index: blog · posts: 47 · author: Siddharth Surana
Notes from the build.
Agent protocols, AI governance, and the regulatory ground shifting under Singapore businesses. Written by the people building Cerebrum.
Which AI Model Should Write Your Marketing and Sales Content?
September 2026 brought a wave of new AI models and a 100-fold spread in list prices. For marketing and sales copy, the token bill is rarely the cost that decides anything. Editing …
How to Measure LLM Visibility: Citation Share, Not One Screenshot
Rankings were a list. AI answers are a sample. Google now counts your AI impressions, but only a fixed prompt panel, run repeatedly, tells you whether you are winning against compe…
Bee Cheng Hiang AI Data Breach: PDPC Undertaking and SME Lessons
The AI coding tool did not malfunction. A script tested only by its logs, with no second reviewer, exposed 95,364 members' email addresses. The five measures in the undertaking PDP…
AI Vendor Due Diligence: Questions to Ask Before Buying an Agent
Governability is a procurement requirement, not a post-signature project. Ask the vendor to stop the agent in front of you, then write what you saw into the contract.
Build or Buy an AI Agent? Decide on Control, Data and Exit Cost
Feature lists are the wrong axis. For a first agent, decide who controls the permissions, where the data goes and what leaving costs. Most SMEs should buy the agent and own the gat…
AI Incident Response Plan: The Triggers and Clocks Cyber Plans Miss
Most AI incidents are not breaches: wrong decisions at scale, an agent acting outside its mandate, a stolen AI key. Your cyber plan has no trigger for them, yet a regulator's clock…
EU AI Act AI-Generated Content Labelling: What 2 December Changes
The December date is your AI vendor's deadline, not yours. Your duty to label deepfakes started in August. For most businesses the real job is to label the right assets and stop st…
How Much Does an AI Agent Cost? Price the Completed Task
Token prices are the smallest line on an agent's bill. Retries, human review minutes and failure recovery set what a finished task really costs, and the expensive tasks hide in the…
When Does the Colorado AI Act Take Effect? What Asian Vendors Owe
Colorado's May 2026 rewrite cut its AI law down to disclosure duties that apply from 1 January 2027. For a vendor in Asia, the duty that survived is the developer's: the paperwork …
Malaysia AI Governance Bill: What Is Known and What to Do Now
Malaysia's AI bill is still a draft, but its data protection regulator already expects an impact assessment for automated decisions that significantly affect people. Preparing for …
AI Agent Identity: Least Privilege and a Kill Path per Agent
An agent running on a shared API key is an employee with no name, no manager and every door key. Give each agent its own identity, scopes it cannot exceed, and a revocation path yo…
Who Is Liable for AI-Generated Ads? The Business That Runs Them
Singapore, US and EU advertising rules test the claim, not the drafting tool, and they ask for evidence. An AI label does not supply it. Gate the claims, not the drafts.
AI Agent Business Continuity Plan: Keep the Manual Skill Alive
A second model covers one failure. The one that hurts is quieter: an agent that is up but wrong, and a team that no longer knows how to do the job by hand.
AI Audit Trail for Agents: The Six Questions Your Log Must Answer
An immutable log of API calls tells an investigator what happened, never why. Design the agent's audit trail around the questions an investigation asks, and capture each answer fro…
Is ISO 42001 Worth It for an SME? Certify, Align or Wait
For most SMEs, the value of ISO/IEC 42001 is the management discipline and the buyer questionnaire it answers. The certificate pays when a named buyer, tender or market asks for it…
How to Prevent Prompt Injection: Contain What the Agent Can Do
Attackers do not need your chat box. They need one field your AI agent will read. You cannot filter your way to safety, so treat the agent like an insider and limit what any one me…
AI Sales Outreach and the PDPA: Consent, DNC and the Pre-Send Gate
An AI sales agent turns one stale consent record or expired DNC check into thousands of non-compliant messages in an afternoon. The fix is a gate the agent must call before every s…
WhatsApp AI Chatbot Rules 2026: Meta's AI Ban, Pricing and Real Cost
Meta bans general-purpose AI assistants on WhatsApp, not sales agents. Stay scoped and the real cost question is people, not tokens: handoffs move the bill more than the choice of …
Human in the Loop AI Governance: Is Your Approver a Rubber Stamp?
Suppose a reviewer approves 99% of agent actions in four seconds. The log proves a click, not oversight. Measure the approver as well as the agent, then keep human review for the d…
Do You Have to Disclose an AI Chatbot? 2026 Rules, Market by Market
In the EU, yes, since 2 August 2026. Parts of the US already require it too. Disclosure costs one sentence; a bot that passes as human costs fines and trust. Build it once to the s…
PDPC Advisory Guidelines on Generative AI: What SMEs Should Fix
The 20 July 2026 guidelines turn "we use AI" into specific notice and consent design choices. The trap: making AI-training consent a condition of sign-up, which PDPA section 14 can…
MAS SAFR Agentic AI Safeguards: What Banks Should Build at Runtime
SAFR is a voluntary white paper from MAS and eight industry contributors, not a rule. Its real shift: agent governance moves from a pre-launch sign-off to a checkpoint that rules o…
The Agentic SDR Is Here: What to Automate, What to Gate, and the Checkpoints That Save Your Pipeline
Agentic sales development agents now prospect, personalize outreach, qualify leads, and book meetings on their own. The version that survives is not the autonomous one. It is the l…
Agentic marketing's ROI is real. Governance is what keeps it.
