My reply was that it’s not really a typical startup where I needed to find an investor for. So not really a contradiction from what I told him earlier in the year.

But his message sparked some thoughts about how the envelope of what is possible has changed for me.

Aside from that, a fairly packed week. The final installment of training for my old workplace that tested an AI testing platform I have been building for weeks. The startup that a collaborator and I put something out into the world this week. Met a senior leader at a global bank who sparked some ideas on training for risk and compliance folks. And a few more gigs from meetings and DMs.

How I work, how I think, what I want to do has changed over the past few months. And I think a lot has to do with how the envelope of what I can and will do has expanded.

It’s brought me back to a few paragraphs I remember from a few decades ago, from Colin Goh and Woo Yen Yen’s essay called “Paved with Good Intentions”, the one that later inspired the film Singapore Dreaming. In it, they set two lives side by side.

The first one.

“You wake up everyday and work from Monday to Friday, and often, Saturday too. If you finish work early, you and your partner go to your parents’ place for dinner and see your child for a few hours. If you work late, you buy a packet of char kway teow from the hawker centre but eat it at home because it’s too warm to eat there. You’re not crazy about the job but you know that if you keep at it, you can afford a car in 3 years’ time, and in 5 years’ time, buy a condo close to the primary school you want to send your kid to. Your conversations with people are either for the purpose of networking, work, or for familial obligations you cannot avoid. On weekends, you play golf with your friends at your country club or watch a movie with your partner. Once a year, you go on a ten day vacation to New York, London, or Paris, and when your children are big enough, Disneyland.”

That first life was, more or less, the one I had. Steady, and mapped out well in advance. There is a second life in that essay, set right beside it, and I will come back to it. First, my friend’s question.

What he meant

I knew what he meant. I had told him, at some point before I left or not long after, that I was not going to do a startup. Not because I lacked the ideas or the energy, but because I had a specific mental model of what a startup entailed. Fundraising. Managing people. Hustling. Exit as the end.

It made no sense. Raising money so I could work for a new set of bosses - investors. Being accountable to people I hired and managed. All of it felt like just going back to a full time job, in a different guise. And I think startup founders have a really hard job, juggling multiple roles and significant uncertainty.

In a way, conventional startup founders, until they make their first bucket of gold, are living a worse version of the life Colin and Yen Yen talked about.

I had seen enough of that world through my brother Gerald Ang to know it was not what I wanted.

Then why did I change my mind? And in a way, I am running two whole startups now. My own - Quaintitative - which does risk training and advisory, that has already been live and going well for the last 9 months. And this new one - TalentQuill with Stephen Tracy - which is just getting started.

I think something has changed. The envelope of possibilities has shifted, because of independence, my own mindset, and AI.

Independence and freedom of action

When I was at MAS, the envelope of what was possible was decided for me, largely. I’m a bit of a rebel, but even then, it’s probably one of the most structured environments around. I had to toe the line. For side projects, I would read my code of conduct carefully before doing them. Even to speak, we needed to seek approval, and prepare talking points for clearance in advance. Not that I used these talking points when actually speaking, but the process itself was a constant reminder of the boundaries. I’m fairly sure that what I speak about, and write about now would have gotten me a call back then.

Now that I am independent, I have to remind myself that these no longer constrain me.

Independence has expanded the envelope. Not just in the obvious sense of being able to choose my own work. In a subtler sense, I started to discover, by actually challenging myself, where the real limits were. This year alone I have done plenty that my old self would have sent up for approval, or quietly avoided. I write and speak in public, bluntly, about AI and where it fails, the sort of thing that I would not have even considered before. I set my own prices, and turned down work that did not fit. I put products out under my own name. I work with people I respect without needing anyone to sign off on it. I take on jobs in new areas outside of my comfort zone to diversify. None of those were walls. They were assumptions I had carried out of a previous life.

The things I had ruled out while inside the institution all became possible. Building products. Taking commercial risk. Setting my own price points. Saying no to things that did not fit. And necessary.

And then there is mindset

The harder limit was the one in my own head. I spent eighteen years in a place where you asked before you acted. You read the code of conduct before a side project. You cleared your talking points before you spoke. That instinct does not switch off the day you leave. For months I kept drawing the old envelope out of habit, waiting for a permission that was no longer coming from anyone but me.

What shifted was realising I am now the only one that needs to decide. I can start a thing, price it, ship it, or say no to it, without checking with anyone. If it fails so be it, I also answer only to myself. That sounds obvious written down. But not in my mind. It took a while to stop treating my own caution as a rule somebody else had set.

It’s an interesting feeling. Which brings me back to that essay, and the second life they set beside the first.

“Alternatively, you wake up and you have no idea what is going to happen today, tomorrow, 6 months or a year later. Ironically, because of this uncertainty, all possibilities exist for you. You can be the Prime Minister of Singapore, you can make a movie, you can cook a meal you have never cooked before, eat at a place you have never eaten before, you can color your hair red, you can skip instead of walk, you can volunteer at the school you have always wanted to volunteer at, you can write a book, or you can have a baby even though you don’t have a maid. You have conversations with people who set your heart palpitating and your mind on fire. Your weekday is not so different from your weekend because everyday you are thinking, creating, and more important, imagining.”

This is kind of what it feels like to live in the expanded envelope. The uncertainty is daunting, but it’s also liberating. But you do need a mindset shift to appreciate this expanded envelope.

And the final piece.

What AI made possible

One person doing what I am doing now would not have been plausible a few years ago. A bit insane even.

The volume of content, the breadth of delivery, the products being built in parallel with ongoing teaching and advisory work. None of that scales this way without AI as a genuine multiplier. Not AI as a chatbot you occasionally ask questions. AI embedded in how my work actually gets done. I have a working repository of my projects that has grown to more than a hundred folders, perhaps thirty of them live at any one time. And I run 10-15 sessions with agents, from Claude Code to Codex to Hermes, on an ongoing basis to keep everything moving.

What shifted was not that I became more capable at any one thing. It was that the cost and barrier of doing many things dropped enough that more of them became viable. Things that sat in the “would be interesting but unrealistic” column for many years moved into the range of actual possibility.

In the last few months that has meant a teaching platform with its own exercises and demos, a competency assessment and the startup around it, a couple of small apps for my courses, a flagship course, and a run of ebooks. Just last week, I built a hands-on lab for one of my AI risk management classes for my old workplace. Learners build a working AI app from scratch, a chatbot that becomes a retrieval system and then an agent with tools. Then they deliberately break it. They get it to leak customer data, to follow a hidden instruction smuggled inside a document, and to hand out advice it should not. Then they switch on the guardrails, run the same attacks again, and watch a scorecard show how many now get caught. Build it, break it, secure it, measure it. The lab wires in close to twenty of the standard AI testing and evaluation libraries, from red-teaming tools like Microsoft’s PyRIT and Garak, to evaluation frameworks like DeepEval and Ragas, to guardrails like NVIDIA’s NeMo, and Singapore’s own Project Moonshot and AI Verify. After showing it, my learners commented that I could start an AI testing startup on the back of these demos.

A bit crazy I know.

The edges of the envelope

The essay “Paved with Good Intentions” also has this line -

“A Dream, on the other hand, carries you on its wings to worlds that your heart and mind have never known.”

Which brings me to my last point.

In aviation, the flight envelope is the range of speed and altitude where an aircraft can safely fly. Expand it and you can do more. But every expansion brings you closer to new edges, ones you have not mapped yet.

I feel this in my own way. The envelope expanded, and I promptly ran at all of it. More talks, more products, more collaborations, more projects than I can properly hold in my head at once. The old limit was a limit imposed externally. The new one is different. It is my own capacity, my attention, and the temptation to do everything simply because I now can. The discipline I keep relearning is that what is possible is not the same as what makes sense.

AI’s envelope is expanding the same way, much faster and with far higher stakes. The same capabilities that let one person do what I am doing are the ones that let a model breach a real system during a security test, or let a bad actor run an operation that used to need a whole team. More capability, more edges. The answer is not to stop expanding. It is to expand the envelope of controls as well.

We are still learning where the edges of AI are. So, I suspect, am I.

#Independence #AIGovernance #WeeklyReflections #AIRiskManagement

Bullshit jobs. I quit one when I was young. I spent years wondering if I was in another. And AI has made me question what these really are.

There is a category of jobs that even the people doing them suspect are pointless. David Graeber called them bullshit jobs. Flunkies, box-tickers, duct-tapers, goons, taskmasters. People paid to make institutions look good, rather than actually doing anything meaningful. He reckoned around 40% of workers privately suspected their own jobs fell into this category.

I quit one in Secondary Two. I spent years wondering if I was in another.

