The CFO
Sees the return on AI: which initiatives earn their keep, and what the controls will cost.
Loading
Loading
AI Investment & Control Review
An AI Investment & Control Review for the board, the chief financial officer and the chief risk officer.
AI Value Ledger: evidence-based scoring, human professional judgment.
AI Value Ledger is a consultant-led review, with software behind it. The review builds an inventory of the AI systems an organization uses, scores the evidence the organization can actually show, gives each AI initiative an investment call, and sets how much authority AI-supported decisions are allowed to have.
The software keeps a register of the organization’s AI systems, including tools adopted outside a formal program. You cannot govern AI you have not identified, and you cannot capture value from it either.
Each use is scored on demonstrable evidence, against the EU AI Act, ISO/IEC 42001 and the NIST AI Risk Management Framework. Where the engagement asks for it, the same evidence can be mapped to Singapore’s Model AI Governance Framework and to AI Verify.
Each AI initiative receives one call, with the cost of the controls that call requires.
For decisions that AI supports, the review sets an authority level through seven trust controls. The result is a decision register, reassessed every quarter.
The review is built to answer four questions a board can ask in one sitting.
Sees the return on AI: which initiatives earn their keep, and what the controls will cost.
Sees the exposure: which uses carry risk the organization cannot yet evidence.
Sees which decisions AI can be trusted with, and at what level of authority.
Receives a record it can examine: the register, the evidence, the investment calls and the decision register.
An organization cannot govern AI it has not identified, and it cannot capture the value of AI it has not identified. The inventory is the starting point. The rules around that inventory are already in force in some places, and still being set in others.
The notes below are a reading of public sources as of October 18, 2026. They are orientation, not a statement of the law. Confirm the current text in the official gazette before you rely on a date.
Regulation (EU) 2024/1689, the EU AI Act, is amended by Regulation (EU) 2026/1744 (the Digital Omnibus on AI), published in the Official Journal on July 24, 2026. The Official Journal is the authentic text. The European Commission’s AI Act Service Desk describes its pages as the EUR-Lex consolidation as of July 27, 2026.
For prohibited AI practices, Article 99 sets administrative fines of up to €35 million or, if the offender is an undertaking, 7% of its total worldwide annual turnover for the preceding financial year, whichever is higher.
On the consolidated timetable in Article 113:
The NIST AI Risk Management Framework is voluntary. It is a way to organize risk management. It is not a statute.
Colorado replaced Senate Bill 24-205. Senate Bill 26-189 was signed on May 14, 2026. The Act takes effect on January 1, 2027, apart from specified provisions that took effect on passage, and it applies to consequential decisions made on or after January 1, 2027. The Colorado Attorney General states that the new automated decision-making requirements take effect on that date.
New York City Local Law 144 requires a bias audit, and notice to candidates, for certain automated employment decision tools. Confirm the current scope and dates in the local law.
The US Federal Trade Commission enforces the longstanding prohibition on deceptive acts and practices. That authority covers claims about what an AI system can do.
The United Kingdom has not enacted a single AI statute. Existing regulators, including the Information Commissioner’s Office, the Financial Conduct Authority and the Competition and Markets Authority, apply the law already in force. The government’s approach is principles-based, including safety, transparency, fairness, accountability and redress.
Section 80 of the Data (Use and Access) Act 2025 replaced Article 22 of the UK GDPR with Articles 22A to 22D. Those articles have been in force since February 5, 2026. A significant decision based solely on automated processing — a decision with a legal or similarly significant effect, taken with no meaningful human involvement — requires safeguards. The safeguards include information about the decision, an opportunity to make representations, human intervention and a right to contest the decision.
Singapore’s Model AI Governance Framework, published for organizations by the Infocomm Media Development Authority and the Personal Data Protection Commission, is voluntary guidance. AI Verify, from the AI Verify Foundation, is a testing framework an organization can use to show how a system was checked. Personal data remains under the Personal Data Protection Act and the PDPC’s advisory guidelines on the use of personal data in AI recommendation and decision systems.
The UAE Charter for the Development and Use of Artificial Intelligence, issued on June 10, 2024, sets principles for ethical and responsible use. It is a charter, not a binding AI statute. The federal personal-data law is Federal Decree-Law No. 45 of 2021. In the Dubai International Financial Centre, Regulation 10 of the Data Protection Regulations, in the text enacted on September 1, 2023, governs personal data processed through autonomous and semi-autonomous systems.
The Saudi Data and AI Authority has published AI Ethics Principles for the development and use of AI. They are principles, not a certification. Personal data is governed by Saudi Arabia’s Personal Data Protection Law.
This page does not rely on a general AI statute in Qatar. The Qatar Central Bank has published Artificial Intelligence Guidelines for the institutions it licenses. The guidelines address governance, risk assessment, disclosure and approval before higher-risk systems are launched. Confirm the current text with the Qatar Central Bank.
EkaC Global Consulting delivers the review. Shanka Wickramasinghe is the founder.
Last updated: October 18, 2026.
The material on this website, including the AI Pulse and any indicative result, is general information. It is not legal advice, regulatory advice, tax advice or investment advice. It is not a recommendation to buy, sell, hold, accelerate, stop or change any system, control or investment. Reading this website, or sending an inquiry, does not create an attorney-client relationship, or any other advisory relationship, with EkaC Global Consulting or with Shanka Wickramasinghe.
Laws, regulatory guidance and technical standards differ by jurisdiction, and they change. A description on this page is a summary for orientation. It is not a statement of the law of any place, and it may be out of date on the day you read it. Confirm the current text with the official source, and with advisers qualified in the relevant jurisdiction, before you act.
A review, a score, an investment call or an authority level depends on the information, documents and access the client provides. EkaC Global Consulting does not independently verify every fact a client asserts, unless the written engagement says so.
Pulse answers are self-reported. A Pulse result is indicative only. It is not an evidence-scored review, and it is not a finding about compliance, risk or value.
To the extent permitted by law, this website, the Pulse and any related material are provided as is and as available. EkaC Global Consulting excludes warranties of accuracy, completeness, fitness for a particular purpose and non-infringement, whether express or implied.
To the extent permitted by law, EkaC Global Consulting and its founder are not liable for loss or damage arising out of the use of this website, reliance on its contents, or a self-reported Pulse result. That exclusion covers direct and indirect loss, including loss of profit, revenue, data or goodwill, whether in contract, tort or otherwise. Nothing on this page excludes or limits liability that the applicable law does not allow to be excluded or limited.
“EU AI Act”, “ISO”, “ISO/IEC 42001”, “NIST”, “NIST AI RMF”, “Model AI Governance Framework”, “AI Verify” and related names are used only to identify public frameworks. Those names and marks belong to their respective owners, including the International Organization for Standardization, the National Institute of Standards and Technology, and the AI Verify Foundation. Use of a name does not imply endorsement, certification, sponsorship or affiliation.
Where the EU General Data Protection Regulation or the UK GDPR applies, EkaC Global Consulting handles personal data under that law. If you use the Pulse, the email address, company name and answers you submit are used to respond to your inquiry and to prepare any follow-up you ask for. They are not sold.
To request access, correction or deletion, or to raise a concern about personal data, write to trust@aivalueledger.com. The Privacy Notice and Limitation of Responsibility sets out how personal data is handled and the limits of responsibility.
Last updated: October 18, 2026.