The return on marketing agents is now measurable, and so is the failure rate. The gap between them is governance, not model quality. Here is how to capture the upside without letti…
Singapore's 400% AI Tax Deduction for SMEs: What Budget 2026 Actually Gives You
Budget 2026 made AI spend tax-advantaged for Singapore SMEs. The one new number you can bank on is narrow, time-boxed, and only survives an audit if your deployment is documented, …
Why AI Agent Projects Get Cancelled, and the Readiness Controls That Keep Them Alive
Most agent pilots stall for reasons you can see coming: no defined success, no clean live-data reach, and unbounded output to customers. Each failure mode maps to one readiness con…
Discover in AI, Buy on Your Site: The 2026 Agentic-Commerce Settlement
In-chat AI checkout stalled in the field. AI-driven discovery exploded. The working model that emerged in 2026 is a clean division of labour: the assistant handles discovery and re…
Qwen 3.8 Max vs Claude Fable 5: What You Can Actually Measure Today
Qwen 3.8 is announced, purchasable as a preview, and still unmeasured. There is a price gap that shrinks from 5x to 2.7x once you count real tasks, a Chinese flagship that is no lo…
Guardrail Asymmetry: Why Hugging Face Ran Breach Forensics on a Self-Hosted Open-Weight Model
Provider guardrails blocked Hugging Face's incident responders in the middle of a live breach. The durable lesson is not looser safety and not Chinese models. It is that an inciden…
OpenAI's Models Escaped Their Test Sandbox and Hacked Hugging Face: What Actually Happened
In July 2026, OpenAI's own models, running a hacking benchmark with safety refusals switched off, broke out of an isolated test environment and breached Hugging Face's production s…
Kimi K3 and the Two Currencies of Trust: Rent It, or Own It
Moonshot AI's flagship lands three points off the frontier at 30 percent of the price, and on July 27 it shipped the open weights it promised, on the date it named. Trust now comes…
Agent-Ready Marketing: What Changes When the Buyer Is a Machine
The buyer's first read is no longer a human scanning your homepage. It is an agent retrieving your facts, checking them against a confidence threshold, and deciding whether you mak…
Agent-ready sales: when an AI agent sits on both sides of the deal
The question is no longer whether to let an agent sell for you. It is whether your sales operation is legible and governed enough for another agent to transact with it safely. That…
The Agent-Readiness Audit: A Scored Checklist Any SME Can Run Before Deploying Agents
A self-contained, scored checklist across four dimensions: data, governance, discoverability, and operational readiness. Run it before you deploy an agent internally, and before a …
The 2026 agent-protocol map: MCP, A2A, ACP and AP2 in plain English
MCP, A2A, ACP and AP2 are not four rivals for one throne. They are four layers of one stack. Here is what each one answers, which layers have settled, and where the money layer is …
Agent-Ready Means Governed: From GUIs to Permissioned APIs
Being agent-ready is not having an API. It is granting a non-deterministic actor scoped authority to act in your name, with a confirm step and an audit trail. The protocol designer…
Agent Search Optimization: Why Latency and JSON-LD Accuracy Are the New SEO
Google says no special schema is required to appear in AI answers. So why does agent-readiness still come down to a fast, correct, server-rendered version of your business truth? B…
Designing the Confirm Step: The Human-in-the-Loop That Is Also Your Legal Shield
For an SME running AI on quotes and replies, the value of a confirm step is not the GDPR Article 22 defence everyone assumes. It is a commercial-liability firewall and an accountab…
The EU AI Act and August 2026: What Singapore SMEs With EU Exposure Actually Have to Do
The headline is half wrong, and the correction is the most useful thing a Singapore SME can hear. The obligations that touch you have been live since 2025. The 2026 deadline you ar…
Singapore Published a Playbook, Not a Law: Reading the IMDA Agentic AI Framework Against the EU AI Act
Singapore's Model AI Governance Framework for Agentic AI is voluntary guidance, not regulation. Here is what its four dimensions actually ask you to build, why they match the EU AI…
Bound the Risk Before You Deploy: How to Tier Agentic AI by Reversibility, Not Hype
Treat an AI agent as a capable junior employee under position limits. Score every action by what an undo costs, automate the reversible majority, and gate the rest. That is the che…
Who Is Accountable When the Agent Acts: The Value-Chain Liability Split
The agentic value chain describes who builds the system, not who pays when it errs. Across vendor terms, API mechanics, and existing law, the loss flows downhill and pools at the d…
From Principles to Practice: MAS AI Risk Management in 2026
The 2026 story is not new principles. The governance burden moved from the model to the operating environment, and Singapore's regulators have started writing the architecture down…
The MCP payment void: why the winning agent standard cannot move money
The integration layer for agents is settled. The money layer is not. MCP connects your business to an agent but stops at the edge of payment, and that gap is a governance problem b…
Multi-Agent Chaos: Why Sales, Marketing and Ops Agents Need One Governed Brain
The research is now clear: most multi-agent failures come from coordination and verification breakdowns, not weak individual agents. Here is what that means for how you run sales, …
The PDPA Liability Gap: Who Pays When Your AI Agent Gets It Wrong
Under Singapore's PDPA, the organisation that deployed the AI agent at its customer carries the accountability, not the vendor who built or hosts the model. The gap is in your assu…
Beyond llms.txt: Structuring Business Data So Agents Do Not Hallucinate Your Hours and Prices
Why the file format you are reaching for is the wrong tool, and how the boring decade-old standard already solves the problem you actually have.
Tell us how your business runs. We will show you the brain.
A real person replies. No funnel, no sequence.
Talk to us