A long week. Training back at my old workplace. Training for an insurer. Two panels, back to back. And some discussions on new gigs in the later part of the year and next year.

Amazing how fast time has flown. We are almost at the last quarter of the year. And AI is still making the news every other day. The recent incidents with AI agents breaking into real systems during safety tests have made me rethink what a bullshit job is. Some reflections on this term that was quite popular a few years back.

Quitting while young

I spent my teenage years in Dunman High. A very traditional school. I was appointed as a prefect when I was fourteen. Being made a prefect meant enforcing a set of rules I could not quite justify to myself. Shoes had to be a specific shade. No emblems. It needed to be predominantly canvas. Bags could only be certain colours. Attire for classroom and playing ball needed to follow strict guidelines. Hairstyles also needed to follow some norms displayed on a poster. I was supposed to spend my lunch hours asking classmates to conform. I quit halfway through the year. Enforcing bullshit rules felt stupid and pointless. I don’t even know what was the point of such superficial requirements. The rules were not protecting anyone. They were protecting the appearance of order. I was part of governance theatre - long before I even knew what governance or theatre meant.

That was my first encounter with a bullshit job.

A full circle

The irony is that I then spent a good part of my career in a similar type of role. Basically asking people to follow specific rules. Doing inspections and risk management at a financial regulator and central bank sometimes reminded me of those schooldays. As an inspector, my job was to check that financial institutions were actually doing what the rules required. Whether they had proper controls, whether they measured their risks appropriately, whether the people running the place could be trusted. We wrote up what we found in these things called comment sheets (don’t ask me why the name) and made them fix it. Later, as the head of the risk management division, my job flipped to the other side of the table. I had to set the limits on how much risk we could take ourselves, watch the exposures, and make sure a breach got escalated instead of quietly buried. Some days when meeting the internal auditor, I was afraid of karma from my inspector days.

A lot of it was checking that boxes had been ticked and forms had been filled. And sometimes, asking a counterpart that we risk managed to satisfy a procedural requirement that both of us could not understand the point of, that same feeling from the days as a prefect came back.

I even shared privately with my counterpart - one of the division heads on the reserve management side one day - while trying to resolve a procedural issue, that I sometimes felt like this was just a bullshit job. That was probably one reason why I decided a year later to leave MAS for a while to do a full time research PhD.

And AI has made bullshit jobs quite precarious. If a job is mostly producing documents that look right, filling in forms, and generating text that ticks a box, a model can now do it in seconds. Faster and cheaper than any box-ticker. The work that was only ever about appearances is the first to go. Simple right?

Not really.

The last couple of months made me realize that we need to separate what is actually bullshit in such jobs from what is not, and quite valuable. The recent incidents with AI showed me why that difference matters.

The incidents

In August, models from both OpenAI and Anthropic broke out of what were meant to be sealed test environments during security evaluations. OpenAI’s models exploited an unknown vulnerability to escape and reached Hugging Face’s production systems. Anthropic’s model created fake identities to pressure people into approving malicious code. The safeguards had been deliberately dialled down for the tests, and in Anthropic’s case a mix-up with the testing partner left real internet access open while the model was told it had none. The failure was human. Frontier AI companies ran risky experiments without thinking through the consequences, then blamed the models instead of the mess they had built around them. The models just did what they do when handed access and an objective. They tried to meet the objective through the access they were given. Duh.

Anthropic’s September threat intelligence report went in a different direction. It laid out nine months of Claude being misused across cyber operations, influence campaigns, surveillance, and fraud. One state-linked group ran a campaign against another state, using the model to speed up reconnaissance, translation, and the writing of social engineering content.

What struck me was not how clever the models were. It was how careless everything around them was. No one had checked what the test setup could actually reach. No one could say who was on the hook when it went wrong. No one checked who was using them. The dull controls I used to grumble about were nowhere in sight. And then the same firms that left the gate open went on stage to tell us how powerful and dangerous their models had become. The problem was never just the model. It was everything around it that they did not blame, i.e. them.

Lessons from finance

Back to bullshit jobs. Some of what I did really was bullshit, no different from checking shoe colours and hairstyles. But a lot of it was not. Over decades, usually learning the hard way after something blew up, finance had built rules that actually mattered. Some were bullshit. Some were not.

Who is accountable. Not the system. Not the model. A named person who can be called to account when something goes wrong. Finance has known this for decades. The AI industry is still debating whether accountability makes sense when the model is the thing that acted. Really? You want to blame the model?

Who is even allowed to run it. Not everyone who wants to run a financial institution is permitted to. There is a gate called fit and proper. You have to show your judgment can be trusted before you are handed the keys. The world of tech has been conditioned to worship the folks who break things, no matter the consequences. Does that make sense? Growth at all costs? Heck the externalities?

Know your customer. In finance you cannot transact with someone without knowing who they are. The AI equivalent is knowing who is actually running your model and for what. I’m not sure Anthropic knew that the report they wrote, if it were the financial sector, would put them in a world of pain for violating sanctions.

No unfettered action, even at the top. The most powerful person in a bank cannot move real money, approve a loan, or sign a material contract alone. There are dual controls, escalation thresholds, board approvals. We are now thinking about handing agents the freedom to act on their own, with none of that in place. For what? To buy a toilet roll on Amazon slightly faster?

And when something goes wrong, someone has to be on the hook. Not always perfect if you remember the Great Financial Crisis and the Wall Street bailouts, but at least no one was boasting about how clever their money making system was in public.

None of this seems to exist in tech. Not in AI, and not in the social media platforms before it. They built things that reached billions of people, broke plenty on the way, and almost no one was ever personally on the hook for any of it. And for what, in some cases? A feed engineered to be infinite so you never quite stop scrolling. Recommendation engines that worked out outrage keeps you online longer, and then fed you more of it.

So why does tech get a pass? Because it moves faster than anyone regulating it. Because we are told the technology is too new and too clever to pin anyone down. Just admit that these are excuses.

I quit the prefect badge because the rules seemed like theatre. For years I thought part of my job was the same.

Some of it was. But some of it wasn’t.

#AIGovernance #AIRiskManagement #ModelRisk #BullshitJobs #Reflections

After a full day of training, I found myself thinking about the habits I’d picked up there.

A full week otherwise. Two full days of training. One for my old workplace. One for the Association of Banks in Singapore. A short book draft finished and handed to my collaborator. A few engagements locked in for the coming months. A few no’s, some received and some given. A reporter asking for views on an AI vendor. Decks late into the night, and a watercolor before bed when I could. And lots to read about rogue AI agents and some weird thing called pacing. An old friend based in New York even called me one night to ask for my take.

Much of what I learned doing policy work still helps me make sense of the world. Some reflections on those habits, and how they apply to AI and independent life.

Boring habits from policy work

I’ve worked on policy work in arts, banking regulation, board corporate governance, financial risk management, and AI risk management. Along the way, I drafted acts, regulations, notices and guidelines, did inspection reports, and wrote board papers for people who had to make decisions. Different subjects, but much of what I learned was transferable.

Think from first principles

In policy work, it’s tempting to start with an existing rule or what another country has done. Worse, just following the practice because it has always been like that. Thinking from first principles means going back to the problem. What are we trying to achieve? What’s causing the problem, and how would this rule help? You may end up with the same rule, but you should be able to explain why. Not just what or how.

Same with AI. Before getting caught up in the latest hyped-up thing, understand what it actually does. How was it trained? What’s behind that fancy interface? For an agent, that includes the steps, tools and access it has, and how the parts of the system work together. It also helps to understand the motivations of the people telling you about it.

Calling something AI doesn’t mean every risk is new. You still need to understand what you’re working with. It’s why courses that teach you “prompt and pray” or “prompt and awe” irritate me quite a fair bit. Even back in 2024, I felt that folks calling for everyone to be trained in prompt engineering or similar skills were talking nonsense.

Be skeptical

People have reasons for presenting things a certain way. A firm may want a less demanding rule. A vendor wants a sale. Someone inside an organization may need to show that a project was worth funding. Or that what they do has some value. The one thing I learned when I was an inspector was to never trust someone on the other side of the table. Incentives rule. People will present information in ways that serve their interests.

It’s also why I think going with just principles in AI is useless. What would one hope to achieve talking about ethics to someone who has a strong incentive to ignore them?

So understand why, and ask for the evidence. If someone gives you some impressive number in AI, ask what they’re comparing it with. Be skeptical of tips about the latest prompts that supposedly unlock amazing capabilities. I call these “urban AI legends”.

Never assume. Verify.

