KBTG's Chatchawat Assawarakwong, speaking at Techsauce Global Summit 2026, cited Gartner research: only 7% of organisations are rated AI-ethics leaders and 31% have strong enough AI governance. He warned that when staff use public AI tools, the company cannot see what data goes in or what comes out. Customer-facing uses such as complaint handling carry real liability if AI gives wrong answers. Starting points he named include the EU AI Act, ISO/IEC 42001, NIST's AI risk framework, and Thai guidance from ETDA, NCSA (สกมช.) and the Bank of Thailand for financial providers. For a small business, the practical step is a simple written AI-use policy for staff, starting from these existing documents.