LLM Implementation 2026: RFP, TCO and Operations for Thailand

Moving an LLM implementation from free-form chat trials into business operations requires a decision on the job, data boundary, acceptance criteria and operating owner before choosing a famous model. This guide gives Japanese manufacturers and regional headquarters in Thailand a practical sequence for writing an RFP, comparing packaged SaaS, API plus RAG and AI agents on one evaluation set, and reaching an investment decision in 90 days.

Why broad enterprise LLM adoption does not mean production readiness

According to the Stanford HAI AI Index Report 2026, 88% of surveyed organizations used AI in 2025 and 70% used generative AI in at least one business function. Yet AI-agent adoption remained in single digits across almost every business function. The gap separates access to a tool from the ability to let that tool participate in a controlled business process.

In a chat trial, a user reads the answer, corrects an error and tries again. In production, the company must define which data may enter the system, which documents it may retrieve, which external actions it may take, who owns the consequences of a wrong answer, what is logged and how service is restored. An LLM should therefore be procured as an operating service that includes process and controls, not merely as a software component.

The responsible-AI evidence points in the same direction. The Responsible AI chapter of AI Index 2026 reports 362 recorded AI incidents in 2025, up from 233 in 2024. It also lists lack of knowledge at 59%, budget constraints at 48% and regulatory uncertainty at 41% as leading barriers to responsible AI. These figures are not an incident rate for any particular company or a forecast. They do support a practical conclusion: buying model accuracy does not automatically buy the capability to operate it safely.

Executives can make the discussion clearer by separating three questions:

• Reach: can employees access generative AI?
• Business value: will it improve time, quality, revenue or risk?
• Production capability: can the organization manage data, access, evaluation, monitoring and change?

High adoption alone is not an investment case. Putting value and operating capability in the same approval document is the first step beyond a proof-of-concept dead end.

Treat LLM implementation as an operating contract, not a model contest

The center of the plan should not be a specific model name. The business owner, IT, legal and compliance, information security, end users and implementation partner should agree on one operating contract covering:

1. In-scope and excluded tasks
2. Permitted and prohibited data
3. Expected output, tolerable failure and critical failure
4. Human review points and final accountability
5. Permissions for models, retrieval and external tools
6. Acceptance criteria for quality, safety, time and cost
7. Logging, monitoring, incident response and user retraining
8. Model updates, switching and end-of-contract data handling

NIST AI 600-1 is a voluntary generative-AI profile of AI RMF 1.0. It helps organizations incorporate trustworthiness and risk management across design, development, use and evaluation. In an RFP, it is more useful as a lifecycle discipline—including changes after launch—than as a checklist completed once.

The NIST announcement for SP 800-218A also matters to buyers. The publication adds generative-AI-specific secure software development practices to the SSDF for AI model providers, AI system developers and AI system acquirers. An acquirer should not stop at asking whether a product is secure. The RFP should require contractible answers about the supply chain, configuration changes, evaluation evidence and vulnerability response.

Compare three approaches with the same evaluation set

Enterprise LLM adoption usually starts with one of three approaches: packaged SaaS, API plus RAG, or an AI agent. No approach is universally best. The job and data boundary determine the fit. During the 90-day PoC, keep representative tasks and acceptance criteria constant while allowing models and configurations to compete.

Packaged SaaS is attractive for meeting notes, drafting and common search when the process can fit the product. API plus RAG is often a better fit for policies, engineering documents and quality records where evidence and document-level permission matter. For a deeper treatment, see our enterprise RAG implementation guide for Thailand.

AI agent implementation becomes relevant when a workflow links several steps, such as classifying an inquiry, retrieving information, drafting a response and preparing an ERP entry. Wider automation also creates exposure to excessive permissions, wrong external actions, duplicate execution and partial failure. A safer maturity path is “recommend only,” then “draft only,” then “execute after human approval”—not autonomy from day one.

A 90-day PoC that ends with an investment decision

The objective is not a polished demonstration. It is to reduce the uncertainties that block production. Limit scope to one or two workflows and divide weeks 0–12 into four stages.

Weeks 0–2: Baseline the process and freeze the evaluation set

Measure current volume, elapsed time, rework, escalation and error impact. Without a pre-implementation baseline, a claim that work “feels faster” cannot become an investment result.

Build 20–50 representative tasks. Include ordinary cases as well as ambiguous requests, obsolete documents, conflicting sources, mixed Thai and Japanese input, and questions the system should refuse. The range of 20–50 is a design range for this PoC, not a general performance guarantee. Give every case an expected result, permitted evidence, tolerance, critical-failure definition and named scorer.

At the same time, classify personal data, customer secrets, manufacturing conditions, prices, drawings and HR data. Set executable rules such as prohibited, anonymized-only or approved-environment-only. Name the business owner, data owner, security owner and final approver during this stage.