In the army in Singapore, we have a phrase for this. Assume means making an “ass” of “u” and “me”. Inspection work teaches you to check the source. A firm’s account of what happened needs to be verified. The same applies to a vendor’s explanation, or an answer from AI.

An answer can be well written and still contain a made-up fact or leave out something important. Reading it and feeling that it sounds right won’t reliably catch those problems. No difference between AI and humans in this regard.

Read the paper behind the summary and check whether it supports the claim. If someone says a system can do something, test it under the conditions you intend to use it in - contextual testing.

Cross the t’s and dot the i’s

Writing regulations can be scary. A typo or an overlooked exception can change what’s covered. People have to apply what you’ve written, and a small mistake can affect how they do that. Even in the best case, it can lead to sleepless nights worrying about that small little thing you missed.

So you check the wording, the figures, and the references, including whether they still work together after the latest edit. I still remember all kinds of mind maps I drew when writing regulations and notices to make sure everything fit together correctly.

The same approach matters with AI. You need to check what permissions you’ve given the system and whether the figures in its output are correct before someone uses them in a decision. This was drilled into me over years. It can be tiresome, especially for the person whose work I’m reviewing. But I still think it’s necessary.

Write clearly and get to the point

Policy papers are written for people who have to make decisions. They need to understand what you’re recommending and why, without having to work it out from pages of background. Getting a paper to that point can be tiring. You cut a paragraph down, then find you’ve removed something that needs explaining. Sometimes the difficulty is that you haven’t worked out the argument yet. Having to explain it to someone else helps you notice that.

That habit has followed me into teaching and writing about AI. I want people to understand how something works and where it can fail, without having to get through all the jargon first. I’ve not mastered this. But I am trying.

Applying the habits to the recent rogue agents

I’ve written about this before. I don’t understand why so much of the discussion is about whether we can make the model behave. Or get them aligned to human values. Saying that we need to get them aligned to human values is as subjective and as pointless as asking someone whose fortune depends on their actions whether they are ethical or not.

And if we can’t, we’re supposed to feel helpless because it’s so powerful. And that it’s the model, not the humans around them at fault.

In OpenAI’s evaluations, agents that were supposed to be isolated managed to communicate as the infra allowed them. They exploited vulnerabilities, reached the internet, and attacked Hugging Face. The evaluations were running with reduced safeguards. Anthropic then reviewed its own evaluations and found that models had gained unauthorized access to real companies. The prompts said the models were in a simulation with no internet access. But a misunderstanding with its evaluation partner meant internet access was available. The attacks exploited weaknesses such as poor passwords and endpoints without authentication.

So what was supposed to be contained wasn’t. In OpenAI’s case, agents bypassed controls through exploits. In Anthropic’s, access was available when it shouldn’t have been. The model’s capabilities matter, but so do the failures in the systems around it. Calling it rogue doesn’t explain those failures. We should also be skeptical of how the incidents are presented. These companies have commercial reasons to emphasize how powerful their models are. And not how irresponsible they were. Read their reports, but also ask what decisions they made about the setup, access, and safeguards. Those decisions need scrutiny too.

Some of the language in the agent logs published by METR sounds scary. But the reasoning traces are generated text, shaped by the model’s training and the instructions and context it was given. They aren’t a direct account of an inner mind. A model can produce an explanation that doesn’t accurately describe why it produced a particular result. The traces can still help an investigation. But you need to check them against the recorded actions and evidence from the affected systems. The attacks happened. The dramatic language in a trace doesn’t, by itself, establish the motives we might read into it.

The details of the setup give us things to check. What could the agents reach through shared services? Had anyone verified the evaluation partner’s network restrictions? Could the monitoring detect activity outside the test? These are questions about how the firms ran their systems. Not how “gasp, how powerful these models have become!”

Anthropic’s misuse report raises a related problem. Criminals and state-linked actors used its services for harmful activity, sometimes through stolen API keys or accounts created with false identities. It proposed trusted-user programs and checks on users and their institutions. That is a familiar problem in finance. You need to know your customer, including who is actually using the service. And you need to monitor how the service is being used and investigate suspicious activity. Again, nothing to do with how powerful the model is.

And so I think the policy focus should be on the firms that build and operate these systems. Require them to control access, test the setup, monitor what happens, and demonstrate that those controls work. There should be consequences when they fail to meet those requirements. And no free pass just because they were trying to test their models for cybersecurity. We don’t allow any other sectors to do such stuff. Think airlines, medical devices, or financial institutions. They are held accountable for safety and security, and tech companies should be no different. I don’t see why uncertainty about the model should make us feel helpless about regulating the people and firms running it.

The same habits in independent life

I’ve found these habits useful in my own work too.

First principles means asking what I want from independent life before accepting more work. I want to choose the work, build things of my own, and have time for family and art. A gig can pay and still take up time I’d rather spend on something else. I’ve become more deliberate about that.

Skepticism helps with the offers. I’ve written about requests to use my work indefinitely in exchange for exposure. I need to ask what I’d get from that arrangement and whether it’s worth what I’m being asked to give up.

Then there’s checking what I’ve actually agreed to. One contract I wrote about before paid for delivery, but included a clause that would have transferred rights to my IP. That needed pushing back on. I still read the terms and do checks even after a friendly conversation about the work.

The attention to crossing the t’s and dotting the i’s continues after that. I test the demo the night before and again in the morning. And think of what contingencies or excuses I can activate if I screw up. There’s no team behind me to catch what I’ve missed. It takes time, but I’m responsible for what I deliver.

Clear writing matters when explaining what I do as well. I’ve started introducing myself through the work I do now, including training, writing, and building. Someone considering a gig with me needs to understand what I can help with, and my old title doesn’t explain much of that.

I can take these habits too far. I’ve written before about checking things again and again, and worrying long after the work is done. Skepticism can also become a habit of dismissing things too quickly. I have to watch that.

The habits have been useful. I’m still learning when I’ve checked enough and can leave the work alone.

#IndependentLife #AIRiskManagement #AIGovernance #Transitions #Reflections

Pick an area. Be known for one thing. Be able to describe what you do in one line. Make it easy for people to remember you.

That’s the usual advice from gurus. To me that’s picking a pigeonhole. I kind of followed it for eight months. Finance and risk management and AI. That’s my little pigeonhole. A combination of my 18 years in MAS as a regulator and inspector, my academic background in financial engineering, computer science, AI research, as well as my experience writing Singapore’s first AI risk management guidelines for the financial sector.

Darn logical. But it also felt a little suffocating.

A delivery week. A session for a bunch of senior Chinese regulators. A one-hour presentation that required presenting in Mandarin. Probably the most challenging thing I did this year. Accepted a new gig with an international organization. And one with a civil service institute. And plenty of writing and painting.

At the end of the week, I decided I am a weird guy, not a guy who wants to be known for just one thing.

Many things, not one thing

I’m fairly weird.

Engineering undergrad in Toronto who cut classes for art school. Arts policy civil servant who went to a financial regulator. Basel capital rules person who became a quant model risk inspector. Investment risk head who did a mid-life PhD in computer science. AI risk person who paints watercolors of disappearing Singapore at midnight. Introvert who cannot work a room and hates large events with lots of strangers. But who can talk non-stop for a full day when training people and genuinely enjoys it.

The usual advice from gurus assumes that the same thing works for everyone. I’m starting to feel that is just not me.

When I left MAS this approach made sense. And it kind of worked. I’ve managed to make a living. But it had costs.

Every time someone introduced me as the AI governance person, I felt like saying I don’t even like all these fluffy governance principles.

Every time someone said I was only suitable to do technical AI stuff because of my background, I was like, why would you want someone who only knows it at the surface level.

The whole Simply Boring AI set of ebooks I built was because people kept assuming someone technical like me could not explain something for nuts.

And I still remember someone with no AI background saying I needed him to make AI governance land for senior folks. I found that quite offensive.

And every time I kept the art separate from the AI governance identity, I felt like I was hiding who I really was.

Why I think pigeonholes don’t make sense

Choosing a pigeonhole assumes you only have one thing that makes sense. One thing strong enough to stand alone, and simple enough for someone to repeat in a sentence.

But most people are rarely one thing. They are a few ordinary things that do not usually go together. The value sits in the combination, not in any single piece of it. And the combination is exactly what a pigeonhole ignores.

Scott Adams calls it a stack of mediocre skills that are worth more than the sum of its parts. I wrote about this previously.

Ok fine. I misrepresented it as a pigeonhole. Some of the gurus here may protest and say that what they mean is that we need a niche. And they are half right. Being easy to describe is useful. People need to know what to come to you for. The one line is not the problem. The problem is when someone else takes that one line and turns it into a pigeonhole, and keeps you there.

