right implementation partners into a single, practical strategy.

If you are ready to build a digital roadmap tailored to your organisation, I would be delighted to have that conversation.

Let's build your digital future—together.

Lukas J. Tan
Digital Transformation Strategist | AI Advisor | Founder, PDX
Digital Roadmap Consulting • AI Strategy • Ecosystem Development

This case study is based on an actual digital transformation project undertaken during the COVID-19 Movement Control Order (MCO). To protect the confidentiality of the client, the company's identity and certain operational details have been anonymised. However, the business challenges, transformation approach and outcomes presented in this article accurately reflect the project.

Case Background

Industry: Retail Business
Business Size: 20 retail branches across Malaysia
Workforce: Approximately 200 employees
Project Type: Enterprise Digital Transformation & Business Process Redesign

The client is an established retail business operating approximately 20 branches with a workforce of around 200 employees. As the organisation expanded, managing information across multiple branches became increasingly difficult. Critical business operations still relied heavily on Microsoft Excel and manual processes, resulting in inconsistent data, duplicated work, limited visibility and weak permission control. Although the company had already invested nearly a year developing a custom business system, the project had reached a point where continuous modifications were creating more operational issues than solutions.

This article shares how we approached the project—not by fixing the software first, but by redesigning the organisation behind it. It also explains why I believe Digital Transformation must always come before Artificial Intelligence, because AI is only as good as the business processes and data that support it.

The Wake-Up Call During MCO

The COVID-19 pandemic changed the way businesses operated almost overnight. During the Movement Control Order (MCO), many companies suddenly realised that the systems and processes they had relied on for years were no longer sufficient. One particular client approached us during this challenging period with a problem that, on the surface, sounded very familiar. They were still managing critical business operations using Microsoft Excel. As the company expanded, multiple employees were editing the same files, data was constantly being overwritten, and management had no confidence that the reports they were looking at were accurate. More importantly, there was no proper permission control. Anyone with access could modify information, whether intentionally or accidentally. The management team knew they needed to digitalise, but what they believed they needed was simply a software system. What they actually needed was something much bigger.

A Year Spent Building, But Not Progressing

For various reasons, the company eventually engaged another software developer instead of working with us. Over the next twelve months, the system went through countless revisions. Every few weeks there was another meeting, another change request, another bug to fix, and another feature to modify. Unfortunately, the project slowly entered a cycle that many business owners know all too well. Every time one problem was solved, another appeared somewhere else. New features could not be introduced because the development team was constantly repairing existing functions. Users became frustrated because familiar processes kept changing, while management began losing confidence in the project altogether. After nearly a year of investment, both financially and emotionally, they were still nowhere close to having the stable business system they had originally envisioned. That was when they returned and asked if we could help.

I Didn't Start by Looking at Their System

When I first met the management team again, they expected me to review the software, analyse the database, or identify the technical problems that had accumulated over the previous year. Instead, I did something that surprised everyone in the room. I barely looked at the system at all. After nearly twenty years of building enterprise software, I have learned that software is rarely the real problem. A poorly performing system is often nothing more than a reflection of a poorly structured organisation. If the business itself lacks clarity, no amount of programming can compensate for that confusion. Rather than spending days trying to understand thousands of lines of source code or documenting every existing screen, I decided to start from the very top. Before discussing technology, I wanted to understand the business.

The First Question Was About People, Not Technology

The very first document I asked the CEO to show me was not a system manual or a workflow diagram. It was the organisation chart. I wanted to understand how the company was structured before understanding how the software had been designed. Looking at the organisation chart, I asked three simple questions for every department. How many people work here? Does this department generate revenue, or is it a support function? What is its primary responsibility? These questions may sound basic, but they immediately exposed issues that had never been discussed during software development. Several departments had overlapping responsibilities. Some approval processes existed simply because they had always existed. Certain teams were overloaded while others had unclear ownership. Before redesigning technology, we first needed to redesign organisational clarity.

Understanding the Business Before Designing the System

Once the organisational structure became clear, I asked the management team to explain something even more important. I didn't ask how every individual screen should work, nor did I request every operational detail. Instead, I asked them to walk me through the complete customer journey. How does a customer first hear about your business? What happens after they make an enquiry? How are quotations prepared? How are orders confirmed? What happens during production, delivery, invoicing and after-sales support? By understanding the entire business lifecycle, we could identify how information should naturally flow throughout the organisation. Only after understanding the business model did we begin discussing software. Technology should always support business operations, never dictate them.

Digital Transformation Is Not About Digitising Existing Problems

One of the biggest misconceptions surrounding digital transformation is that businesses believe success comes from converting manual paperwork into digital forms. In reality, that approach simply transforms inefficient manual processes into inefficient digital processes. If an organisation has unnecessary approvals, duplicated work, poor communication between departments and inconsistent ownership, software will only make those weaknesses more visible. Digital transformation is not about replicating yesterday's workflow on a computer. It is about questioning every process, eliminating unnecessary steps, simplifying communication and redesigning how the organisation operates. Only then should technology be introduced to automate and support those newly designed processes. Software should never preserve inefficiency; it should eliminate it.

Building a Business System Instead of Just Another Software Application

One aspect of this project that I truly appreciated was the trust given to our team. After we completed our analysis and proposed a new operational framework, the client allowed us to redesign the system based on business objectives instead of individual preferences. They did not interfere with every button, every screen or every workflow. Instead, they judged us based on one simple expectation: when the system is delivered, it must work. It must be intuitive for employees to use, easy for new staff to learn, and capable of providing management with accurate, real-time information. Every department would have its own permission controls, ensuring that employees only accessed information relevant to their responsibilities. Data would move seamlessly from one department to another without repeated manual entry, while every enquiry, customer case and business transaction could be monitored through dedicated operational dashboards. The goal was never to create beautiful software. The goal was to create a business that operated more effectively.

The Real Transformation Happened Inside the Organisation

When the project was completed, the biggest success was not the software itself. The greatest transformation occurred within the organisation. Departments began communicating more effectively because everyone was following the same workflow. Information no longer disappeared inside spreadsheets stored on individual computers. Management gained complete visibility into every stage of the business instead of relying on fragmented reports prepared manually by different teams. Employees spent less time searching for information and more time serving customers. Permission control reduced unnecessary risks, while structured processes improved accountability across the organisation. The company did not simply receive a new system. They gained an entirely new way of operating, where decisions were based on reliable information rather than assumptions.

Before Artificial Intelligence Comes Digital Transformation

Today, almost every boardroom conversation revolves around Artificial Intelligence. Organisations are eager to adopt AI assistants, intelligent automation and predictive analytics. Yet one important question is often overlooked: is the organisation actually ready for AI? Artificial Intelligence does not magically fix poor business processes, inconsistent data or fragmented operations. AI simply consumes whatever data an organisation provides. If the underlying data is incomplete, duplicated or inaccurate, AI will only produce faster and more convincing mistakes.

This is why I often remind business leaders that Digital Transformation is not an optional step before AI—it is the foundation upon which every successful AI initiative is built.

Digital Transformation creates structured business processes. Structured business processes generate reliable and consistent data. Reliable data empowers trustworthy Artificial Intelligence. Skip the first two steps, and AI simply becomes another expensive technology layered on top of organisational chaos.

Many organisations today are rushing to purchase AI tools before asking whether their own operations are ready. They hope AI will solve problems that actually originated from years of inconsistent processes, disconnected systems and poor operational governance. Unfortunately, AI cannot create operational discipline. It can only amplify whatever already exists. If your business operates with clarity, AI accelerates performance. If your business operates in confusion, AI accelerates confusion.

