AI security for Philippine businesses: what regulators expect and what to test
Last reviewed · By Shanley Clarence, Founder, ChuuniX
General information, not legal advice.
Understand NPC AI guidance, BSP's financial-sector governance paper and practical questions for reviewing data access, tools and human oversight before deployment.
Overview
AI security starts with the information a system can reach and the actions it can trigger. A business assistant may read documents, prepare replies or use connected tools. Before deployment, decide which of those activities are permitted, who owns exceptions and how staff can stop the workflow when its behavior is uncertain.
This guide separates regulatory context from engineering preparation. NPC guidance concerns AI systems processing personal data. The BSP paper concerns financial-sector AI governance, rather than a blanket requirement for every Philippine business. Use the official sources with your DPO or qualified adviser; a technical test is not a legal compliance determination.
NPC guidance: begin with personal-data processing
NPC Advisory 2024-04 addresses the application of the Data Privacy Act, its implementing rules and NPC issuances to AI systems processing personal data. It covers development and deployment, including training and testing. Transparency, accountability, governance and data subject rights remain relevant when an interface is described as an assistant.
For implementation planning, map what enters through messages, documents and tools, what is retrieved, what is generated and what is stored. Include test data and operational logs. A public-facing question can still contain private information, and a retrieved file can contain details the person asking is not entitled to see.
Your responsible adviser should assess the processing arrangement. Engineers then need a concrete specification of the approved data, access rules and review points. Our Data Privacy Act and AI guide provides a separate preparation checklist and primary references without claiming that completing a checklist establishes compliance.
BSP guidance: understand the sector and status
The BSP guidance paper published with Memorandum M-2026-031 concerns AI governance in financial services. Its introduction describes the principles as non-binding and voluntary, without prejudice to existing laws and regulations. Its scope covers BSP-supervised or registered financial institutions and extends to vendors supporting their AI-related activities through shared responsibility.
Do not present that paper as a certification or as a universal obligation for every retailer or software business. If your work supports a financial institution, clarify the institution’s governance, outsourcing and evidence requirements with its responsible team. The supplier’s technical scope and the institution’s obligations should be understood separately.
For a project discussion, identify who approves the intended use, who controls each system and which evidence the client expects. Avoid promising that a test report will satisfy a regulator or a buyer. A scoped review can document observed behavior and limitations; acceptance and legal interpretation remain separate decisions.
What to check in the application
Information boundaries
List the documents, records and memory available to the assistant. Test with users entitled to different information and confirm that the application applies those permissions before retrieval. A refusal after private content has already been exposed does not undo the disclosure. Include archived material and indirect references when defining the test scope.
Actions and approvals
Describe each connected tool in terms of what it can read or change. Check whether the executing system enforces the user’s authority and any required approval. A generated request to send a message or update a record should not bypass those checks simply because it looks like valid structured output.
Untrusted instructions
Consider hostile text in customer messages and in the material the assistant reads. Retrieved content should be treated as evidence, not as authority to change permissions. Use the prompt-injection guide to plan direct and indirect cases in a controlled environment, with synthetic records and documented authorization.
Failure and intervention
Agree what happens when a source is missing, an account is unavailable or the assistant cannot support a request. Staff need a way to inspect the context, intervene and pause the workflow. Test the handoff destination and the recovery path rather than assuming that a message asking a person to help completes the transfer.
What's included in a useful evidence pack
An evidence pack can identify the assessed version, environment, permitted tests, user accounts and source information. For an observed problem, record the triggering input, relevant context, actual behavior and the expected boundary. Keep sensitive material minimized or redacted so the report does not become another unnecessary store of personal information.
Distinguish observed failures from untested assumptions. A clean result on an agreed example does not prove that every possible input is safe. Link remediation to the actual enforcement point: an access check, tool permission, approval gate or output validator. Record the cases to repeat after a fix so the team can examine the change consistently.
How it works
ChuuniX offers an AI security review for this technical work. Scoped quote after a free discovery call. Review the cost guide to understand why testing coverage, source access and connected actions affect scope; it does not publish ChuuniX prices.
- Agree the system and purpose. Identify data owners, intended users, tools and the people responsible for privacy and release decisions.
- Define a test scope. Use an authorized environment and representative accounts; document exclusions and the version being assessed.
- Exercise the boundaries. Review normal tasks, hostile instructions, missing sources and recovery, recording reproducible evidence.
- Review and remediate. Prioritize findings, agree changes and repeat the affected tests before approving the next release.
FAQ
Does the Data Privacy Act apply to an AI assistant?
It can apply when the assistant processes personal data. NPC Advisory 2024-04 addresses AI-related processing during development and deployment. Start by mapping the actual information flow, then have your DPO or qualified adviser assess the arrangement. Calling a feature a chatbot does not determine its responsibilities or establish an exception.
Does BSP guidance apply to every Philippine business?
The cited paper concerns AI governance in financial services, with scope covering relevant financial institutions and vendors supporting their AI activities. It is not a blanket certification requirement for every business. Review the source and your actual client relationship with the responsible advisers rather than inferring applicability from an AI feature alone.
Is an AI security review a compliance certificate?
No. A scoped review documents technical behavior, reproducible findings and limitations for an agreed system and environment. It does not certify legal compliance, guarantee regulatory acceptance or establish that the whole system is risk-free. Your organization retains responsibility for its processing, governance and release decisions, with appropriate professional advice.
What should we prepare before testing?
Prepare the intended use, approved information, user roles, connected tools and human approval rules. Identify a suitable test environment and representative accounts, with synthetic or appropriately prepared records. Agree authorization and exclusions before testing. The reviewer needs a defined boundary to examine, not unrestricted access to every business system.
What changes require another review?
Consider changes to model behavior, prompts, retrieval sources, user roles, tools and approval rules. A previously tested feature may behave differently after those changes. Agree which tests should be repeated and who approves the result. An optional Care Plan can include security re-checks within its explicit support scope.