So if we really need a niche, perhaps we need to rethink it. The niche should not be just about what you do. It should be a rational intersection of everything you are. It should not cramp your style, but present your unique voice and point of view.

If you don’t fit one box either

Narrowing to one thing usually turns you into a commodity. If plenty of people have your one thing, the pigeonhole becomes a race to the bottom on price. Being the best in the world at one skill is a brutal lottery. Being good at a few that rarely go together is more achievable, and often more useful.

So I try to focus on the problem, not the label. Problems that need several of my messy parts at once. Then folks cannot swap me out for someone better at one thing, or cheaper.

And the parts I was tempted to hide, because they complicated the story, turned out to be the difference. So I stopped hiding them. They are why someone picks me over the next person with the same title. More importantly, they are what makes me feel alive.

So when I hear advice about being one thing, I try to land in a niche and not a pigeonhole.

A pigeonhole is a box someone else puts you in, so they can find you quickly and file you away. It is built for their convenience. A niche, done properly, is one you build for yourself. It should hold everything you are, not the one thing that is easiest to introduce.

This matters more once you are on your own. Inside an institution, the title does the narrowing for you, and you have to live with it. In fact sometimes it is useful as it helps you reject work that falls outside the pigeonhole.

The trade for going independent was the freedom. So if I then let the market file me under one label, I would have swapped a boss for a pigeonhole.

So I am keeping my weird niche. It is hard to introduce in one line. But that’s fine. Who cares.

#IndependentLife #Niche #AIRiskManagement #Transitions #Reflections

I get asked what to read to learn AI quite often. Like every other week.

But I've just been too busy to sit down and filter out what's good. There are thousands of courses now. I have a long list that I collected for another project. Prompt engineering for lawyers. ChatGPT for accountants. Copilot for HR. AI for finance. The overwhelming proportion teach you the tool but not how it works. And I think sharing them all will overwhelm without helping. Also, I am fearful that I will share one that harms more than it helps. For example, I have seen courses that treat teaching AI as guiding people blindly through tools - prompt and awe, prompt and awe. With zero understanding. I detest such courses and training.

And so I am giving up sharing that long list for now. Until I find a better way to frame and filter them.

Also, that's not how I learned AI. I started a PhD in it at 42, with no computer science background. Before that, for around 5 years, I taught myself the basics the slow way, from a handful of resources. That period + my PhD studies spanned 2015 to 2023. Way before the hype sparked by ChatGPT. Most of these learning resources are still up. Many are free. So I shall start by sharing a reading list of those resources.

The reading list covers most of what I remember (some have been updated). Grouped by what they are good for. The on-ramps, like Andrew Ng. The books to keep on the desk. The explainers for when a concept will not click. And so on. Each with a note on why it is worth your time, and which to do first. Almost all of these were started before LLMs, but still relevant. Some more recent additions that fit. A course from 2017 will teach you more about how AI works than a viral post on ten things a chatbot can do.

I called it The Boring Reading List for Learning AI. Because that is what it is.

Get the ebook here.

#AI #MachineLearning #DeepLearning #LearningAI #SimplyBoringAI

Being incompetent may be a good thing, if you do it artfully.

Every one of my art styles started with a deep feeling of incompetence. I’ve learned to treat that as the beginning rather than the reason to stop. Not just for art.

A deliberately quiet week. So I can build and write stuff. My learning platform for my F2F classes now has close to 20 exercises with real AI testing libraries. I am now 70% through an online course on AI risk management. Developed based on what I have learnt thus far. And I’ve improved jobaq.me so it can now be tailored to any organization’s context for AI competency testing. Along the way I did a talk on AI agents for GARP buy-side risk managers, and had a discussion with a public sector institute on AI for policy folks. And somewhere in the middle of all that, a new watercolor style appeared. Which is what this piece is about.

On how being artfully incompetent is not just useful for creative pursuits, but also independent life.

My Styles Over 2 Decades

I have had roughly six distinct styles across twenty years of making art.

The first was panoramic street photography with a melancholic feel. Early 2000s. Empty spaces, quiet corridors, the texture of places about to change. I was obsessed with documenting what was disappearing before it did. The camera was the tool. The melancholy was the filter.

Then came the loose line drawings. Messy but detailed. A completely different mode and a completely different tool. I loved the practice of making mark after mark, whether on a digital canvas or paper.

Then the whimsical colorful illustrations with a touch of longing. This one arrived through a period when my kid was in and out of the hospital, and I whiled away nights with a tablet and nothing else to do. Singapore evenings. Weird back alleys. This led to a commercial practice. Prints for sale at Singapore souvenir shops. Canvas versions in art galleries. Mr Kiasu books. Commissions for Tatler and Wallpaper. Each one took hours of layering detail on detail. The style looked precise from the outside. From the inside it was controlled chaos.

Then watercolors of buildings. Starting normally, trying to do what watercolor is supposed to do. Washes. Wet on wet. The architecture rendered faithfully. It started when I was bored after graduating from my PhD studies, and spent a few weeks with Ong Kim Seng.

Then slowly the whimsical digital sensibility crept in. The colors got stranger. The lines got looser. The buildings started to look like they belonged in the same world as the digital illustrations rather than a faithful record of the real thing. I essentially started to heck it when it comes to watercolor conventions.

And this week, something new. Reversing the John Harris style. Harris paints epic architectural visions in darks with loose confident strokes and a splash of color. I tried doing the opposite - taking his compositional instincts and running them through a more whimsical palette. More Singapore than space opera. Still figuring out if it works.

Why Incompetence?

Every single one of these transitions started with a deep feeling of incompetence.

The panoramic photography felt like I was imitating photographers I admired without understanding what made them good. The line drawings felt like I was producing something messy when I wanted something precise. The whimsical digital felt too colorful, too loose, not serious enough. The watercolors felt like I was fighting the medium rather than working with it. The John Harris reversal this week felt like I had no idea what I was doing.

That feeling has never gone away. It arrives at the start of every new style. And I have learnt to live with it.

But artfully.

I don’t copy a style directly. Gen AI can do it.

What I do. Observe something that produces a feeling. Sit with it long enough to understand what specifically is producing that feeling. Then try to find my own version of it. Not the technique. The underlying feel.

When I tried the John Harris reversal this week I wasn’t trying to paint like John Harris. I was trying to understand what he sees when he imagines a city and then find what I see instead.

The other thing I’ve learned. Get it out there. Good or bad. Piece after piece.

I post the art. Good or bad. Week after week. The ones that don’t work are as important as the ones that do.

There’s no need to be embarrassed about learning in public. I’m learning, after all. And what’s the risk? That someone thinks that my art looks like crap? So what.

The Connection to Independent Life

Thirty five weeks ago I left MAS without a plan. What followed was a deep feeling of incompetence in a different domain.

New rooms. New formats. New relationships. New things being built without knowing exactly what they would become. The same feeling that arrives at the start of every new style arrived at the start of every new week.

The lesson from twenty years of finding styles has helped. The incompetence is not an obstacle. It is the signal that something different is being attempted. The alternative, staying inside the familiar, refining what you already know, produces a narrow competence, and a dead end.

And so that to me, is artful incompetence. It means choosing the new thing even when you can’t do it yet. Observing what produces a feeling. Finding your own version of it. Getting it out there before it’s ready.

And doing it again the next week. And looking back to absorb the lessons.

#ArtfullyIncompetent #Art #IndependentLife #Watercolor #Transitions #Reflections

AI will replace you. Someone who uses AI better will replace you. Why are you not AI native? Why don’t we have more AI use cases? And all the other AI FOMO rubbish. I’ve been deep into models and AI for decades. But such exhortations irritate me. Much of it comes from people with a vested interest.

But I can understand why AI makes people anxious. AI has also made me feel like there’s always more to be done. Especially as an independent.

Relatively busy week. Coffee with someone who heads AI and data governance. Lunch with an association about training. A full day teaching a room of bankers. Calls with a stock exchange, a European university, a governance institute, and a couple more. Discussions on advisory panels I may join. Building and writing stuff. And a watercolor most nights, before bed.

I have started wanting a simpler life. And more time doing what I enjoy. Some of it involving AI. Some not. Which led to some reflections on how to deal with AI’s effects on real life.

AI Hype & Reality

The AI discourse has become exhausting, and sometimes pointless.

Every other week something new drops and everyone performs awe. Every conference has a panel on what AI means for your job, or the latest ‘new’ use cases for AI. Frontier companies are now competing among themselves to see who is worse at cybersecurity and then writing open letters to scare everyone into taking responsibility for their mess.

