Methodology
Methodology: risk dimensions, evidence requirements and human-review boundaries
This page sets out HaiWen’s reference assessment framework: how company profile, market obligations, sector risk, evidence completeness and human-review boundaries shape a judgement. The weights and sector scores shown are reference values, not the parameters of the workspace assessment; no conclusion should be presented as an unverifiable professional opinion.
Build company profile
Capture product, model capability, customer type, deployment, data processing and ESG status.
Map target-market rules
Check the company profile against target-market AI regulation, privacy, transfer, export-control, ESG disclosure and customer entry rules.
Run a risk assessment
Produce a compliance score and a remediation gap list with suggested owner roles and priorities, flagging items for human review.
Store reports and tasks
Create board briefs, due diligence response packs, ESG drafts and project task boards.
Risk dimensions (reference weights)
6 dimensions that describe market-entry risk
AI regulatory applicability
22%Determine whether the product triggers high-risk AI, GPAI, sector-entry, transparency or human oversight obligations.
Data protection and transfer
20%Assess personal data, logs, training samples, DPIA, SCC, localization and processor roles.
Export controls and sanctions
14%Identify model capability, chips, encryption, sector customers, geopolitical and supply-chain restrictions.
ESG and AI governance disclosure
18%Cover compute carbon, fairness, privacy governance, supplier responsibility and customer disclosure evidence.
Customer due diligence and contracts
16%Prepare DPA, security paper, AI governance memo, model limitations, SLA and incident response workflow.
Localization execution capability
10%Assess local cloud, language, support, partners, certifications and sector sales cycle.
Sector risk profiles (reference)
Sector risk profiles and suggested starting points
Generative AI SaaS
GPAI, customer data input, content safety, training-data copyright and enterprise security review overlap.
Start with model risk classification, training-data summary, DPA/SCC and a due diligence response pack.
AI hardware and robotics
Product certification, sensor data, edge deployment, supply-chain ESG and local service duties run in parallel.
Build certification route, data-collection boundary, supplier due diligence and incident response.
Health, finance and education AI
High-impact use, sensitive data, sector regulation, human oversight and explainability are stricter.
Complete high-risk AI review, DPIA, model validation, human oversight and expert review.
Public-sector and smart-city AI
Public procurement, local hosting, public safety, data sovereignty and sanctions risk are sensitive.
Start with sanctions screening, local deployment memo, government questionnaire and data-sovereignty evidence.
Report Quality Checks (sample)
Evidence and review boundaries to check before a report goes outSample
Report quality checks (sample): these items describe what a report review looks at; the states shown are samples, not the result of a check run on any specific report.
Complete source references
Key conclusions are tied to policy, case or regulatory-update sources so customers and reviewers can check them.
Owners and deadlines set
Every remediation item has an owner role, priority, deadline and evidence requirement.
High-risk items flagged for review
Legal, tax, certification and filing conclusions are not treated as final professional advice.
ESG data methodology sign-off
Compute carbon and fairness metrics still need finance, security and ESG owner confirmation.