Direct answer: the first question to ask an AI transformation consultant is "how do we choose the first AI use case?" A good starting point usually has a clear goal, usable data already in hand and a cost of failure you can live with, such as quality inspection or predictive maintenance for equipment; rank candidates by data availability, business value and how controllable the risk is, not by how new the technology is. Next, check whether the consultant works "governance first": set up an AI policy, an inventory of AI systems and a review process before deployment (which can map to ISO/IEC 42001), assess each use case's risks and applicable laws, keep monitoring model performance after go-live, and make clear who is responsible for human oversight.
Three ways to build AI capability
| Approach | When it fits | What to clarify first |
|---|---|---|
| Buy a mature AI solution | The need is common and you want to go live quickly | Where your data is stored, whether the vendor may use your data, and whether you can exit later |
| Co-develop with a technology vendor | The need is specific and you lack in-house data science talent | Who owns the model and data rights, the acceptance criteria, and who runs it after go-live |
| Build in-house capability | AI is a core competitive capability that needs long-term iteration | Training people, the data foundation and governance processes |
Eight criteria
| Criterion | Question you can ask any consultant |
|---|---|
| Use-case selection | How do you choose the first use case? Is it based on data availability, business value and the cost of failure? |
| Governance first | Will you set up an AI policy, an AI system inventory and a review process before deployment? Can you build an AI management system to the requirements of ISO/IEC 42001? |
| Risk assessment | How do you assess the risks of each AI use case? Do you refer to ISO/IEC 23894 or the US NIST AI Risk Management Framework (govern, map, measure, manage)? Is generative AI treated separately? |
| Data and personal data | Where do training and operating data come from, and how is quality controlled? When personal data is involved, how do we comply with Taiwan's Personal Data Protection Act? |
| Applicable laws | Which laws apply to our AI uses and markets? How will Taiwan's sector regulators manage AI by risk? When our AI's output is used in the EU, what is our role and risk level under the EU AI Act? |
| Monitoring after go-live | How are model performance and drift monitored? Who is responsible for human oversight and the decision to switch a system off? |
| Measuring results | What is the baseline before deployment? How are benefits tracked, and how often are they reviewed? |
| Who leads, and is work subcontracted | Who actually runs the engagement, with what qualifications? Will any of it be subcontracted? |
When you may not need a consultant
If staff only use general-purpose generative AI tools for everyday documents that contain no confidential information or personal data, an internal usage policy plus training is usually enough. If AI will affect decisions about customers or employees, process personal data, or go into products for the EU market, you need formal governance and risk assessment.
How Winners Consulting addresses these criteria
What follows is Winners Consulting's own description. Test us with the questions above, just as you test other consultants.
- Use cases and risk assessment: review core business processes to identify use cases such as predictive maintenance, quality inspection, customer-service automation and sales forecasting, and assess the risk level of each AI use case at the same time; we recommend starting where the goal is clear, the data is at hand and the cost of failure is low
- Governance first: set up an ISO 42001 AI management framework before AI systems are deployed, including AI ethics principles, AI system inventory management, security requirements for AI development and procurement, and an algorithm review process
- Data: set up management of AI model training data to ensure its quality and security
- Monitoring and regulation after go-live: set up AI system performance monitoring (model drift detection) and continuous improvement, assess whether the EU AI Act applies, and prepare the compliance documents required
- Results and capability: set a measurement baseline before deployment, and help assess which approach fits best: buying, co-developing or building in-house
- Who leads: vice-president and director-level consultants run the whole engagement; nothing is subcontracted
Related questions
- How does AI transformation relate to ISO 42001? ISO/IEC 42001 is the international standard for AI management systems and gives AI transformation a governance framework; certification means an independent certification body has confirmed that the organisation's AI management system conforms to the standard. But ISO/IEC 42001 is not a harmonised standard under the EU AI Act: certification gives no presumption of conformity and does not by itself meet the obligations for high-risk AI systems. How to choose an ISO 42001 and AI Act consultant in Taiwan
- What does Taiwan's AI Basic Act require of companies? Taiwan's Artificial Intelligence Basic Act was promulgated and took effect on 14 January 2026, with the National Science and Technology Council as the central competent authority. Most of its provisions are addressed to government; specific requirements for companies will mainly come through risk-based management rules and industry guidelines set by sector regulators, which the Executive Yuan has asked them to issue by January 2028. The Ministry of Digital Affairs published version 1.0 of its AI risk classification framework on 7 July 2026, which can serve as a reference for inventorying and assessing AI use-case risks. AI transformation advisory
- Can we do AI transformation without data scientists? Yes: buy mature solutions, co-develop with a technology vendor, or build in-house capability; the three approaches can be combined as needed. AI transformation advisory
- How long does AI transformation advisory take? It depends on AI maturity and scope; the advisory period listed on Winners Consulting's service page is usually 7 to 12 months or more. AI transformation advisory
Request a free mechanism diagnosis
Compliance needs all three; a consultant's value is integration
CRA, TISAX, ISO 27701 and the AI Act are not single technical problems. They are only complete when process, security technology and legal compliance all hold at the same time. Fix only one and the gaps in the other two surface during audits, incident reporting or customer due diligence, and the work has to be redone.
| Dimension | The question it answers | Typical gap when only this part is done |
|---|---|---|
| Process (management system) | Who is responsible, what is done, when, where the evidence is, how it improves | Tools are in place but nobody runs them on schedule, so there are no records at audit time |
| Security technology | How controls are designed and how their effectiveness is verified | Documents are complete but the systems do not actually do what they describe |
| Legal compliance | Which regulation applies, which role you hold, the deadlines and penalties | Controls are built against the wrong regulation or role, so obligations are not covered |
Winners' consulting team covers all three dimensions and plans regulatory scoping, process design and technical controls together, so a single body of evidence serves multiple regulations and customer requirements.