AI transformation for CFOs: ROI, penalty exposure, capitalisation

How should a CFO measure the return on AI investment, and how should the first use case be chosen?

Rank before you spend. Rank the first use case on three factors: data availability, business benefit and cost of failure (risk controllability), not on how new the technology is. The approach listed on the service page is to set KPI baselines before AI deployment so that the return on AI investment can be tracked.

After go-live, keep monitoring model performance and drift: when performance falls, so does the benefit, so monitoring and operation belong in the budget. The US NIST AI Risk Management Framework is organised around four functions, govern, map, measure and manage, and can serve as a reference structure for measurement and reporting.

Buy, co-develop or build AI capability: how do cost structure and contract risk compare?

The three can be combined. The legal effect of rights, liability and exit clauses is for legal counsel to review.

How are the costs of building an AI model or subscribing to AI SaaS recognised?

Framework (Taiwanese public companies prepare financial reports under IFRS as endorsed by the Financial Supervisory Commission):

• Recognising an intangible asset: future economic benefits are probable and cost can be measured reliably (IAS 38 paragraph 21).
• Internal development: research expenditure is expensed when incurred (paragraph 54); development costs need all the paragraph 57 conditions demonstrated, including technical feasibility, the intention and ability to complete and use or sell the asset, how it will generate probable future economic benefits, and adequate technical and financial resources; if the phases cannot be distinguished, treat it as research (paragraph 53).
• AI SaaS subscriptions: under a 2021 IFRS Interpretations Committee agenda decision, where the customer only receives a right of access, configuration or customisation costs are usually not recognised as an intangible asset and are expensed when provided or over the contract term, depending on whether the service is distinct.
• Staff AI training: expensed when incurred (paragraph 69).

Which phase a proof of concept falls into, and the conclusion, are for the statutory auditor based on the facts.

How should a CFO size exposure to EU AI Act fines and AI-caused damage, and is a provision needed?

• Fines (Article 99): up to EUR 35 million or 7% of total worldwide annual turnover in the preceding financial year for breaching the Article 5 prohibitions; up to EUR 15 million or 3% for obligations of providers, deployers and others and the Article 50 transparency obligations; up to EUR 7.5 million or 1% for supplying incorrect information; whichever is higher, or the lower for SMEs.
• Timeline: stand-alone high-risk AI systems from 2 December 2027, AI embedded in regulated products from 2 August 2028 (Regulation (EU) 2026/1744).
• Civil damages: the EU AI Act itself has no civil liability rules; damage is mainly handled under the new Product Liability Directive (EU) 2024/2853 and Member State tort law.
• Provisions: judge against the IAS 37 conditions of a present obligation, a probable outflow and a reliable estimate; future compliance costs are not a provision. The conclusion is for the statutory auditor.

What belongs in an AI governance budget, and is ISO 42001 certification worth it?

Budget items: AI system inventory and risk classification, building the ISO 42001 management system, technical documentation and human oversight design for high-risk systems, consulting fees, certification fees.

The value and limits of ISO 42001 certification:

• Value: it lets you show customers, partners and regulators that AI runs under a responsible governance framework.
• Limits: ISO/IEC 42001 is not a harmonised standard under the EU AI Act, so certification gives no presumption of conformity; high-risk AI systems must still meet legal obligations such as risk management, technical documentation, human oversight and conformity assessment.

If staff only use general-purpose generative AI for everyday documents without confidential or personal data, internal usage rules and training are usually enough.

What should be reported to the board and audit committee on AI transformation?

Article 20, item 6 of the annual report regulations requires analysis of the impact of important domestic and foreign policy and legal changes and technological change (including cybersecurity risk) on finances and operations, and the response (the annual report regulations apply to public companies; companies that are not public are not covered by them and can use them voluntarily).

How does Winners Consulting help a CFO drive AI transformation?

• Use cases and risk assessment: review core business processes, identify use cases such as predictive maintenance, quality inspection, customer service automation and sales forecasting, and assess their risk level in parallel
• Governance first: build the ISO 42001 AI management framework before AI systems are deployed, including AI ethics principles, AI system inventory management, security requirements for AI development and procurement, and an algorithm review process
• Results and capability: set baselines before deployment; help decide whether buying, co-developing or building fits best
• Monitoring and regulation after go-live: model drift detection; assess EU AI Act applicability and prepare the necessary compliance documents
• Who leads: VP- and director-level consultants throughout, never outsourced; the advisory period listed on the service page is usually 7 to 12 months or more

More: AI transformation consulting, How to choose an AI transformation consultant in Taiwan, ISO 42001 and AI Act budget and timeline, CFO role page. Request a free mechanism diagnosis