That is why I always tell business leaders during my keynote presentations that AI is not the starting point of transformation. Digital Transformation is.

A Leadership Lesson Beyond Technology

Looking back, this project reinforced something I have believed throughout my career. Technology has never been the hardest part of Digital Transformation. People often assume software development is about coding, databases and programming languages. In reality, the most difficult challenge is helping organisations rethink the way they operate.

Every company already has a workflow. Every company already has departments. Every company already has reporting structures. The question is whether those structures are still suitable for today's business environment.

Digital Transformation is not an IT initiative. It is a leadership initiative. It requires management to rethink responsibilities, decision-making, accountability and information flow before technology can truly deliver value. When leaders embrace this mindset, software becomes an enabler instead of a burden.

A Message to Business Leaders

If your organisation is constantly modifying its system but never seems to make real progress, perhaps the problem isn't your software vendor. If your employees continue relying on spreadsheets despite having an expensive system, perhaps the issue isn't user adoption. If every department keeps asking for new features while management still cannot obtain accurate information, perhaps the real challenge lies much deeper than technology.

Before introducing AI into your organisation, ask yourself a simple question: is your digital foundation strong enough to support it?

AI is only as intelligent as the data it receives. Data is only as reliable as the processes that generate it. And those processes are only as effective as the leadership that designs them. If the foundation is weak, AI will only make poor decisions faster. If the foundation is strong, AI becomes one of the most powerful business accelerators your organisation will ever adopt.

Over the past two decades, I have worked with organisations not just to build software, but to redesign how businesses operate. Sometimes that means stepping into projects that others could not complete. Sometimes it means rebuilding the architecture from the ground up. Much like an intensive care unit (ICU), our role is to stabilise critical digital transformation projects before they fail completely, allowing organisations to recover, modernise and prepare for the future.

If your organisation is facing endless software revisions, disconnected systems, poor data quality, weak permission controls or operational processes that no longer scale with your business, let's have a conversation. Whether through executive advisory, Digital Transformation consulting or one of my keynote sessions, my mission remains the same: to help organisations build the right digital foundation today, so they are truly ready for the AI-powered future tomorrow.

After using AI intensively over the past few weeks, I realised something interesting. My way of working has completely changed.

In the past, I spent almost the entire day operating my computer—writing, editing, checking, and executing every task myself. Today, my computer is running multiple AI agents at the same time. One is writing, another is researching, another is designing, while another is analysing data. My role is no longer to do everything manually.

Instead, I wait for the first draft. I review it, make adjustments, approve it, and let AI continue improving. My value has shifted from execution to judgment. The keyboard is no longer where I spend most of my time—my thinking is.

What the Waiting Moments Became

What surprised me most was what happened during those waiting moments. Instead of rushing to the next task, I found myself picking up a book, enjoying a coffee, or simply thinking about bigger ideas. It feels like a break, but in reality, it’s becoming some of my most productive time.

The Better Question

People often ask me whether AI will take away our jobs. I think a better question is this: When AI gives us back time, what will we do with it? Will we spend it scrolling through social media, or will we invest it in learning, reading, thinking, and becoming better leaders?

For me, that’s the real promise of AI. It isn’t replacing people—it is giving us the opportunity to focus on the things that only people can do: think deeply, make better decisions, and create a greater impact.

How has AI changed the way you spend your time? Has it made you busier, or has it given you back time to learn and think? I’d love to hear your experience in the comments.

Over the past two weeks, one of the biggest lessons I learned wasn’t about AI itself. It was about myself. For most of my career, I’ve been someone who is very detail-oriented. I like to understand every process, every implementation, and every small step before moving forward. That mindset has helped me build businesses over the years.

But recently, I found myself working differently. Instead of spending hours thinking about every detail, I began focusing on the outcome I wanted to achieve. I realised that AI is often capable of handling the detailed execution faster, more consistently, and sometimes even better than I could. It challenged a habit that I had built over many years.

Details Still Matter — But Who Handles Them Changes

This doesn’t mean details are no longer important. Details still matter. The difference is who should spend more time on them. As leaders, perhaps our greatest value is no longer doing every detail ourselves, but ensuring the direction is correct, the objectives are clear, and the instructions are precise. AI can help execute, but it still depends on us to define the destination.

Leadership Is About the Right Work, Not the Most Work

It reminded me that leadership has never been about doing the most work. Leadership is about helping people—or now, even AI—do the right work. The clearer our thinking, the better the execution becomes. I’ve started spending more time asking “What problem are we trying to solve?” rather than “How do I complete every individual task?”

I’m still learning every day, and I’m sure my thinking will continue to evolve. But this has probably been my biggest personal takeaway so far. AI isn’t replacing our thinking. It is pushing us to think at a higher level, focusing more on strategy, judgment, and leadership than ever before.

I’d love to hear your experience too. Has AI changed the way you work, lead, or make decisions? What’s the biggest mindset shift you’ve experienced? Let’s learn from one another, because I believe we’re all still discovering what leadership looks like in the AI era.

People often ask me why I started the Penang Digitalisation & AI Conference & Exhibition (PDX). Some assume it was because I wanted to organise a conference or create another technology event. The truth is much deeper than that. PDX was never about organising an event—it was about solving a problem that I had observed for many years.

Throughout my journey with OPERiON, I had the opportunity to work with organisations across different industries. I realised that government agencies, businesses, technology providers, universities and talented individuals were all working towards the same goal of driving innovation and economic growth. However, they were often working independently, with limited opportunities to connect, collaborate and create meaningful impact together.

I came to believe that digital transformation is not simply about adopting new technologies. It is about bringing people together, redesigning the way organisations operate, and building stronger partnerships across the entire ecosystem. Technology is only an enabler. Real transformation happens when people share knowledge, trust one another and work towards a common vision.

The Future Belongs to Ecosystems, Not Individuals

As artificial intelligence continues to reshape every industry, the importance of collaboration has become even greater. No single organisation can prepare for the future alone. Governments need industry. Businesses need technology partners. Universities need closer connections with employers. Students need opportunities to learn from real-world experiences. The future belongs to ecosystems, not individuals.

That belief became the foundation of PDX. My vision was to create a platform where government, industry leaders, technology providers, universities, startups and future talent could come together under one roof. A place where ideas become collaborations, collaborations become opportunities, and opportunities become lasting impact for our communities and economy.

Every Obstacle Became Part of the Journey

The journey has not been easy. Building an ecosystem is far more challenging than building a company. There have been countless challenges, financial pressures, setbacks and moments of uncertainty. Yet every obstacle has reinforced one important lesson: if the mission is meaningful and benefits others, every challenge becomes part of the journey rather than the reason to stop.

Today, PDX represents much more than an annual conference and exhibition. It is a growing movement to accelerate digital transformation, encourage responsible AI adoption, develop future-ready talent and strengthen collaboration between the public and private sectors. It is a platform designed to help organisations learn, connect and move forward together.

Looking Ahead

Looking ahead, my vision extends far beyond the next event. I hope to see PDX become a leading AI and digital ecosystem that starts in Penang and creates impact across Malaysia and the region. Through initiatives such as AI Hackathons, leadership forums, talent development programmes and industry collaborations, we can build a stronger future together. If you share this vision, I warmly invite you to join us on this journey by following PDX2027, participating as an exhibitor, partner or delegate, and becoming part of an ecosystem that believes innovation grows stronger when we build it together.

Think Bold. Build Together. Transform the Future.

Follow PDX

🌐 Website: penangdigitalisation.com

📢 Follow the PDX social media channels for the latest updates on exhibitions, conferences, partnerships, AI programmes and exhibitor opportunities.