Weeks 3–6: Test SaaS, API + RAG and agents under the same conditions

Run the same representative tasks through each candidate and score Japanese, Thai and English separately. Do not rely on an average score. Classify failures such as unsupported answer, obsolete source, instruction violation, out-of-permission retrieval, lost condition in translation and interrupted execution.

For API plus RAG, measure retrieval and generation separately. If the correct document was never retrieved, the corrective action differs from a case where the model ignored a correctly retrieved document. For an agent, capture not only the final answer but also the plan, selected tools, parameters, stopping decision and retries.

Avoid locking the procurement to one model name at this point. A design that can run the same evaluation set against multiple models and settings is better able to absorb price changes, retirement, quality drift and revised data terms.

Weeks 7–10: Test real data boundaries, attacks and failure modes

Within an approved real-data scope, test whether user permissions correctly constrain retrieval, whether the audit trail records who entered what and which sources were used, whether the output cites evidence, and whether prohibited questions are refused.

The OWASP GenAI LLM Top 10 2026, released on August 4, 2026, organizes major security threats for LLM applications in its current edition. An RFP should not merely list vulnerability names. It should convert relevant threats—such as prompt injection, confidential information, excessive agency and external tool execution—into tests for the proposed architecture.

For example, if a retrieved document contains an instruction to ignore prior controls, does the system treat it as untrusted content? If a malicious link reaches an email-drafting agent, can it cause credentials to be disclosed? Can a purchasing agent finalize a record without approval? Reproduce such failures safely and verify refusal, human approval, reduced permissions and fallback behavior.

Weeks 11–12: Apply acceptance gates and decide the rollout boundary

Evaluate quality, safety, time and cost together. Candidate KPIs include task success rate, critical-error rate, evidence rate, rework rate, processing time, inference cost per case, the Thai–Japanese quality gap, permission violations and audit-log gaps. Set acceptance at zero permission violations and zero missing audit records for the PoC. The organization should set all other targets from business impact and its baseline rather than copying a generic guarantee.

Classify the result as production, conditional continuation, reduced scope or stop. Even production approval should state the first department, number of users, permitted data classes and transaction ceiling, plus the gate for expansion. Conditional continuation needs the missed KPI, improvement owner, due date and retest method.

What an RFP should ask for—and what evidence should come back

A useful RFP makes candidates comparable; it is not a spreadsheet of unchecked feature claims. Replace “supported” answers with evidence such as configuration screenshots, design documents, sample logs, test results and contract clauses.

Business value and responsibility

• Which process steps will be replaced, and which will only be assisted?
• Who detects and recovers from a wrong answer or incomplete transaction?
• Where do vendor, implementer and customer responsibilities begin and end?
• What prevents bypass of required human approval?
• What is included and excluded from the SLA, where is it measured and how often is it reported?

Model, evaluation and change management

• Which models, regions and versions are used, and under what switching rule?
• Are model updates announced and regression-tested with the same evaluation set?
• Are changes to prompts, indexes, tool definitions and policies versioned?
• Can the customer export its evaluation data and results?
• What is the rollback process if quality declines?

Data boundary and supply chain

• Where are inputs, outputs, embeddings, logs and backups stored?
• What are the retention period, deletion method, deletion evidence and subprocessors?
• Under what conditions may customer data be used for training, product improvement or human review?
• Which external model, retrieval, monitoring and translation providers are dependencies?
• At exit, can the customer retrieve data, indexes, evaluation sets and configuration?

As one vendor-specific example, OpenAI’s business data policy says inputs and outputs from Business, Enterprise, Edu and API are not used to train models by default. Its Zero Data Retention update dated August 19, 2026 describes ZDR for eligible API customers, under which prompts and responses are not retained after request processing. These are OpenAI-specific conditions. They must not be generalized to other vendors, every plan or every endpoint. Verify covered features, exceptions, retained operational metadata and eligibility in the actual contract.

Security and operations

• How are SSO, multi-factor authentication, roles, least privilege and emergency stop implemented?
• How are prompt injection and data leakage tested?
• Can read, create, update, delete and approve permissions for tools be separated?
• Do audit logs contain input, sources, output, action, approval and error?
• What are the deadlines for incident notice, containment, evidence preservation and prevention?

Every RFP claim should map to a PoC acceptance test. If a bidder says logs are available, export them and check every required field. If it claims model portability, switch a model, rerun the same cases and compare quality, cost and latency.

Compare a 12-month TCO using replaceable assumptions

The following is a hypothetical design example only. It is neither a market price nor a TOMAS TECH quotation or customer result. Replace every input with the proposed workflow, volumes, existing contracts, data readiness, security requirements and support scope. Our generative AI implementation cost guide for Thailand provides another way to structure the cost components.