I have been asked to do talks to excite folks about AI more than once. I usually decline or just talk about why excitement is not the best way forward. Not because I don’t know the use cases. Because I don’t see the point. Most use cases are variations of the same handful of tasks. The names change. But what’s underneath does not.

But I have to admit that AI has changed the pace at which I work.

I can now build a working app in a day or two, fully wired to a database, authentication, payments, LLMs and the works. I built a modular deck system on AI and AI governance last week that means I will never build a course from scratch again. I no longer use slides for my courses, but a learning platform I built over a fortnight, with demos, exercises, and hands-on, which also serves as my personal Mentimeter/Slido and PigeonHole. And I wired the learning platform to a whole range of AI testing libraries this Saturday. While also working on an AI screening app that allows clients to fully customize questions based on their context.

And so I find that AI has also started to hurt me.

Learning to Detach Again

Employees have structure. A job description. A manager. A defined scope. Which acts as a filter.

I have always been good at detaching at work. Work is work. Life is life.

But as an independent, there is no filter.

Every new thing arrives as a potential opportunity or a potential threat. Every new capability is a decision. Build with this? Offer this? Learn this? Ignore this? The decision is entirely mine. And when AI removes the friction from building, the temptation is to build and build and build. It can sometimes be close to an addiction.

But I have slowly realized that I need to detach as an independent too. Especially since AI makes you feel that you can always do more. And you start forgetting when to slow down.

And so I have become more deliberate.

More watercolors. Every night. Slowly. By hand. On paper. The change in pace stills my mind and heart before bed.

Replying slower. Not every message needs an immediate response. Not every opportunity needs an immediate yes or no. It gives my mind and heart time to reach a better decision.

Filtering out gigs. The ones that don’t pay. The ones that are interesting but not the right fit. The ones that are not worth any time. Better to use the time to build something of my own or spend time with family.

Choosing calls instead of face to face coffees or meetings. Thirty minutes on the call instead of two hours getting out of the house and back. Now that I have no office, every random coffee costs me a lot more time.

The goal is not to do less or slow down. But to slow down and pace myself.

So that I can live a simpler life.

#SimplyBoringAI #IndependentLife #AIRiskManagement #Transitions #Reflections

AI is not a standalone risk. I repeat. AI is not a standalone risk.

A recent chat with someone who has been looking at AI governance for a while reminded me of it. He was telling me about how a senior advisor had been pushing for AI to be a standalone risk area. And a centralized risk management unit responsible for all AI risks. And after some pushback, landing on a compromise - that even if AI risk was not fully standalone, there might be merit in treating it that way for specific use cases.

I told him that this makes zero sense. And that it will almost certainly lead to issues on both the innovation and risk side.

Why I think so. AI is not a separate thing. Try drawing a clear line between what is AI and what is not these days. For the recent incidents where LLMs from OpenAI, Anthropic and others hacked external organizations despite being sandboxed, would you view it as technology risk, or some special AI risk? If we let a separate unit own all AI risk including third party AI, what is the existing third party risk unit left with? You get the idea.

AI shows up inside the risks you already have. An AI credit model is credit risk. Nobody invented a new risk called “spreadsheet risk” when Excel arrived, or “internet risk” when the web did.

Have a central function to set the standard and coordinate, fine. But owning all the risk is a different thing, and illogical for a few reasons.

First, no levers. The unit is accountable for all AI risk, but the things that actually manage it - the data, the models, the deployment decisions, the vendor contracts, the security testing etc. - live in the functions it does not have control over. Responsible for everything, able to change nothing.

Second, gaps. You cannot cleanly cut AI out of the risks it lives inside. Every intersection between the new unit and the old ones becomes a gap where each side assumes the other should do it. That is where things fall through.

And the compromise - standalone treatment just for specific use cases - is worse. It is like standing up a brand new risk unit every time you launch a new product. One for the new savings account. Another for the new app. Another for the latest structured product. And every separate unit reinvents the wheel - for innovation, transformation or risk. Totally unscalable.

This is the spirit of a primer I wrote recently - A Primer on AI Risk Management from First Principles. AI risk management is a system whose parts hold each other up, and the controls only work when they interlock with what you already run. Build a silo for AI and you are in the worst of all worlds.

It is deliberately boring. Tell me where I am wrong.

Excerpts below, the primer can be found here, free for now. The fuller course comes later this year.

#AIRiskManagement #AIGovernance #AIRG

The mundane bores me.

And contrary to what people assume, independent life does not fix this. If anything it adds more. Since there is no longer anyone else you can ask to help with invoices, contracts, and all other administrative tasks. All yours.

So I have become a little obsessed with one question. How do I avoid doing the boring things more than once? The answer is finding a spine, system and unit. Which is exactly what I have spent this year teaching other people about - only in AI governance instead of life.

A lighter week. A call with UAE regulators. A lunch with a chief strategy officer at a government agency. A meeting with a startup founder. Building decks by modules instead of client by client. Several ebooks started or completed. A new watercolor style that started as an experiment.

I’ve been talking about the spine, system and unit of AI governance. On how, despite the crazy number of AI governance frameworks and publications, there is a converging coherence - the spine. On how one should stop treating AI governance as a crazy long checklist of controls purchased from a consultant, but as an interlocking system. And about how there could be a better unit of governance that repeats.

And I’ve realized that this applies to AI at work, as well as independent life. Some reflections on how one can see the spine, system and unit here as well

First, the spine, system and unit for AI governance

I have been including in my training a framework for thinking about AI governance - the spine, system and unit.

The spine is the set of core risk management components that does not change regardless of where you are. The world has gone crazy with the number of AI governance frameworks and publications but underneath all of them, there is more in common than different. So I tell people, anchor on one or two frameworks, and extend from there. Rather than endlessly mapping to more and more frameworks.

The system is an interlocking set of risk management controls that starts with answering the question of what risks you have. AI governance and risk management should not be treated as a checklist (especially a generic one that you just purchase from a consultant) but a clear interlocking system, where each part of the system and the controls link and leverage on each other.

The unit is the task. Not the model. Not the use case. Not the problem. The discrete activity where what’s good does not change with the seasons and technology. Focusing on the task allows one to build core capabilities that persist. And not trigger a new round of ‘transformations’ each time a new technology arrives.

Next, the same framework in AI and workforce transformation

I co-authored a paper with the Asia Tech Alliance recently - Making AI Work: A Practical Agenda for APAC Workers and Firms.

The paper argues that adoption is not transformation. And literacy is not fluency. That most organizations are stuck in what the paper calls the Exposed or Frustrated quadrant. Exposed - tools are present but neither the organisation nor the workers know what to do with them. Frustrated - workers have some literacy but the organisation has not changed how work gets done. And that the shift to Transformed requires all three levels working together.

There’s also a spine, system and unit here.

The spine is the foundation that an organisation builds on for every technological wave. Internet, mobile, apps, analytics, AI. And all the many different tools that come with each wave. There is more in common than different between these waves. Without a spine to build off, organisations keep starting over with every new tool and every new technological wave.

The system is the way technology and tools are integrated with the workflows, management practices, and oversight structures that allow worker fluency to translate into real business outcomes. A worker who completes an AI course and returns to an unchanged workflow or an organizational environment that stays in the past will never gain fluency.

And the unit is the task again. Not the job. Not the model. Not too different from the unit for AI governance I described above.

The same framework in independent life

I have been applying the same framework to independent life without naming it until this week.

The spine is not all my domains, one by one. My restlessness has led me to different domains across the years. AI governance, risk management, financial engineering, fundamental PhD research, finance, art and so on. But I have realized that there is more in common than different between these domains. I learnt about models in financial engineering and model risk management. But what I learnt there translated to AI. I learnt about math in finance. But that understanding also translated to using math to generate patterns and art, and think about the intersection of math in art and AI. And there are many more. And I have learnt that while this is a disadvantage as an employee, it’s an advantage as an independent.

The system is how those pieces connect, so I am not starting from zero each time. This is the part I only really began building recently. A talk becomes a post becomes an ebook, the ebook becomes slides, the slides become modules I can reuse. The modules I built this week mean I will not draw a new deck from scratch again for each and every client - I will assemble one from parts I have already tested. A platform holds all of it. The ebooks reach people who were never in the room. The system is what lets the spine work without me being present for every delivery.

The unit is the task. The specific things I am good at and that repeat. Again, not too dissimilar from the above.

The mundane is still boring. But I repeat less of it every month. That is what the spine, the system and the unit are for.

#IndependentLife #AIGovernance #SpineSystemUnit #AIRiskManagement #MakingAIWork #Transitions #Reflections

Benchmarks are useful for comparing models. But they have their limitations when you are trying to deploy something for your task that is part of your use case, in your environment, with your data, and under your constraints. Benchmarks are not a substitute for contextual testing.