We look forward to welcoming you to the PDX ecosystem.

By Ts. Lukas J. Tan

For the past two decades, businesses have invested heavily in Search Engine Optimisation (SEO). We optimised keywords, built backlinks, improved page speed, and published articles to rank higher on Google. Those strategies are still important, but while building my own AI workforce recently, I realised something that completely changed my perspective. The next generation of websites won’t compete only for search rankings—they’ll compete to be understood by AI.

One unexpected lesson came from something developers have quietly used for years: Markdown (.md). I wasn’t trying to learn Markdown. I discovered it while building AI-powered systems with Claude. At first, I wondered why almost every document was stored as a Markdown file instead of Microsoft Word or plain text. Then it clicked. Markdown isn’t just a writing format; it’s a structured way of organising knowledge. AI doesn’t care about beautiful layouts or animations. It understands hierarchy, relationships, context, and clearly organised information. The better your knowledge is structured, the easier it is for AI to understand your business.

This made me rethink how we build websites. Traditionally, we start by designing pages—Home, About Us, Services, Contact. Today, I believe we should start by designing knowledge. Most websites, especially traditional CMS platforms, were built primarily for humans to read and search engines to crawl. They can absolutely be made AI-friendly, but many organisations still organise content page by page rather than as a connected body of knowledge. With AI-assisted development, I now find myself creating structured knowledge first, then letting AI generate the website, proposals, profiles, and other business assets from that single source. The website becomes one output—not the starting point.

From SEO to GEO and AEO

I believe we are entering the next phase of digital transformation. In the past, we optimised for SEO. Today, conversations are shifting toward Generative Engine Optimisation (GEO), Answer Engine Optimisation (AEO), and other AI-focused approaches. Whatever terminology eventually becomes the standard, the direction is clear: organisations need websites that communicate expertise in a way AI systems can understand, not just pages that look attractive to people.

One Knowledge Base, Every Output

The organisations that adapt early will gain a significant competitive advantage. Imagine maintaining one trusted knowledge base that powers your website, LinkedIn articles, keynote profiles, proposals, sales materials, training content, and even your internal AI workforce. Instead of rewriting the same information across different platforms, AI understands your knowledge once and helps you publish it consistently everywhere. That changes not only how we build websites, but how we manage knowledge across an entire organisation.

I am still researching and learning in this space, but one thing is becoming increasingly clear. The last 20 years were about building beautiful websites. The next 20 years may be about building websites that AI can understand. The question is no longer, “Does your website rank on Google?” The better question is, “Can AI understand your business well enough to recommend it?” Those who begin restructuring their websites into AI-ready knowledge platforms today may be the ones who remain visible, trusted, and discoverable in tomorrow’s AI-first world.

People often ask me what framework I use or which technology I recommend. The truth is, I have never been someone who learns technology by memorising names or following trends. I learn by solving real business problems. Many years ago, I built a UI component system that made my projects more consistent and easier to maintain. Years later, someone looked at my code and said, “This is basically Bootstrap.” I smiled because, at the time, I had never even thought about Bootstrap. I wasn't trying to use a framework — I was simply trying to solve a problem.

The same thing happened again around 2009. As my projects became larger, I realised I needed a better way to control code quality. I designed my own PHP project structure so developers could only access the folders they were supposed to access. Business logic, presentation, and data were separated to make maintenance easier and reduce mistakes. Years later, I discovered that what I had built followed the same philosophy as the Model-View-Presenter (MVP) pattern. I didn't set out to implement MVP. I was simply designing a better way to build software.

The Problem Comes First, the Name Comes Later

Looking back, I realised this has always been my approach. I rarely start with a technology or a framework. I start with the problem. Once I understand the problem deeply, I build the architecture that solves it. Sometimes the industry already has a name for it. Sometimes it becomes a recognised design pattern. Either way, the name has never been the goal. The solution has always been the goal.

Why the Database Comes First

If there is one area I have always believed deserves the most attention, it is the database. Frameworks change. Programming languages evolve. AI models improve every few months. Cloud platforms come and go. But your data remains. A poorly designed database will create problems for years, no matter how modern the technology stack is. A well-designed database, on the other hand, allows applications, frameworks, and even entire platforms to evolve without disrupting the business. To me, the database is not just another component — it is the foundation of the organisation's digital assets.

That is why, throughout my career, I have invested more time in database architecture than in chasing the latest technology trends. Naming standards, relationships, primary keys, audit trails, migrations, scalability, and future-proof design are not glamorous topics, but they are the reason software survives. If people remember me for one thing, I hope it is this: build the database right, and everything else becomes easier.

If your organisation is facing challenges in database architecture, system design, digital transformation, or AI-ready application architecture, I would be glad to have a conversation. The right database design doesn't just solve today's problems — it creates the foundation for the next decade of growth.

By Ts. Lukas J. Tan — Founder of ScamAlert Junior™ | CEO of OPERiON | AI & Digitalisation Strategist

Over the past few years, I have had the opportunity to work closely with businesses, schools, government agencies, technology professionals, educators, and parents through various digitalisation, artificial intelligence, and cybersecurity initiatives. While every organisation has different priorities, one concern has become increasingly common — the digital world is evolving much faster than our ability to prepare people for it. Cybersecurity is no longer a topic reserved for IT departments or large corporations. It has become a life skill that affects every individual, regardless of age.

As technology becomes more accessible, children are also entering the digital world earlier than any previous generation. They learn through smartphones, communicate through messaging platforms, play games online, and increasingly interact with artificial intelligence without fully understanding the risks that may exist behind every screen. This observation led me to a simple but important question: are we preparing our children early enough to navigate the digital world safely? That question eventually became the starting point of ScamAlert Junior™, an educational intellectual property created to help children develop critical thinking, responsible digital habits, and the confidence to make better decisions before they encounter online threats.

The Digital Childhood Has Changed

Childhood today looks very different from what many parents experienced growing up. Previous generations spent most of their free time outdoors, interacting face-to-face with friends, reading physical books, or learning through direct conversations with teachers and family members. Today's children, however, are growing up in an environment where digital technology is seamlessly integrated into almost every aspect of daily life. Smartphones, tablets, online classrooms, social media platforms, streaming services, artificial intelligence, and multiplayer games have become part of their normal routine from a very young age.

While these technologies provide incredible opportunities for education, creativity, and communication, they also introduce new challenges that many children are not yet equipped to recognise. Fake online identities, phishing attempts, scam advertisements, misleading information, cyberbullying, and AI-generated content are becoming increasingly sophisticated. Children are naturally curious, trusting, and eager to explore new experiences — qualities that make them wonderful learners but can also make them more vulnerable in digital environments.

The digital world itself is not the problem. Technology is one of the greatest tools humanity has ever created, opening doors to knowledge and opportunities that previous generations could only imagine. The real challenge lies in ensuring that children develop the judgement, awareness, and critical thinking needed to use these technologies responsibly. Just as we teach children how to cross a busy road safely, we must also prepare them to navigate the digital world with confidence rather than fear.

Why Traditional Scam Awareness Is No Longer Enough

For many years, scam awareness campaigns were designed primarily for adults. The focus was often on financial fraud, investment scams, phishing emails, or identity theft targeting working professionals and senior citizens. Children were rarely considered part of the conversation because they were perceived as having limited financial resources and relatively little online independence. That assumption is changing rapidly.

Today, children are exposed to online interactions much earlier than before. They receive messages from strangers while gaming, watch influencer content across multiple platforms, click advertisements without understanding their intent, and sometimes unknowingly share personal information through quizzes, apps, or social media. Modern scams are no longer limited to stealing money. They can involve manipulation, deception, emotional exploitation, identity misuse, or attempts to build trust before targeting other members of a family.

