Balian AI for law firms, not-for-profit organisations and NGOs
Governed AI for organisations entrusted with the most sensitive information.
Privileged client material, survivors’ accounts, children’s records: Balian AI’s stack is built for work where a single disclosure or an unchecked output carries real harm. Every action an AI agent proposes is checked against a written mandate before it runs, consequential steps wait for a named person, and every step is recorded in a ledger designed to be verified independently.
On your own servers, or in a private environment Balian AI runs for you alone, at cost. Either way your data and keys stay on your premises. The showcase uses synthetic data only.
Two editions, one governed core
Each edition adds its own rules to the same architecture: the mandate check, maker-checker review and the hash-chained ledger are shared.
Matters, conflicts and citations
Research drafted from the matter’s documents and the firm’s judgments library, every citation checked; conveyancing documents from the firm’s own precedents; conflicts cleared before work; ethical walls that hold; partner release. Singapore and Malaysia.
Read the Legal edition NGOConsent, safeguarding and donors
Consent checked on every use, safeguarding referrals to the lead alone, donor restrictions enforced on spending, every reported figure traced to its source. Asia and Australia.
Read the NGO editionBuilt for high-risk information
Law firms answer to courts and clients; not-for-profit organisations and NGOs answer to the vulnerable people they serve and to the donors who fund them. Balian AI’s stack is designed to that standard: the data stays inside the organisation’s own environment, the controls run inside the system on every action, and every decision can be traced to a person, a mandate and a rule.
It is sized for lean teams. Neither a practice nor a charity needs a dedicated AI governance function to operate it: the system enforces the controls, and people review only what is routed to them.
Confidential by default
Privileged client material, survivors’ accounts, children’s records. Sensitive data is masked before it reaches any component that does not need it, and source documents are read only inside the private core.
Professional and ethical duties
Conflicts of interest, ethical walls, consent and safeguarding are rules the system enforces on every action, not reminders in a policy document.
Outputs others rely on
Submissions cite authorities; donor reports cite figures. Each is checked against its sources before it can be released, and release waits for a named reviewer.
The same governed architecture underpins Balian AI’s work in financial services, advanced manufacturing, healthcare and infrastructure (balian.ai).
The legal edition
For litigation, arbitration and advisory practices. Matters, clients and parties are first-class records; the firm’s published judgments form a library every matter can draw on, and nothing a model writes is released until a partner has seen it.
Matter research with verified citations
Answers are drafted from the matter’s own documents and the firm’s judgments library. Every neutral citation and pinpoint paragraph in the draft is checked against the firm’s authority register.
Citation verifier · Result GateDrafting with partner release
Drafting is assistive; releasing a document is a consequential act. The release step waits for a partner, and the person who started the work cannot approve it.
R-ESC-01 · maker-checkerConflict checks before any work
A new matter is checked against every matter in the firm. Until it is cleared, every action on it is denied; a waiver needs two different partners.
R-LGL-01 · two-partner waiverEthical walls that hold
A walled-off person is stopped at the first gate, and the database’s row-level security hides the matter itself from them.
Exclusion compartments · row-level securityFiling and sensitive matters
Work declared for filing waits for a partner. Criminal, sealed and minor-related matters are always treated as the most sensitive tier, which keeps them on in-house models.
R-LGL-02 · R-TIER-01The not-for-profit and NGO edition
For humanitarian, development and social-service organisations. Beneficiary cases and programme files are kept apart, consent is checked on every use, safeguarding information reaches the safeguarding lead and nobody else, and every use of a grant is checked against the donor’s restrictions.
From the Balian Papers: Governing Local-First Agentic AI for Vulnerable Populations
Case triage within consent
Caseworkers ask questions of a household’s records. When consent is the basis for processing, it is checked on every action; withdrawn or expired consent stops all use, including adding new records.
R-NGO-01Safeguarding referrals
A referral goes only to the safeguarding lead on the case. While a high-severity incident is open, every action on the case waits for review, and safeguarding records are visible only to the safeguarding group.
Reviewer routing · R-NGO-02Donor reports with sourced figures
Every figure in a draft report must match the labelled figure in a cited field report. The programme lead releases the report; unsupported figures block the release whoever approves it.
Report verifier · R-ESC-01Children, survivors and locations
Requests involving a child or a survivor, or whose location is sensitive, are always the most sensitive tier, whatever the request declared.
Tier 1 forced by the metadata contractHow every action is governed
The same path for both editions. Agents propose; they never act on their own authority. Runtime safeguards decide each proposed action before it runs. The approach follows SAFR, a guidance paper on runtime safeguards for AI agents published by the Monetary Authority of Singapore with industry contributors,1 applied here beyond finance.
- PII / DQ gate
Each request carries a metadata contract: case, tier, purpose, jurisdiction. Anything missing or not permitted is rejected and kept in a dead-letter queue. Personal identifiers are tokenised.
- Signed envelope
The agent describes the action it proposes, with its trace and context, and signs it with its own key.
- SAFR disposition
Core and edition rules decide: allow, allow and observe, escalate, or deny. The decision and its basis are written to the ledger.
- Escalation desk
Escalations go to a named reviewer role on the case, with a deadline. An approval is bound to one step and is spent when it runs.
- Result Gate
Every output is re-scanned for identifiers and checked by the edition’s verifier. Unresolved flags block any release.
- Ledger
Each entry is hash-chained to the one before and signed by the core, so internal audit can verify that nothing was changed or removed.
Allow
Within the agent’s mandate and below every threshold.
Observe
Allowed, but flagged for monitoring, as model drafting is.
Escalate
Waits for a named person: releases, filings, open safeguarding incidents.