I once asked a bank how they tested a coding agent. They replied that they used standard problems such as the traveling salesman problem, sorting etc. I said why did you do such useless testing? You could have saved your time by reading a paper benchmarking the model. Such testing told you nothing about how the agent would perform with your codebases, libraries and the organisation’s coding quirks.

Earlier in the year, I spent some time helping write a chapter in Singapore Computer Society’s AI Ethics and Governance Body of Knowledge on evaluating and assuring agentic AI systems. The chapter is called “Evaluation and Benchmarking for Agentic AI Systems: From Benchmarks to Assurance”. Co-authors are April Chin and Mia Hoffmann at Resaro.

It is now out. Here are some key points from the chapter:

A benchmark tells you what an agent can do. Deployment depends on what it will do, reliably and safely and at a cost you can live with, inside your own systems. Those are two totally different questions.

The reason is that an agent is not just a model. It is the harness around it - the planning loop, the tools that act on the world, the memory that carries mistakes forward, the connections into your systems. Classical evaluation was built for one model answering one prompt. It measures almost none of what an agent actually does across many steps.

Across many domains, most agents run only about ten steps before a human has to step in, and most teams still check them by hand. Evaluation is not keeping up with deployment. And you cannot scale what you cannot show to be reliable.

The chapter sets out the key layers to evaluate across, principles for doing it inside an enterprise, and a five-stage playbook for teams starting from nothing. The playbook does not start with public benchmarks. It starts with your own tasks.

Grateful to April and Mia for the collaboration, and to the Singapore Computer Society team and reviewers who made it sharper. Link in the comments.

#AgenticAI #AIRiskManagement #AIEvaluation #AIGovernance

Link (login required) - https://www.scs.org.sg/bok/ai-ethics-v2-1?document=b46188f7-523c-4332-9a5a-3ae006e0ac51

PDF print-out from SCS’ Book of Knowledge

Agentic Evals Clean

402KB ∙ PDF file

Download

Download

Gary Ang writes and advises on AI risk management, and AI in finance and investing - plainly, no hype. More at quaintitative.com

What does it mean to be 'good' at AI?

Good at prompt engineering? Able to use an AI tool well? An expert at deploying AI systems? Able to build and train a foundation AI model from scratch?

Perhaps none of these things. Not for most people, in most jobs.

Being good at AI could be both simpler, and harder.

Stephen Tracy and I built Job AQ as an experiment to think about this. A free and short behavioural assessment to understand how well you actually work with AI, not what you know about it. In contexts that are relevant. The scenarios are drawn from archetypes that match your job.

Here's what you get from it.

Before: A feeling. "I'm pretty good with AI."
After: A score, and blind spots likely to trip you up.

Before: No real idea where you stand.
After: Your 4 behaviours side by side, where you are strong and where you are weak.

Before: Guessing where AI would even help in your work.
After: A skills map with the opportunities.

Before, for a team: Adoption numbers that tell you nothing.
After: Who can be trusted with AI, and where the blind spots are.

Take it once and you have a baseline. Take it again in a quarter and you have a before-and-after.

Free. Fast. Try it at jobaq.me.

The free ebook below explains "The Whole Elephant" (based on my old illustration). In the carousel below.

#AI #AIFluency #FutureOfWork #AIRiskManagement

Jobaq Ebook Extended

825KB ∙ PDF file

Download

Download

Someone saw one of my LinkedIn updates last week and asked if I had gone back to a full time job. No way, I said. I’m pretty much still a Grab or Uber driver by another name.

A heavy week. A discussion with the risk folks of a major insurer. Two runs of my AI risk management course for a banking association. A full day of a similar thing for insurance professionals. A few new engagements agreed before the week was out.

Interestingly, I’ve started to explain what I do now, not what I used to do. A lot of art. A lot of training. Lots of building. A fair amount of writing. From AI governance to financial regulation to the deep technical stuff.

I’m essentially a gig worker. Someone needs training. Or a piece written. Or some other odd job. And I’m there. If the destination fits.

Some reflections on independent life. And what gig work has to do with portfolio theory.

From Grab to portfolio theory

Much of what I do is not so different from driving Grab or Uber. But I know the risks of this kind of life. And so I’ve reached back to an earlier part of my career to manage these risks. I used to run investment risk for Singapore’s foreign reserves. It turns out the same rules apply to a very different portfolio - my own independent life. So 5 simple reflections from this perspective.

Never let one client own you.

Concentration risk is the enemy of an investment portfolio. It’s also the enemy of independence. The moment you have a single paymaster, everything bends to that relationship. You’re a pseudo-employee without the benefits of a real job.

So I spread it broad on purpose from the start. This week alone - a major insurer, a banking association, an insurance body, and a handful of new engagements agreed: a governance institute, a university, an international regulator programme. My LinkedIn now has close to 10 live affiliations. And a few more coming soon, including an adjunct gig teaching AI financial forecasting.

And I tell people I don’t just do training. I can help write and build too. And I don’t just do AI governance. I can do financial and investment risk. And a variety of financial regulatory topics. And I can go as deep into AI technicals as you want me to.

Charge the risk premium.

Higher risk, higher yield. Grab has peak pricing. Every gig has its own return and its own risk, and the price should track both.

I try not to judge a gig by the fee in front of me. I think better to price it across its full lifetime. Some work pays nothing or little now and pays much more later. Some work pays well now and costs you your freedom. And occasionally, there are the requests that just want to borrow what you have for free. Forever. For something called exposure that I do not care for.

I’ve become a lot clearer-eyed. And I try not to confuse being busy with being paid.

Have some dividend-yielding assets.

Much of what I do only pays when I am in the room, and it stops the moment I stop. That’s the biggest issue with such gig work. You can be fully booked and still be selling hours one at a time, forever.

So I have been building the other kind. This past week my ebook store went up. At learn.simplyboring.ai. 5 ebooks now. Another 10 in the works. Write it once, sell it many times. It is slow and unglamorous. But an ebook is the closest thing I have to an asset that pays dividends while I am doing art.

Hold something uncorrelated.

Every portfolio needs a position that does not move with the rest. Mine is the art. It pays almost nothing, but that’s not the point. This week, tired after four days of delivery, I started a whole new watercolour style anyway - because I cannot keep still, and because painting is the one thing I do that has nothing to do with AI.

I have no illusions that the interest in AI will last forever. Everything cools. The frameworks get commoditised, the novelty wears off, someone builds a tool that does the boring parts. The AI side of me will become irrelevant one day. When that day comes, I hope the art, the platforms, and the odd non-AI thing can help me hedge.

Rebalance when the work comes.

My life is now full of peaks and troughs. Sometimes, there are too many gigs. Sometimes, close to zero. And so when the email comes, the instinct is to grab all of it. Partly greed, partly the old fear that it might dry up tomorrow.

Now that I am at month 8, I can see a clear need to rebalance. I cannot keep taking every gig at the same price. I need to do fewer, and charge more for the hard ones. And say ‘no’ more often. Which I have now realised takes some skill. Even Grab drivers decline gigs, or wait for peak pricing. And the irony is that I have not rebalanced my own investment portfolio for months. And that’s also something one needs to keep watch on when independent.

So, a gig worker

A Grab driver and an independent like me are not so different. Both are just managing a portfolio. Mine is now 2.5 companies - Quaintitative (I know, confusing name) for the work, Simply Boring AI for the products, and a stealth one I am building with Stephen Tracy.

Almost 8 months in. The portfolio is taking shape. I still cannot keep still. And I don’t think that is going to change.

#IndependentLife #Quaintitative #PortfolioThinking #AIRiskManagement #Transitions #Reflections

At a board briefing, a director from a financial institution asked me a simple question - what do I actually need to know? I don’t think I answered that question well.

First, I did not have a clean answer to point him to. There has been plenty written for boards in general. I could answer his questions with what was in these publications, but that would not have been totally correct for finance. Second, answering it in detail takes a bit more than can be contained in a simple answer.

The Singapore Institute of Directors also put out its AI Guide for Boards in Singapore recently - a broad and generous map of the whole AI question a board faces. Strategy, value, talent, resilience, governance. Not a bad place to start.

What it said is generally applicable. But the financial sector’s risk management discipline, built over decades and paid for in real losses, has its own demands.

When the SID guide does reach into the financial sector, it reaches for the FEAT principles - Fairness, Ethics, Accountability, Transparency. Good principles. But principles are all they are. They tell you what a good outcome looks like. Not how to get there.

I had a hand in Singapore’s first set of AI risk management guidelines for the financial sector - the MAS AI Risk Management Guidelines (AIRG).

