HK Dev / Responsible AI delivery
Governance, Guardrails
& Auditability
I build AI workflows with clear decision ownership, practical guardrails and records that support review. Your team can see what the system is allowed to do, where human approval is required and how important decisions can be traced.
Legal AI · Application security · Product engineering
Our principles
Accountability, traceability and evidence guide each stage of delivery.
Accountable by design
Define operating limits, approval requirements and decision owners before increasing autonomy. Match the level of oversight to the impact of each action.
Traceable decisions
Preserve the sources, versions and approvals needed to explain important actions. Give reviewers useful evidence while limiting the sensitive data retained.
Evidence-led delivery
Agree acceptance criteria before implementation. Document test results, known limitations and unresolved risks so your team can make informed release decisions.
Controls for your AI system
Controls are selected for your data, operating environment and business risk. Each engagement defines the implementation scope, acceptance criteria and responsible owners.
Data handling & privacy
- Identify the data the workflow needs and remove unnecessary personal information.
- Verify encryption and access permissions in the selected systems.
- Define retention periods and verify deletion across the systems in scope.
- Review model-provider training and retention terms before connecting client data.
- Document processing responsibilities and any required data-processing agreements.
Model selection & governance
- Compare providers for accuracy, reliability, data terms and running costs.
- Document approved models, accounts and tools.
- Record model, prompt and tool versions so changes can be traced.
- Test updates against an agreed set of examples before release.
- Define approval gates for consequential actions and assign accountable reviewers.
Testing & red-teaming
- Define measurable acceptance criteria and verify them before release.
- Test attempts to bypass instructions, expose data or misuse tools.
- Evaluate impact and bias where decisions may affect people.
- Retain known failure cases in regression tests for future releases.
- Report test coverage, exclusions and unresolved risks.
Monitoring & observability
- Monitor workflow quality, errors, response times and operating costs.
- Set actionable alert thresholds with named response owners.
- Keep decision records proportionate to investigation needs and data sensitivity.
- Evaluate changes to models, prompts and integrations before expanding their use.
Incident response
- Name the escalation owner and the person who can pause or restart the system.
- Plan and test rollback, manual handling or a limited fallback where feasible.
- Document incident evidence, root causes and corrective actions.
- Agree notification responsibilities and ongoing support coverage before deployment.
Standards that guide delivery
Recognised standards, regulatory requirements and security guidance inform the controls we build and the evidence we document. Applicability is assessed for your organisation and use case.
This page does not claim an HK Dev SOC 2 report, ISO 27001 or HIPAA certification, or a guarantee of regulatory compliance.
EU AI Act(opens in new tab)
Regulatory reference
Support system inventories, risk assessments, technical documentation and human oversight. Your organisation and qualified advisers determine which legal duties apply.
GDPR(opens in new tab)
Privacy requirements
Support data mapping, minimisation, retention and access controls, alongside evidence for privacy reviews. These controls contribute to your compliance programme; they do not establish GDPR compliance on their own.
SOC 2 Type II(opens in new tab)
Audit-support reference
Use the Trust Services Criteria to organise security controls and evidence for your review. Project-level work is not a SOC 2 attestation, and this page does not claim an HK Dev SOC 2 report.
HIPAA(opens in new tab)
Healthcare requirements
Scope healthcare workflows around your privacy, security, access and vendor requirements. Applicable agreements and responsibilities must be confirmed for the engagement; compliance is not guaranteed.
OWASP LLM Top 10(opens in new tab)
Security testing guide
Use relevant AI security risks to shape threat models and tests for malicious instructions, data exposure and unsafe actions. Document coverage and gaps; no test suite proves a system is vulnerability-free.
NIST AI RMF(opens in new tab)
Voluntary risk framework
Organise risk ownership, evaluation and monitoring around Govern, Map, Measure and Manage. This voluntary framework supports risk decisions; it is not a certification.
ISO 27001(opens in new tab)
Security management reference
Use relevant information-security requirements to guide access, supplier and incident controls. Project-level alignment is not an audited information security management system or an HK Dev certification.
Common questions
Will our data be used to train an AI model?
Training or fine-tuning on your data requires explicit agreement. Before connecting a provider, we review the selected service, account terms and configuration for training use, retention and access. The permitted uses are documented for the deployment.
Where will our information be stored and processed?
We document the data flow across the application, model providers, logs and backups, including support access. Hosting regions and processing requirements are agreed with your team and checked against the capabilities of the selected services.
Can an agent send a message or change a matter on its own?
Consequential actions require the agreed human approval. The workflow should show the proposed action, the information behind it and who can approve it. Legal decisions remain with your attorneys. The exact permissions and review points are defined for your workflow.
How are production errors handled?
The delivery scope defines escalation owners, review triggers and the records needed for investigation. Where included, pause, fallback and recovery procedures are tested before handover. Ongoing monitoring and incident response coverage are agreed explicitly.
Can you support our security or compliance review?
Yes. I can implement technical controls and prepare evidence for your legal, security and audit teams, including data flows, access rules, test findings and remediation results. Independent assurance, certification and legal conclusions remain with qualified specialists.
Does this page mean HK Dev is certified?
No. This page does not claim an organisational SOC 2 report, ISO 27001 certification or HIPAA certification. Framework references explain how scoped technical work can support your review. Ask for current, specific evidence before relying on a certification or compliance claim.
Discuss your requirements
Define the controls before deployment.
Review your workflow, data requirements and approval responsibilities. Together, we can establish a practical scope for implementation, testing and handover.