This means digital safety education cannot begin only after an incident has occurred. Waiting until a child becomes a victim is similar to teaching road safety only after a traffic accident. Prevention has always been more effective than recovery. Instead of relying solely on warnings such as “don't click suspicious links” or “don't talk to strangers online,” we need to help children understand why certain situations are dangerous and how to think critically before making decisions.

The future of scam awareness should not be built upon fear alone. It should be built upon knowledge, observation, curiosity, communication, and responsible decision-making. These are skills that children can continue applying throughout their lives as technology continues to evolve.

Why Stories Can Teach Better Than Lectures

Throughout history, stories have always been one of the most effective ways to teach values, wisdom, and life lessons. Long before classrooms, textbooks, or digital learning platforms existed, knowledge was passed from one generation to another through stories that people could remember, relate to, and share. While technology has changed dramatically, the way children learn has remained surprisingly consistent. They still remember characters long after they forget instructions. They remember emotions more easily than statistics. They remember meaningful experiences more than lengthy explanations.

This understanding became one of the foundations behind ScamAlert Junior™. Rather than producing another educational handbook filled with warnings and technical terminology, I wanted to create characters that children could genuinely connect with. Characters like Lukas, Leo, Lynn, Turbo, Johan, Lina, and Atuk Hassan each represent different personalities, perspectives, and life experiences. Through their adventures, mistakes, discussions, and teamwork, children are encouraged to observe carefully, ask questions, verify information, and think before acting.

Storytelling transforms learning into an enjoyable experience rather than a compulsory lesson. Instead of telling children what they should or should not do, stories allow them to explore situations alongside familiar characters, developing their own understanding through observation and discussion. When learning becomes emotionally engaging, the lessons often remain with children far beyond the final page of a book.

Building More Than Just a Comic

Many people who first hear about ScamAlert Junior™ naturally assume it is simply another children's comic book. While storytelling remains an important part of the project, the comic itself represents only one component of a much larger educational vision. From the beginning, my objective was never limited to publishing a series of books. I wanted to create an educational intellectual property that could continue supporting children across different learning environments for many years to come.

Behind every official character sits a comprehensive Character Asset Library that defines visual identity, personality, behaviour, educational purpose, communication style, expressions, poses, costumes, colours, and commercial guidelines. This ensures consistency regardless of whether the characters appear in books, classroom activities, animations, mobile applications, educational games, public awareness campaigns, or licensed merchandise. Every future adaptation remains aligned with the same educational philosophy and values.

Beyond the characters themselves, the ecosystem is designed to expand into activity books, teacher resources, parent guides, workshops, digital learning materials, exhibitions, community programmes, and future educational technologies. Each component shares the same mission: helping children become thoughtful, responsible, and confident digital citizens through engaging and practical learning experiences.

Building an educational intellectual property requires thinking beyond today's publication. It requires creating a foundation that remains relevant as new technologies, new challenges, and new generations emerge.

Looking Towards the Future

Artificial intelligence will continue advancing. Digital platforms will become even more sophisticated. Online scams will undoubtedly evolve in ways we cannot yet fully predict. While technology changes rapidly, the qualities that protect people often remain timeless. Critical thinking, empathy, responsibility, curiosity, integrity, and good judgement have always been valuable, regardless of the tools people use.

This is ultimately what ScamAlert Junior™ hopes to contribute. The project is not about creating fear of technology or encouraging children to avoid digital innovation. On the contrary, it is about helping young learners embrace technology with confidence while understanding the importance of thinking before acting, verifying information before believing it, and seeking guidance whenever uncertainty arises.

I also believe protecting children online should never be the responsibility of schools alone. Parents, teachers, communities, government agencies, technology companies, and industry leaders all have an important role to play in shaping the next generation of responsible digital citizens. Education becomes most effective when these groups work together towards a common purpose.

ScamAlert Junior™ was created with that long-term vision in mind. It is more than a comic, more than a collection of characters, and more than an educational campaign. It is a commitment to helping children build the confidence, judgement, and values they will need not only to recognise scams, but to navigate an increasingly digital world with wisdom, responsibility, and hope.

At a PDX2026 speaker briefing last year, a manufacturing CEO told me his company had just rolled out an AI forecasting tool that nobody on the floor was using. The tool wasn’t broken. Nobody had told the planning team which decision it was supposed to change. Six months and a licence fee later, the spreadsheets were still running the floor, and the AI dashboard sat open in a browser tab nobody clicked.

I hear a version of this story at almost every PDX prep call. The technology works. The leadership around it doesn’t move fast enough to point it at anything.

Three Things I Keep Seeing

The tool arrives before the decision does

Someone in IT or ops champions a good tool. It gets bought, piloted, even praised in a town hall. But nobody has decided what will change because of it — which report stops being manually built, which meeting gets shorter, which approval gets skipped. Without that, the tool becomes a second system running next to the old one, not a replacement for it.

Nobody owns the follow-through

A pilot has a project owner. Adoption rarely does. Once the vendor demo is over and the case study photo is taken, the person accountable for whether staff actually change their daily habits is often nobody in particular — which means, in practice, nobody.

Middle management absorbs a leadership problem

When adoption stalls, the story that gets told is usually “our people resisted change.” In my experience it’s rarely resistance. It’s that middle managers were handed a new tool and the same old targets, with no time carved out to actually redesign how the work gets done. They didn’t reject the technology. Nobody gave them room to use it.

A Test Before Your Next AI Pilot

Before signing off on another tool, I ask leadership teams three questions. If they can’t answer all three in one sentence each, the pilot is not ready to launch:

• What specific decision or task does this replace, not just support?
• Who is personally accountable for adoption twelve weeks after go-live?
• What will we stop doing to make room for this?

If the answer to the third question is “nothing”, you’ve just bought a second job for your team, not a productivity gain.

FAQ

Will AI actually take my team’s jobs?

Rarely in one clean step. What I see far more often is a role quietly becoming unnecessary over 12–18 months because leadership never redesigned the workflow around the new tool — the job doesn’t disappear so much as the company falls behind competitors who did the redesign.

What should a leader do differently this quarter?

Pick one AI tool already sitting half-used in your organisation and answer the three-question test above for it. Fix the adoption gap before buying anything new.

Is this really a leadership problem, not an IT problem?

If your IT team can point to a tool that’s live but nobody outside IT can point to a decision it changed, it’s a leadership problem wearing an IT costume.

The Short Version

The real risk was never that AI replaces people. It’s that leaders who can’t make a fast, specific decision about how work should change get quietly outpaced by leaders who can — using the exact same tools.

Running PDX means I get a year-on-year read on what Malaysian business leaders are actually worried about, not what a survey says they should be worried about. Between PDX2025 and PDX2026, the conversations in the delegate lounge changed in a way I didn’t expect.

Three Signals From the Delegate Floor

Signal 1: Fewer people ask “what is AI”

At PDX2025, a good third of conversations were still explaining basic concepts. At PDX2026, almost nobody asked that. The question had shifted to “who else in my industry has already deployed this, and what did it cost them to get it wrong?”

Signal 2: Vendors are being asked harder questions

Exhibition-floor conversations got sharper. Procurement teams showed up with checklists instead of curiosity — asking about integration with legacy ERP systems, not just feature lists. That’s a sign the buying committee has matured past the pilot-project stage.

Signal 3: The window to catch up is visibly shrinking

A supply-chain director told me flatly that two of his competitors had already renegotiated supplier contracts around real-time data sharing. His company hadn’t started. He wasn’t worried about being behind — he was worried about being unable to catch up before contracts renewed.