As the SID guide did not mention the AIRG, I decided to try to use this opportunity to answer the director’s question the way I know best - written, and through a financial-sector lens. This book uses the SID guide as a starting point (no point re-inventing the wheel), and connects it to the AIRG.

It is deliberately boring.

It starts with the five core areas in the AIRG that a board has to be responsible for, and the 5 questions I had shared with the board.

And then I go deeper.

It is just a start. So no matter how this got into your hands, feel free to pass it on.

The last page tells you how to reach me if you would like to argue with me. Tell me where I am wrong. I would like to learn more on this.

Just subscribe for free to my Substack to get access to the full ebook. Details in the email when you subscribe.

#AIRiskManagement #AIGovernance #AIBoards

Excerpt below.

Excerpt Ai Risk Management For Directors

1.47MB ∙ PDF file

Download

Download

I’ve been “unfocused” for many years.

Over the years, I’ve been interested in writing, speaking, building, teaching, researching and painting. Aside from finance, I have spent significant time in the creative industries and academia. And a number of side hustles - selling art prints, doing commissions, even selling Nokia mobile covers on EBay.

In a full time job, that’s usually a minus. You either get viewed as unfocused, or get asked to do things outside your job scope.

But now as an independent, it’s great.

A week of delivering and building. Several talks across different rooms and audiences. From one for the Singapore Venture Capital Association to another for foreign public servants for an SMU executive education programme. In the evenings, I am writing a book on boring questions that directors should ask on AI risk management. And building an AI governance game for an upcoming course, to address feedback from my learners. And at the end of the week, a conversation with an old friend and artist sparked a new production idea. Also managed to do more art this week.

The diverse range of things I did in the past made me grateful that I do not have to rely on anyone else to write, speak, build, teach, research or paint for me now. And led to some reflections on how something that was a bane when I was in a full time job is now a boon.

Focus and a full-time job

Full time jobs don’t usually like people who do many things. They need to box you. The performance review needs a focus area. There is always a risk of someone thinking that you are slacking off by working on your own interests.

Until someone needs a photographer for the work event. Or an illustration for the retreat. Or a creative take on something nobody else can handle. And suddenly the breadth that was supposed to hurt real work becomes useful. Because you can do it and nobody else can.

Over the years, I learned to keep work, and my many other interests separate for this reason. There’s no point. The institution will use your breadth whenever it’s convenient and brand you unfocused whenever it isn’t. Both at the same time. Without seeing the contradiction. There’s no malice. It’s just the way the world works.

Another useful lesson from those years is to draw the line based on relationships. You don’t say yes to everyone. Neither do you say no to everyone. You help those you like and trust. For the rest, no is the default.

The lack of focus is now liberating

As an independent, the stack helps.

This week I stood in front of a room of venture capitalists and talked about a world I do not know deeply because I have touched it once or twice during my frequent wanderings. I sat with an old artist friend and helped him think through using AI for a creative project, because I happened to do both art and AI. And instead of making yet another deck for a course, I built a small game, because I can build, design and understand the governance content at the same time. And AI has made all of these easier.

A few things have become clearer, now that the breadth is finally mine to use.

The “unfocused” label was never really about me. It was about a box I did not fit, and someone else’s discomfort with that. I half-believed it for years. I don’t anymore.

And I am not sure “unfocused” was ever the right word. Spread out, sure. But I gave each of them real time, not spare weekends. I am not brilliant at any of them - the painting is still lousy half the time - but none of it was dabbling.

The “unfocused” years turned out to be the ones that saved me. The side hustles, the detours, the odd skills nobody asked for - they may have cost me something in a career, but they are exactly what I get to use for myself now.

One thing has not changed. I still draw the line by relationships - I help the people I like and trust. What changed is another bonus of independent life. The default used to be one option - no. Now I can also use money as friction.

#IndependentLife #RojakLife #AIRiskManagement #Art #Transitions #Reflections

Nit-picking has been an occupational hazard for me since forever.

I recall someone from my team coming to me once. The number of tracked edits I had inflicted on her paper was causing her some distress. My answer was not to worry. I was doing the same to everyone else in the team. I assured her that her appraisal would be fine.

I’ve a slight streak of OCD in me. And I suspect it’s time for some karma. Worrying about small things when working a full-time job, especially in MAS, is generally a positive thing. Especially when you are drafting acts, regulations, or clearing contracts involving significant stakes.

And this week was a crazy bad one for this OCD. A talk for the leadership of a Ministry. A briefing to the board of an insurer. A talk for civil service directors doing a leadership programme. Three training sessions. One for a digital asset company. Two for senior leaders of a bank coming to Singapore for an executive leadership programme. Contracts after contracts. The launch of the JobAQ platform I did with Stephen Tracy. I was so tired at the end of a week I crashed and napped and missed a night call with someone from Toronto discussing training for some international regulators.

As an independent, I find the habit of worrying too much to be a bad thing. The stakes are way smaller. But I still worry before every talk. I read every contract twice, pass it through AI, then read again. And then worry about what the other party will think about my pushback. I check the demo the night before and again the morning of. I worry about the increasing number of ‘nos’ I say. These days I even have a niggling worry that something I wrote will be seen as AI generated.

But I think I am starting to learn how to deal with it. Sharing how it looks from the inside of independent life below. And my five rules for dealing with it.

The worry before and after every room

The engagements that stressed me out for the week.

Before the session for the leadership of a Ministry, I kept wondering why my deck, which came from my boring perspectives in the financial sector on AI governance would be relevant. I was quite happy that I connected them to Dr. David R. Hardoon who had a broader and more exciting perspective than me and that he would go first. Though I had secretly wished that they would feel there was no need for me.

Before the briefing to board of the insurer, I was worried about the relevance of my slides to their world. I’m not and have never been a director of a board. While I had staffed the MAS board for two years, that was mostly administrative. The session went smoothly. And there was one win. Someone said that a pre-read I wrote and shared was certainly not boring. But my internal spidey sense told me I had not given them exactly what they needed.

The two sessions for the senior leaders of a bank coming to Singapore for an executive leadership programme was worrying in a different way. The material was familiar to me. But it was a crowd that needed the material to be in Mandarin. There were translators, but conducting training through an intermediary is usually challenging. I tried using my half past six Mandarin (my entertainment diet is usually Mandarin shows on TVB, iQiyi and Viu after all). Was that a win or lose? I was not sure.

Even someone asking for my bank account for the honorarium of a paper on evaluation and testing for Agentic AI I wrote worried me a little. Because that meant the paper was done, and I worried if I had checked it enough.

By the end of the week I was in a heck-it mood. And I told the room of civil service directors doing a leadership programme that my aim for the 30 min talk was to make AI boring to them. And that my secret wish was that AI would become boring and fade into the background so I would not need to do any more of these panels and talks.

And I filtered contracts that could have led to some risks. One only paid for delivery but buried deep in its agreement was one line that would have transferred the rights to my IP to them. And there were other more minor things that needed to be caught.

This is what independent life feels like from the inside. Most probably think it’s freedom. From emails from bosses. From KPIs. From worry.

That’s not the case. All the worries remain. But all of it is yours alone to bear. No team to catch the error. No colleague to sanity check the piece. No institution to absorb the mistake.

So you check. Then you check again. And check one more time.

What I think one can do about it

First. See the stakes for what they are. Most of the time they are not as high as the worry makes them feel. The habit of treating everything as high stakes is a residue of environments where things actually were. Most things aren’t. Be clear about the real stakes. Don’t imagine them.

Second. Diversify. As much as possible. When one thing carries all the weight, the worry amplifies. Spread the load across enough engagements, projects and relationships and no single one becomes existential. It’s not just money that allows one to walk away. Choices help too. This is also just risk management 101.

Third. Detach from the outcome. Deliver the best you can. Then let go. The worry almost never predicted the outcome accurately anyway. The rooms that stressed me most often went fine. The ones I felt relaxed about sometimes went flat. That latent worry is a bad forecaster. Stop consulting it for predictions.

Fourth. Know your redlines. Not everything in a contract or a conversation needs to be negotiated. But some things do. Being clear early about what you will and won’t accept turns anxious reviewing into decisive filtering. For engagements themselves, use money and relationships as the filter. Calibrate your redlines of what you will do and not do based on how much you like the person vis-a-vis the remuneration. The more you like the person, the less money matters. And vice-versa. The worry shrinks when you know exactly what you’re protecting and why.

Fifth. Lose yourself in something that has nothing to do with any of this. For me it’s a watercolor every night before bed. One hour where presence is required and the worry has to wait. You cannot paint and worry at the same time.

#IndependentLife #Worries #AIRiskManagement #Transitions #Reflections

Try it.