Deny
Outside the mandate, a conflict not cleared, consent withdrawn, a route not permitted.
Responsible AI, translated for these sectors
The same five principles as balian.ai, and how this architecture is designed to put them into operation in a law firm and in an NGO.
| Principle | In a law firm | In an NGO |
|---|---|---|
| Least agency | Agents search and draft; releasing a document or filing waits for a partner. | Agents search and draft; releasing a donor report or making a referral waits for the responsible lead. |
| Routine verification | Every citation and pinpoint is checked against the firm’s authority register. | Every reported figure is checked against the field report it cites. |
| Data boundaries | Ethical walls and matter membership are enforced at the gate and in the database. Identifiers are tokenised before indexing. | Consent is checked on every use; safeguarding records are visible only to the safeguarding group. |
| Awareness of limits | Sensitive matters stay on in-house models; low confidence sends the work to a reviewer. | Cases involving children or survivors stay on in-house models; an open serious incident pauses autonomous work. |
| Accountability | Each action is attributable to a person, an agent mandate and a rule, in a ledger the firm can verify. | Each action is attributable to a person, an agent mandate and a rule, in a ledger auditors and donors can be shown. |
Proportionate to the organisation
Controls are designed for a lean team to operate: one operations administrator manages accounts; partners, programme leads and safeguarding leads review only what is routed to them.
Informed by regional guidance
Designed with regard to published agentic-AI guidance,21 Singapore’s and Malaysia’s personal data protection laws45 and the international AI management standard.6 Each source is listed, with links, under References & acknowledgements.
This summary is for orientation and does not constitute legal advice. Being informed by a framework is not certification or regulatory endorsement.
Showcase
9 scenarios, each recorded by running the real core on synthetic matters and cases. Every page shows what the people involved did, what the core decided at each step, and the ledger entries it wrote, with the core’s signature checked on every response.
Legal edition
Research with verified citations
An associate asks a question on a matter. The answer is drafted from the matter's documents and the firm's judgments library, and every citation in it is checked against the library before it is shown.
Read the governed trace →A draft is released only after a partner approves
Drafting is assistive; releasing a document is a consequential act. The release step waits for a partner, and the person who started the work cannot approve it.
Read the governed trace →An invented authority stops the release
A model appends a citation that is not in the firm's library. The Result Gate flags it, and the release tool refuses to run even after a partner approves.
Read the governed trace →An ethical wall holds at the first gate
A partner walls an associate off a matter. The associate's request is rejected before any agent acts, and the rejection is kept in the dead-letter queue.
Read the governed trace →No work until the conflict check clears
A new matter acts against an existing client. Work is denied until the conflict check runs; the conflict can be waived only by two different partners.
Read the governed trace →NGO edition
A donor report where every figure has a source
A caseworker drafts a donor report from field reports. Every figure must match a figure in a cited source, and the programme lead releases the report.
Read the governed trace →An overstated figure cannot be released
A model inflates the results and adds a figure with no source. The verifier flags both, and the release is refused even after approval.
Read the governed trace →Withdrawn consent stops every use
A household's data is processed on the basis of consent. When consent is withdrawn, every further action on the case is denied, including adding new records.
Read the governed trace →A safeguarding referral goes to the safeguarding lead only
A caseworker refers a concern. Only the safeguarding lead sees and decides it; while a high-severity incident is open, every action on the case waits for review.
Read the governed trace →Deployment and data residency
The stack is designed to run in the firm’s own environment. This portal is only its edge: it holds no client or beneficiary data and shows only responses the core has signed.
Private core
Gateway, agents, safeguards and ledger run as containers on the firm’s servers or private cloud, reached through a private tunnel.
Models the firm approves
Open-weight models served by Ollama or vLLM inside the core. Each model is benchmarked on the edition’s gold set and approved per edition before any request can use it.
One database, separated by rule
Postgres with row-level security: each person’s connection sees only the cases they may use.
Simple sign-in now
User names and passwords with one-time first passwords and lockout. Sign-in through the organisation’s identity provider (Microsoft Entra ID) is planned.
One edition or both
A deployment profile chooses legal, NGO or both. An edition that is not chosen is never loaded.
The firm keeps everything
Records, ledger, models and configuration remain the firm’s, with no dependence on any single provider.
Or run for you, privately
Balian AI can run a private environment for one firm alone, at cost. The firm holds the keys: documents and personal data are sealed with keys from a key service on its premises, and an operator can look in only through a short, stated, ledgered window the firm is told about.
Signing keys in your own hardware
Every ledger entry and verdict is signed. On request, the signing key is held in a hardware security module on the firm’s premises, so nobody at Balian AI can sign in the firm’s name; if the module cannot be reached, nothing is signed and the work stops.
A record anyone can check
The ledger is hash-chained. Each day’s root is anchored outside the firm’s database and time-stamped by an independent authority, so a changed or missing entry shows.
Where firms begin
The same engagement path as every Balian AI client, sized for a practice or an organisation of this kind.
- Discovery
A short study with partners or programme leads of where AI would make a material difference, and where it should not be used.
- Feasibility
The showcase scenarios run on the firm’s own hardware against a synthetic copy of its matters or cases, so leadership can see the controls at work.
- Pilot
One edition, one practice group or programme, measured against a figure the firm already tracks, such as research hours or report turnaround.
- Scale
Further practice groups or programmes, the organisation’s identity provider, and the operating model realigned as use matures.
Each phase concludes with a decision by the client. Engagements may be concluded at any phase, and the client retains all work produced to that point.
Arrange a conversation
We welcome an initial discussion with managing partners, executive directors and their operations teams.
Balian AI
Singapore
info@balian.ai