Where the Smart Companies Are Actually Positioning

The organisations that stood out to me this year weren’t the ones with the biggest AI budget. They were the ones who could describe, specifically, which of their existing workflows would be redesigned in the next two quarters — and who owned that redesign. Everyone else was still in “exploring options” mode, which is a polite way of saying nothing has actually changed yet.

A Question Worth Sitting With

If a competitor called your best customer tomorrow and said “we can already do that, in real time, at lower cost” — would your team know within the hour, or find out at contract renewal?

Where This Goes Next

This is exactly the gap we built PDX2026 around: not another round of AI explainers, but a room where the people already three steps ahead sit next to the people who need to move. If you want to see where Malaysia’s next phase of digital transformation is actually heading, that’s the conversation happening on the PDX floor, not in a webinar.

A few years ago, an OPERiON client — a mid-sized distributor — asked us to help fix a warehouse system their internal team had spent eight months building. It didn’t talk to their accounting software, couldn’t handle their busiest month of the year, and had already cost more than three off-the-shelf platforms combined. The build itself wasn’t incompetent. Nobody on the team had simply been given time to look outside the building before starting.

The Situation

Their internal IT lead was smart and had built useful tools before. But he was solving the problem with the only reference points he had: what the company had done in the past, and what he personally already knew how to build. Three competitors, we later found out, were already running a widely-used regional platform for the exact same workflow — at a fraction of the cost and time.

The Insight

Internal teams aren’t under-skilled. They’re under-exposed. A good engineer who has only ever seen one company’s way of solving a problem will build a solution shaped by that one company’s history, not by what the wider industry has already learned the hard way. That’s not a competence gap. It’s a visibility gap, and no amount of internal effort closes it, because the information simply isn’t inside the building.

What Changed

We didn’t replace their team. We changed the first step: before building anything, spend two weeks mapping what already exists in the market and who in their own supplier or partner network had solved something adjacent. That single habit — look outward before building inward — turned their next three projects from eight-month builds into six-week integrations.

Why This Keeps Happening

Vendor dependency gets a bad reputation, so companies overcorrect into “we’ll build it ourselves to stay independent.” But independence built on outdated information isn’t independence — it’s isolation with extra steps. The companies actually winning right now aren’t the most self-reliant. They’re the ones with the widest, fastest-moving network of outside insight feeding into decisions made inside.

A Question for Your Next Project

Before your team writes a single line of code or signs off on a build, can anyone in the room name two ways competitors or peers have already solved an adjacent problem? If not, you’re not being independent. You’re building blind.

Artificial intelligence is not reducing the importance of humans—it is redefining the value humans are expected to create.

Technology Has Entered a New Era

For almost two decades, I have worked in software development, digital transformation, and technology consulting. During most of that time, technical expertise was one of the strongest competitive advantages a professional could possess. The more programming languages you mastered, the more systems you built, and the more technical problems you solved, the more valuable you became to an organisation. Today, that equation is changing rapidly. Artificial intelligence is transforming the way software is written, analysed, tested, and maintained. Tasks that once demanded years of experience can now be accelerated within minutes using AI-assisted development tools. This is not a temporary trend or another technology cycle. It represents a structural shift in how knowledge work is performed. While many discussions continue to focus on whether AI will replace jobs, I believe the more important question is whether professionals are prepared to redefine the value they bring. Technology is evolving faster than many careers, and those who continue relying only on traditional technical skills may soon discover that technical execution alone is no longer enough.

AI Is Replacing Tasks Before It Replaces Professions

There is a common misconception that artificial intelligence will suddenly replace entire professions. In reality, AI is replacing individual tasks long before it replaces complete roles. Software developers can now generate code, automate documentation, identify programming errors, create user interfaces, and even suggest software architecture within minutes. Accountants can automate reconciliations. Designers can generate visual concepts almost instantly. Lawyers can summarise contracts with remarkable speed. These capabilities do not eliminate professionals overnight, but they significantly reduce the time required to complete routine work. As a result, organisations begin asking a different question. Instead of evaluating employees based on how efficiently they complete repetitive tasks, they increasingly evaluate them based on how well they solve business problems, make decisions, communicate across teams, and improve organisational performance. The value of execution is gradually shifting towards the value of thinking. Those who recognise this transition early will position themselves for future growth, while those who continue competing only on technical execution may find themselves competing directly against AI.

Technical Skills Will Remain Important—but They Are No Longer Enough

Some people interpret discussions about AI as suggesting that technical knowledge is becoming irrelevant. I disagree completely. Programming, engineering, cybersecurity, software architecture, and systems integration remain essential disciplines. However, technical capability is becoming the starting point rather than the destination. Future technology professionals must also understand business operations, organisational behaviour, customer expectations, process optimisation, and strategic objectives. Throughout my career, I have discovered that many software projects fail not because programmers cannot write code, but because business requirements are misunderstood, communication breaks down, or the organisation has never clearly defined the problem it wants to solve. AI may now generate thousands of lines of functional code, but it still depends on humans to ask the right questions, define meaningful outcomes, and evaluate whether the proposed solution actually creates business value. Technical knowledge remains valuable, but business understanding increasingly determines professional relevance.

The Professionals Who Thrive Will Become Translators

One observation has remained remarkably consistent throughout my experience working with clients from different industries. The individuals who create the greatest impact are rarely those with the deepest technical expertise alone. Instead, they are the people capable of translating between business and technology. They understand the language of executives while also appreciating the realities faced by programmers, engineers, and operational teams. They know how to convert a strategic objective into system requirements, and they know how to explain technical limitations in business language that decision-makers understand. Artificial intelligence will only increase the importance of this role. As AI becomes capable of generating technical output, organisations will need more professionals who can provide context, exercise judgement, resolve ambiguity, and align multiple stakeholders towards a common objective. The future belongs not only to builders, but to translators who connect ideas, people, systems, and execution.

Organisations Must Redesign Work, Not Just Buy AI

Many organisations are currently investing heavily in artificial intelligence platforms, hoping that productivity will improve automatically. Unfortunately, technology alone rarely transforms an organisation. I have seen projects where sophisticated systems were successfully deployed, yet employees continued using spreadsheets because workflows were never redesigned. Managers still approved work manually because responsibilities remained unclear. Communication problems persisted because the organisation focused on purchasing technology instead of changing behaviour. Artificial intelligence should never be viewed as an additional tool layered on top of existing inefficiencies. Instead, leaders must rethink how decisions are made, how information flows, and how responsibilities should evolve. AI changes the way work is organised, not merely the software employees use. Without leadership, ownership, communication, and redesigned processes, even the most advanced AI solution will struggle to create sustainable value.

Leadership Will Become More Valuable Than Technical Perfection

One of the biggest changes brought by artificial intelligence is the growing importance of leadership. Technical professionals who aspire to remain valuable must develop capabilities that AI cannot easily replicate. These include critical thinking, ethical judgement, creativity, emotional intelligence, negotiation, stakeholder management, adaptability, and strategic decision-making. Likewise, business leaders must develop sufficient technological understanding to make informed strategic decisions without needing to become programmers themselves. The strongest organisations of the future will not necessarily employ the most technically gifted individuals. They will build teams capable of combining business insight, technical capability, leadership, and continuous learning. In the AI era, leadership is no longer reserved for people with formal management titles. Every professional is increasingly expected to contribute ideas, challenge assumptions, coordinate across departments, and help organisations adapt to continuous change.

Dream It. Execute It. Ground It.