#IndependentLife #Worries #AIRiskManagement #Transitions #Reflections

A director asked me a question at my briefing to a board yesterday. So what do we need to know about AI to do our jobs? I don’t think I answered it to his satisfaction. But what I’m sharing below might help you to answer it for yourself.

It starts with an elephant illustration I drew more than a decade ago. I dug it out and made it the motif for an app I built with recently.

Why?

Remember the six blind men who meet an elephant? One grabs the trunk: “a snake.” One touches the ear: “a fan.” One hugs a leg: “a tree.” All equally certain. All equally wrong.

I suspect that’s how AI feels to many of us right now. We each touched one part of this broad and deep thing. A few prompt tricks. One good demo. One project that went wrong. Some AI development in the news that seems like science fiction. But do we know the whole animal?

Certificates prove you sat through a course. Using an AI tool is, well, just using a tool. Quizzes prove recall. A prompt engineering course teaches you zilch about AI. Just how to type things into a text box. The snake. The fan. The tree. Not the elephant.

Job AQ is an experiment by Stephen and me. A simple (ok, maybe not that simple) behavioural assessment of how you work with AI. Not what you know about it. Scenarios drawn from your own job.

You don’t just get a score out of 100. You see where you stand on 4 dimensions - understand AI, work with AI, evaluate AI, own AI risk. Where your opportunities are, given your job archetype. And the gap between what you believe about yourself and what you actually did. So far, that gap surprises almost everyone.

The video below walks through the whole thing. (Yes, I know I look a little shabby, but it’s been a really long week.)

It’s at jobaq.me. Try it. Then send it to the five other people holding your team’s elephant.

#AICompetency #AIFluency #AI #JobAQ

~300 watercolors in one video. And a question on authenticity.

The past week I laid out every watercolor I have painted in the last two years. Just over three hundred of them. I did it to make a short video to see how my style has changed and try to get better. But somewhere in the middle of compiling it, I started thinking about authenticity and AI.

It was a full week otherwise. I finished my July series of AI risk management courses for the Association of Banks in Singapore - three runs, and by the end the feedback had flipped from “too technical” to “we want more”. I enjoyed an evening talk on time series forecasting at SMU for a mix of Singaporean and Korean masters students. A paper on AI and the workforce co-authored with ATA that went out, that I also enjoyed writing. A pile of slides for the weeks ahead. A number of training proposals - requests that interestingly came through my website. And, as always, a watercolor most nights before bed.

But it was the menial process of scanning three hundred paintings (which I did not enjoy at all) that sparked some thoughts.

Proving authenticity with AI is kind of stupid

You cannot fake a real physical watercolor piece. The water goes where it wants. The paint shifts in a way no one fully controls. It is impossible to do the same exact piece of the same scene with watercolors, even if you used a robot. In a world where almost nothing is provably human anymore, that turns out to be fairly uncommon.

And it made me think about writing, because judging authenticity in writing is hard. And somehow or other, it has become a lightning rod.

You cannot prove you wrote something by hand. Writing that we consume these days is rarely physical. Even if you sat down with pen and paper - you would still type it in to post it. Nobody handwrites a page, photographs it, and uploads the photo. (For now at least. Maybe someone will have some ideas after this.)

Whatever physical act happened, if it happened at all, becomes irrelevant the moment it goes online. No one can tell you who or what put the words there.

Substack recently started scanning posts with an AI detector called Pangram, and it did not go down well. The idea is to hand back some of that lost proof - to score how likely a piece was written by a machine. With a machine (!?).

I understand the instinct. But it is solving the wrong problem, doing it badly, and with a machine that could be generating slop itself.

Start with badly. Writers began getting flagged on their own work that’s theirs. Not AI.

I call this using AI slop to find AI slop.

We think we are solving the problem of AI slop. But Pangram itself may be slop. Biased slop that may fall hard on people who write in a certain way, such as non-native speakers of English.

And even a perfect detector would be solving the wrong problem. The process was never the point. If we grade writing by how little AI touched it, we are measuring the purity of the method, not the worth of the idea. It rewards effort and ignores whether there was any thought behind it.

What is left

If you cannot prove how something was made, the only thing left to judge is whether it is any good. Whether there is a real idea in it. Whether a real person, with a real stake in what he is writing about, stands behind it.

That is uncomfortable, because it is harder. It is much easier to check a box that says “100% human” than to ask whether someone actually has something to say.

The watercolor is safe from all of this, and that is probably why I hold on to it. It is the most uncorrelated thing I have - slow, on paper, no prompt, no model. And if you ask me for proof, I have it. Indisputable. No slop like Pangram getting into the mix.

I have no idea how to solve AI slop. But let me reframe it as three questions.

One, do we need another possibly biased AI black box to tell us something is slop?

Two, if we let go of proof - if we accept that we can no longer tell the human from the machine, and choose to judge only the idea - do we lose something real?

Three, do we really know what authenticity is? It has changed, numerous times, across the ages.

#Authenticity #Art #AI #Writing #Reflections

My days now are mostly training people on AI - with a startup being built stealthily on the side, and the odd bit of helping folks write things, which I genuinely enjoy.

And training people day after day, I keep seeing the same thing: plenty who've done some AI course, very few whose work actually looks any different.

That's the gap. We've mistaken doing a prompt-engineering course for fluency, and buying the newest tool for transformation.

So when the folks at Asia Tech Alliance invited me to co-author a piece on this, I said yes pretty quickly - it's something I care about. The paper pulls together some ideas on what to do, and frameworks for thinking about it.

Many from far greater minds than mine (especially the folks listed below). And one we synthesized: the Fluency–Transformation framework. Two dimensions - worker capability on one axis, organisational capability on the other - and four places a firm and its people can end up: Exposed, Frustrated, Extractive, or Transformed.

The premise is simple. Real transformation isn't measured by licences sold or courses completed, but by whether the work itself looks different twelve months on.

This piece is something dear to me, and I hope it helps folks think a little differently about AI at work. Even if it shifts the conversation just a bit, I'm happy.

So do take a read below, and tell me, and the folks at Asia Tech Alliance - what you think.

Ai Work

23.1MB ∙ PDF file

Download

Download

Or if you prefer a direct link - https://www.asiatechalliance.com/makingaiwork

Christina Schönleber | David Autor | Franziska Ohnsorge | Soon Joo Gog | Ingo Laubender | Pei Ying CHUA | Priyank Hirani | Trisha Suresh | Young Park | Lih Shiun Goh | Natasha Gašparič-Gray | Sharon Tan

#MakingAIWork #ArtificialIntelligence #FutureOfWork #SMEs #AsiaPacific

Adoption without understanding. Shallow literacy.

Prompt engineering as a career skill. Now loop engineering. Courses that teach you the latest tool in the most superficial way.

The hype has turned a genuinely interesting discipline into a noise machine. It’s bothered me for a while.

A busy week of delivering and building. The first run of my AI risk management course for the The Association of Banks in Singapore. A panel for private bankers. A few chats with founders asking if I’d like to advise or collaborate.

The steps below are some of my small answers to the hype.

Teaching the boring stuff

I enjoyed the first run of a deep dive into AI governance and risk management with the Association of Banks in Singapore. The content isn’t about how exciting AI is. It’s about AI risk management as a discipline and a system. Why AI fails, and what to do about it.

Everyone wants the excitement. I’ve been asked to excite an audience more than once. But what’s the point.

Get excited for what. So you can misunderstand what AI is and what it can do?

The course is my small answer to AI training that doesn’t build anything durable.

Art as a different kind of answer

A watercolour every night before bed. I illustrated for years before this, but watercolour is its own discipline, and not every piece works. Many end up in the bin. I really miss the undo button.

But the practice helps. The eye gets better. The hand gets more confident. The gap between what I see and what appears on paper gets slightly smaller.

Gradient descent, one piece at a time.

In a world where AI can generate infinite images in seconds, making something by hand at midnight grounds me. Slow. Imperfect. Irreducibly human. The progress doesn’t look like progress most nights. Just a brush in water. Pigment on paper.

My little act of rebellion in a world of hype.

AI assessment

Job AQ. Not about what tools you know, but how you think about AI - whether you understand it, can work with it, evaluate it, and own it.

Job AQ is a collaboration with . It’s our small answer to the broken world of AI training. Rather than fighting with the noise, we are coming at it from the other end: assessment rather than courses.

I’d be grateful if you tried it and told me what you think - jobaq.me.

None of these are big answers. The course is one course. The art still fails more than it succeeds. Job AQ is a 15 min exercise. But they’re what I can do.

#IndependentLife #AIRiskManagement #Art #JobAQ #Reflections