This philosophy has guided my work for many years, long before generative AI became part of everyday business conversations. Dreaming is about recognising opportunities that others have not yet seen. Execution is the discipline required to transform those ideas into practical workflows, systems, and measurable outcomes. Grounding is ensuring that innovation genuinely improves the lives of employees, customers, and organisations instead of becoming another technology experiment with little lasting impact. Artificial intelligence is giving organisations unprecedented capabilities, but capability without execution creates little value. Likewise, execution without grounding often produces systems that look impressive yet fail to solve meaningful problems. Sustainable innovation requires all three elements working together. Technology should serve people, support organisations, and strengthen long-term competitiveness rather than simply demonstrating technical sophistication.

The Real Question Every Professional Should Ask

Perhaps the most important question facing professionals today is not whether AI will replace them. A more meaningful question is whether they are developing capabilities that remain valuable even when AI becomes significantly more capable. If artificial intelligence can perform half of today’s technical tasks tomorrow, what unique contribution will you continue making? Will you become someone who simply executes instructions, or someone who frames problems, guides decisions, builds alignment, and creates lasting organisational value? Throughout history, every major technological revolution has rewarded those willing to evolve alongside it. The AI era will be no different. Traditional technical expertise will remain important, but the professionals who combine technology with strategic thinking, business understanding, communication, leadership, and disciplined execution will become the people organisations rely on most. In the years ahead, human value will be measured less by what we can do manually, and more by how effectively we help others navigate change.

I built my first automation system in 2008 — a customer-relationship tool I called Autobot CRM, inspired by watching Iron Man and wondering if a small business could have its own version of Jarvis. There was no “AI workflow” category back then. There was just a simple realisation: the software mattered less than the sequence of steps it was automating.

The Lesson That Still Holds

Autobot CRM wasn’t powerful because of clever code. It was useful because I’d mapped, in painful manual detail, exactly which follow-up happened after which customer action, and in what order. The automation just executed a workflow that was already clear. Companies rushing to bolt AI onto a messy, undocumented process today are making the same mistake I’d have made if I’d automated a workflow I hadn’t actually understood first.

Two Kinds of Companies in the AI Economy

Companies with a workflow to plug AI into

These organisations can describe, step by step, how a task currently moves from trigger to completion, including who touches it and why. When they adopt an AI tool, it slots into a known gap and the result is immediately measurable, because the “before” state was already documented.

Companies hoping AI will create the workflow for them

These organisations buy the tool first and hope structure emerges afterward. It rarely does. The AI ends up automating confusion faster, surfacing more inconsistent outputs at higher speed, which is a worse position than the manual mess they started with.

How OPERiON Builds Around This

Every system we design leans on independent, microservice architecture on purpose — not as a technical preference, but so that a client’s workflow can keep evolving without the whole system needing to be rebuilt each time a piece changes. Fragile, tightly-coupled systems are exactly where AI adoption stalls, because nobody can safely change one part without breaking three others.

A Practical Starting Point

Before evaluating any AI vendor, write down — on one page — the current manual steps of the process you want to improve. If you can’t fit it on one page, that’s the actual project. The AI tool is the easy part that comes after.

As AI makes software development faster, software architecture becomes more important—not less.

Everyone Is Talking About AI Writing Code. Few Are Talking About What Happens Five Years Later.

Artificial intelligence has transformed software development at an extraordinary pace. Today, developers can generate code, build websites, create mobile applications, design user interfaces, and even produce technical documentation within minutes. Tasks that once required days of programming effort can now be completed through carefully written prompts and AI-assisted development tools. This technological progress is remarkable, and I believe every technology professional should embrace it. However, while AI has dramatically reduced the time required to build software, it has also created a new misconception. Many people now assume that if software can be built faster, then software development itself has become easier. My experience over more than nineteen years tells me otherwise. Building software has indeed become faster. Building software that remains maintainable, scalable, secure, and valuable over many years is an entirely different challenge. That challenge has always been called software architecture, and in the AI era, it has become more important than ever before.

Building Software Is No Longer the Difficult Part

For many years, software projects were constrained by development speed. Businesses waited months for programmers to complete interfaces, databases, reports, and workflow modules. Today, AI has changed that equation completely. Prototypes can be created within hours. Landing pages can be generated within minutes. Developers can solve programming errors with unprecedented speed. Even non-technical users are beginning to create applications using AI-assisted platforms. This democratisation of software development is exciting because it lowers the barrier to innovation. More entrepreneurs can validate ideas, more organisations can experiment, and more people can participate in digital transformation. However, creating a working application should never be confused with creating a sustainable software platform. Speed solves the problem of building version one. It does not automatically solve the challenges of maintaining version fifty. The true complexity of software begins after deployment, not before it.

Architecture Determines Whether Software Can Grow

Every organisation changes. Customers evolve. Regulations are updated. Business models expand. New technologies emerge. As these changes occur, software must also evolve. This is where architecture becomes the foundation of long-term success. A well-designed architecture allows systems to scale without constant rebuilding. It enables modules to be upgraded independently, integrations to be added safely, and new business requirements to be implemented without affecting the entire platform. Poor architecture produces the opposite effect. Small changes create unexpected problems. New features become increasingly expensive. Technical debt accumulates. Eventually, organisations reach a point where replacing the system appears easier than maintaining it. The problem is rarely the programming language or the framework. More often, it is the architectural decisions made at the beginning of the project, when speed was prioritised over sustainability.

AI Understands Code. Architecture Requires Judgement.

Artificial intelligence has become remarkably capable of generating technical solutions. It can recommend database structures, optimise algorithms, suggest APIs, and write clean code based on detailed prompts. These capabilities significantly improve developer productivity. Yet software architecture extends beyond writing code. Architecture requires understanding business strategy, organisational workflows, operational risks, user behaviour, scalability requirements, security considerations, governance, and long-term maintenance. These decisions often involve balancing multiple priorities that cannot be resolved by technical optimisation alone. An architect must ask questions such as: How will this system evolve over the next five years? Which modules should remain independent? How should future integrations be managed? What happens if business priorities change unexpectedly? These questions require judgement, experience, and business understanding. AI can provide recommendations, but humans remain responsible for making architectural decisions that determine the future of an organisation’s technology.

The Most Expensive Software Mistakes Are Usually Invisible at the Beginning

One of the most dangerous characteristics of poor software architecture is that it often appears successful during the early stages of a project. The application launches. Users log in successfully. Reports are generated correctly. Management feels confident because the project has been delivered on time. The real problems emerge months or even years later. New business requirements become difficult to implement. Performance begins to decline as transaction volumes increase. Integrating external platforms requires significant redevelopment. Every enhancement introduces unexpected bugs because components are tightly connected. Technical teams spend more time maintaining old code than creating new value. These issues are rarely caused by poor programmers. They are usually the consequence of architectural decisions that failed to anticipate future organisational growth. By the time these problems become visible, correcting them is often significantly more expensive than building the system correctly from the beginning.

Software Architecture Must Begin with Business Architecture

Throughout my career, I have learned that successful software projects rarely begin with discussions about technology. They begin with conversations about the business itself. How does the organisation create value? Which workflows generate competitive advantage? Which information is most critical for decision-making? Where are operational bottlenecks occurring? Technology should support these answers rather than dictate them. Before writing a single line of code, organisations should first understand how work flows across departments, how responsibilities are assigned, and how customers experience the business. Software architecture should therefore reflect business architecture. When technology follows business strategy, systems remain aligned with organisational objectives even as technology continues evolving. When technology is designed independently from business reality, organisations often find themselves adapting their operations to accommodate software instead of allowing software to support the business.

AI Is Changing the Role of Software Professionals

The AI era is transforming what it means to be a software professional. Future developers will spend less time writing repetitive code and more time solving business problems. Software architects will increasingly evaluate AI-generated solutions rather than producing every technical component manually. Project managers will coordinate intelligent automation instead of supervising routine development tasks. Business analysts will become even more important because defining the right problem is now more valuable than generating another solution. Professionals who combine technical expertise with communication, critical thinking, business understanding, and architectural judgement will become indispensable. Those who focus only on code generation may discover that AI performs many of those activities faster and at lower cost. The future belongs to professionals who can bridge business strategy and technology implementation while ensuring systems remain maintainable long after the excitement of deployment has faded.

Dream It. Execute It. Ground It.

Artificial intelligence has given us extraordinary new capabilities, but technology alone has never guaranteed lasting success. Dreaming allows organisations to imagine new possibilities and innovate beyond traditional limitations. Execution transforms those ideas into working systems that improve productivity and create measurable value. Grounding ensures those systems remain practical, maintainable, scalable, and aligned with the realities of business growth. Software architecture represents this final step. It is the discipline that turns short-term innovation into long-term organisational capability. As AI continues changing how software is built, organisations should remember that technology may accelerate development, but architecture determines sustainability. The companies that succeed over the coming decade will not simply build software faster. They will build systems that continue serving their organisations long after today’s technologies have evolved into tomorrow’s history.

Executive Reflection

Before beginning your next software or AI project, ask yourself:

• Are we designing software, or are we designing a long-term business capability?
• Will this architecture still support our organisation five years from now?
• Does our technology reflect the way our business actually operates?
• Are we prioritising speed at the expense of sustainability?
• If AI can generate code in minutes, where will our long-term competitive advantage come from?

Artificial intelligence has changed how software is built.

It has not changed the importance of designing systems that organisations can trust, maintain, and grow with.

That is why software architecture remains one of the most valuable disciplines in the AI era.

Organising the first PDX conference, I made hundreds of decisions personally — which vendor, which stage layout, which speaker slot. By PDX2026, my job had changed almost entirely. I was no longer making most of those decisions. I was designing the system that let other people make them well, without calling me first.

Decision-Maker vs System Architect

A decision-maker is the person everyone waits on. A system architect is the person whose absence doesn’t stop anything, because the structure already tells people how to decide. Most leaders I meet are still operating as the first, even as their organisation has grown far past the size where that scales.

What a decision-maker optimises for

Being right, quickly, on the specific thing in front of them. It feels responsive. It also means every important choice funnels through one person’s calendar.

What a system architect optimises for

Designing the conditions — the information flow, the escalation rules, the shared context — so that a good decision is the default outcome even when the architect isn’t in the room. It feels slower to set up. It scales without you.

The PDX Test

The clearest sign PDX had become a system rather than a one-man decision engine: during the 2026 event itself, I was mostly moving between stages, not fielding operational questions. The team had the structure to handle what came up. That wasn’t luck. It was eighteen months of deliberately building the structure instead of just making faster decisions.

FAQ

Does this mean leaders shouldn’t make decisions anymore?

No — it means reserving your personal decision-making for the handful of choices that genuinely need it, and designing everything else so your team doesn’t need to ask.

Where should a leader start?

Pick the single decision your team asks you for most often. Instead of answering it again, write down the rule you used to answer it, and hand the rule to the team. That's the first brick of the system.

The best digital tool I’ve ever built won’t stop a single scam on its own. What stops a scam is a grandparent pausing for three seconds before clicking a link, or a teenager remembering to ask “why is this stranger asking me for a one-time password?” That’s not a technology outcome. It’s a thinking habit — and it’s the exact same gap I see inside companies that have spent heavily on digital transformation and still can’t explain what changed.

Two Kinds of “Digital”

Writing Scam-Proof and building the ScamAlert Junior comics taught me something I now see everywhere in corporate transformation projects too: giving someone a tool doesn’t give them the instinct to use it well. You can install the best anti-fraud software in Malaysia on every device in a household, and it won’t matter if nobody in that household has learned to pause before trusting an urgent message. The software was never the missing piece. The habit of questioning was.

Companies make the identical mistake with digital transformation budgets. They buy the platform. They skip building the habit of questioning how work should actually flow through it. Six months later, the platform is “live” and nothing about how people actually work has changed, because the organisation never learned to think differently — it just learned to click a new button in roughly the old way.

What “Thinking Differently” Actually Looks Like

In the scam-awareness talks I give to schools and community groups, the turning point is never the moment I show a slide about phishing techniques. It’s the moment someone in the room says, out loud, “wait, I did exactly that last week.” That’s a mindset shift, and it happens through story and reflection, not through installing anything.

Inside an organisation, the equivalent moment is a manager saying “wait, we’ve been approving this the same way for six years and nobody has asked why.” If your digital transformation programme has never produced that sentence out loud in a meeting, technology has been installed, but thinking hasn’t changed — and the transformation, whatever the dashboard says, hasn’t actually happened yet.

Where to Look First

Before your next platform purchase, sit in on the process you’re trying to fix and count how many times someone says “that’s just how we’ve always done it.” That sentence, not the software gap, is what you’re actually transforming.

Artificial intelligence is not simply changing the tools we use. It is forcing organisations to rethink how work is organised, decisions are made, and value is created.

Technology Is Moving Faster Than Most Organisations Can Adapt

Over the past two decades, organisations have invested billions of dollars in enterprise software, cloud platforms, automation, and, more recently, artificial intelligence. Yet despite this rapid advancement, many businesses continue to struggle with the same operational challenges they faced years ago. Meetings remain unnecessarily long, approval processes are slow, information is scattered across departments, and employees still spend valuable time performing manual tasks that technology should have eliminated long ago. This disconnect highlights an important reality. Digital transformation is no longer constrained by technology. Today’s tools are more capable than ever before. Instead, the limiting factor has become the organisation itself. The greatest challenge is no longer finding better software but redesigning how people collaborate, make decisions, share information, and execute work. Organisations that continue treating digital transformation as an IT project will increasingly find themselves falling behind competitors who understand that transformation begins with organisational redesign rather than technology acquisition.

Technology Alone Does Not Change the Way an Organisation Works

One of the biggest misconceptions surrounding digital transformation is the belief that implementing a new system automatically changes organisational behaviour. In reality, software only provides capability. People determine whether that capability creates value. I have seen organisations invest heavily in ERP platforms, CRM systems, workflow automation, AI assistants, and sophisticated dashboards, only to discover months later that employees still rely on spreadsheets, manual approvals, email chains, and disconnected processes. The technology functions exactly as intended, but daily operations remain largely unchanged. This happens because digital transformation is often approached as a technology deployment instead of an organisational redesign exercise. Installing new software without redefining responsibilities, communication channels, performance measurements, and decision-making processes simply digitises existing inefficiencies. Technology becomes an additional layer rather than a catalyst for meaningful improvement.

Artificial Intelligence Is Redefining Organisational Structures

Artificial intelligence is accelerating a transformation that extends far beyond automation. It is changing how organisations should be structured. Traditional organisations were designed around clearly defined departments, hierarchical approvals, and specialised job functions. AI is making these boundaries increasingly fluid. Employees now have access to tools that allow them to analyse information, create content, automate routine tasks, and solve problems that previously required multiple departments. As a result, organisations must rethink reporting structures, role definitions, decision authority, and collaboration models. The future organisation will rely less on rigid departmental silos and more on cross-functional teams capable of responding quickly to changing business needs. This shift is not about removing people. It is about enabling people to contribute at a higher level while allowing technology to handle repetitive execution. Organisational design must evolve alongside technological capability.

Leaders Must Shift from Managing Work to Designing Systems

Leadership itself is undergoing a significant transformation. For many years, effective managers were expected to supervise work, monitor performance, approve decisions, and solve operational problems. In the AI era, these responsibilities increasingly shift towards designing systems that allow good decisions to happen consistently without constant managerial intervention. Leaders must become architects of organisational capability rather than supervisors of daily activity. They must establish clear workflows, define accountability, simplify communication, and ensure information reaches the right people at the right time. Artificial intelligence can assist with analysis and automation, but it cannot replace thoughtful organisational design. Sustainable transformation depends on leaders who understand both business strategy and operational execution, creating an environment where technology supports people instead of forcing people to adapt to poorly designed systems.

Communication Is Becoming the Most Valuable Organisational Capability

Throughout my career in software development and digital transformation, I have observed that many projects do not fail because of poor technology. They fail because communication breaks down between business leaders, technical teams, operational users, and external stakeholders. Executives often describe business objectives while developers interpret technical requirements, yet somewhere between those conversations the original problem becomes distorted. Artificial intelligence does not eliminate this challenge. In many cases, it amplifies it. AI systems depend heavily on accurate context, clear objectives, and disciplined implementation. The organisations that succeed will therefore invest as much in improving communication as they do in purchasing technology. Employees who can translate business challenges into practical implementation strategies will become increasingly valuable because they bridge the gap between strategic vision and operational reality.

Organisational Agility Will Become the New Competitive Advantage

In the past, organisations often competed through economies of scale, production efficiency, or geographical reach. Today, competitive advantage is increasingly determined by organisational agility. How quickly can leadership recognise change? How rapidly can teams redesign workflows? How efficiently can information move across departments? How confidently can employees adopt new technologies? Artificial intelligence provides faster access to information, but organisations still require people capable of interpreting that information, making informed decisions, and executing consistently. Companies that redesign themselves around adaptability rather than bureaucracy will respond more effectively to market changes, customer expectations, and technological disruption. Agility is no longer simply an operational characteristic. It is becoming a strategic capability that determines long-term competitiveness.

Digital Transformation Requires Courage Before Technology

Every successful transformation I have witnessed began with leadership making difficult decisions rather than purchasing new software. Leaders chose to challenge long-standing assumptions, redesign familiar workflows, redefine responsibilities, and encourage employees to embrace new ways of working. These decisions often created discomfort because organisational redesign requires people to leave familiar routines behind. Technology implementation is usually the easiest phase of transformation. Changing behaviours, aligning stakeholders, and maintaining momentum require significantly greater discipline. Organisations must therefore recognise that transformation is fundamentally a leadership responsibility. Technology provides new possibilities, but courage, communication, and execution determine whether those possibilities become sustainable business outcomes. The future belongs to organisations willing to redesign themselves before competitors force them to do so.

Dream It. Execute It. Ground It.

Every meaningful transformation begins with a vision of what an organisation could become. Dreaming allows leaders to imagine a future beyond today’s limitations. Execution transforms that vision into redesigned workflows, improved communication, stronger leadership, and measurable operational improvements. Grounding ensures that transformation remains practical, sustainable, and aligned with the realities of employees, customers, and long-term organisational success. Artificial intelligence will continue evolving at remarkable speed, but technology alone will never determine which organisations succeed. Those that thrive will be the ones willing to redesign how they work, rethink how they lead, and continuously adapt how they create value. Digital transformation has therefore become much more than a technology initiative. It has become an organisational discipline that connects people, leadership, systems, and innovation into a sustainable competitive advantage.

Executive Reflection

Before launching your next digital transformation initiative, consider these questions:

• If every employee had access to AI tomorrow, would your organisation still operate the same way?
• Which workflows exist today simply because “that is how we have always done it”?
• Are your organisational structures designed for hierarchy, or for speed and collaboration?
• Does technology support your people, or have your people adapted to inefficient technology?
• If you could redesign your organisation from scratch today, what would you do differently?

The organisations that lead the next decade will not necessarily own the most advanced technology. They will be the organisations with the courage to redesign themselves before change forces them to.

Everyone who has organised a large event will tell you the idea is the easy part. Turning “Penang should have its own digitalisation conference” into two days at Setia SPICE Convention Centre with government, MNCs and industry leaders in the same room meant running straight into the same execution failures I now see inside almost every organisation I work with.

Three Failures That Almost Sank PDX

1. Everyone agreed on the goal, nobody agreed on the trigger

Early on, three teams all believed “get sponsors confirmed” was someone else’s next move. Nobody was wrong about the goal. Nobody had been told exactly what event should trigger their part of the work. The fix wasn’t a pep talk about ownership — it was a one-page document naming, for every workstream, the single event that started it.

2. Knowledge lived in one person’s head

For the first PDX, sponsor relationships existed mostly in my own memory and inbox. The moment I was unreachable for two days, decisions stalled, not because the team lacked judgement, but because they lacked the context I hadn’t written down anywhere. We now document context, not just tasks — the “why” behind a relationship or a commitment, not just the “what.”

3. Feedback arrived too late to matter

In year one, we found out what delegates actually wanted from post-event surveys — useful for next year, useless for the event already over. Now we build in short feedback checkpoints during planning, not just after the event, so a bad assumption gets caught in week three instead of month eleven.

The Pattern Behind All Three

None of these were knowledge problems. Every team involved knew, in the abstract, what needed to happen. What was missing was the specific trigger, the written-down context, and the fast feedback loop that turns knowing into doing. That gap — not a lack of smart people or good intentions — is what I’d call the real execution gap.

FAQ

Isn’t this just a project management problem?

Partly — but project management tools don’t fix it if the underlying triggers and context were never defined. The tool organises the gap; it doesn’t close it.

What's the fastest way to check if my team has this problem?

Ask three people on the same project to describe, unprompted, what specifically triggers their next task. If you get three different answers, you've found the gap.

Scammers adopted AI voice cloning and deepfake video call scams faster than most Malaysian banks updated their customer fraud warnings. I’ve tracked this gap closely while researching Scam-Proof, and it isn’t a story about criminals having better technology. It’s a story about who moves fast and who moves slow — and that exact gap shows up inside ordinary companies too, just with less dramatic headlines.

Fast Side, Slow Side

A scam network can test a new script, drop the ones that don’t convert, and scale the ones that do, all within days. A bank updating a customer warning message often needs sign-off from legal, compliance, and brand — a process measured in months. Neither side lacks intelligence. One side has removed the friction between noticing something and acting on it. The other hasn’t.

I see the identical pattern inside companies evaluating AI tools. A competitor tests, fails fast, adjusts, and ships. The slower organisation is still circulating the seventh draft of a risk-assessment memo for a pilot with no customer data in it yet. The technology gap between them is usually small. The decision-speed gap is enormous, and it compounds every quarter.

What Speed Actually Costs You If You Skip It

To be clear, this isn’t an argument for recklessness — a bank should absolutely check its fraud messaging carefully. It’s an argument for shrinking the distance between “we noticed a problem” and “we did something proportionate about it” from months to weeks. Every extra month of deliberation is a month a faster-moving competitor, or a faster-moving scammer, gets to operate unopposed in the same window.

Three Questions That Reveal Your Real Speed

• How long ago did your organisation last change a customer-facing process because of something you noticed last month, not last year?
• Can anyone below senior leadership approve a small, reversible experiment without three layers of sign-off?
• When something goes visibly wrong, does the fix ship in days, or does it wait for the next quarterly planning cycle?

If those answers are uncomfortable, the risk you’re carrying was never really about AI. It was about how long your organisation takes to notice and move — and in both fraud prevention and digital transformation, that number is the only one that actually predicts who gets hurt.