Hypothetical cost assumptions

The value side also uses hypothetical inputs:

240 people × 0.5 hours/day × 220 days × THB 450/hour × 45% realization = THB 5.346 million/year

In this example, first-year net benefit is THB 5.346 million − THB 4.32 million = THB 1.026 million. Steady-state monthly benefit is THB 445,500, and steady-state monthly net benefit is THB 445,500 − THB 160,000 = THB 285,500. Dividing the THB 2.40 million initial cost by THB 285,500 gives a simple payback of about 8.4 months. Ramp-up delay, tax and cost of capital are excluded.

The realization rate is the decisive variable. At 30%, value falls to THB 3.564 million and first-year net benefit becomes THB 3.564 million − THB 4.32 million = negative THB 756,000. The 45% assumption is therefore a variable to measure during the PoC, not a promised outcome.

Do not confuse time that could be saved with time converted into value. If a response is prepared 30 minutes faster but the released time becomes waiting time, financial value may be limited. Tie savings to higher throughput, reduced overtime, lower outsourcing, shorter lead time or avoided errors. On the cost side, include data work, evaluation, monitoring, support, change management, training, incident response and exit migration—not only model usage.

Using internal data with generative AI: boundaries and Thailand PDPA work

“Cloud or on-premises” does not describe the complete boundary for internal data and generative AI. Draw the flow from input to deletion and separate prompt construction, retrieval, embeddings, inference, output, logs, monitoring, backups and human support.

For a Thailand operation, legal and privacy owners should confirm the role and purpose under the PDPA, necessity, retention, access, cross-border handling, processors and subprocessors. This article is not legal advice. The operational point is to keep a review record based on the company’s actual data and architecture, not a vendor’s generic statement.

ETDA’s 2026 direction for Thailand AI Governance states that 12 sets of guidelines and toolkits are available and that an AI Ethical Impact Assessment Playbook and AI Value Creation are being further developed in 2026, alongside an AI Red Teaming Challenge. This supports running governance and value validation in parallel rather than waiting indefinitely for every rule to settle.

ETDA’s Generative AI Governance Guideline for Organizations is a Thai-language primary source. It addresses responsible use in relation to organizational goals, risk, personal data, confidential information and legal compliance. It can help localize RFP questions, acceptable-use rules, approval flows and training for a Thai organization.

Turn classification into enforceable rules:

• Public: usable in an approved environment
• Internal: only with corporate identity, retention and logging controls
• Confidential: restrict purpose, users and retrieval; control output export
• Personal data: verify purpose, necessity, legal basis, retention and cross-border handling
• Highly confidential or prohibited: block input and combine detection with user training

RAG does not automatically make the boundary safe. Indexing can strip source permissions; departed-user access can remain; and an obsolete revision can rank first. Inherit access rights at retrieval time and maintain owner, version, effective date and retired status as document metadata.

AI agent security means controlling actions

In an ordinary chat, a poor answer is the dominant risk. An AI agent may send email, create files, update tickets or prepare ERP transactions, so the impact of a wrong action is greater. For AI workflow automation, separate read access to information from execution rights in external systems.

Start with recommendations or drafts only. Move next to execution of one human-approved case. After adequate evaluation and monitoring, consider automation only for low-risk, reversible actions. Deletion, payments, final price approval, employment decisions and equipment shutdown should retain a separate approval path even when automation is technically possible.

Key controls include:

• Dedicated least-privilege credentials for each tool
• Separate read, create, update, approve and delete permissions
• Limits for target, amount, volume and time window
• An idempotency key that prevents duplicate execution
• Defined restart points and compensating action after partial failure
• Audit records for input, reasoning outcome, sources, action and approval
• Human fallback and immediate credential revocation

Security tests belong inside the representative set, not after the normal demonstration. Add hostile instructions and out-of-scope requests, while also measuring whether refusals unnecessarily stop valid work. Measuring safety and usability together reduces the chance that employees evade controls and return to unapproved tools.

Score Japanese, Thai and English separately

At a Japanese company in Thailand, management material may be Japanese, shop-floor records Thai and standards or equipment manuals English. One multilingual average can hide a missing condition or negation in a particular language.

Include equivalent cases in all three languages and realistic mixed-language source sets—for example, a Thai defect report, Japanese quality criteria and an English equipment manual. Score names, units, dates, quantities, negation, exceptions, owner and cited evidence individually. Fluency matters less than preservation of business conditions.

Thai tokenization and spelling variants, omitted subjects and abbreviations in Japanese, and differences between standards terminology and company language in English can all change retrieval. Design query expansion, glossaries, synonyms and metadata by language, then compare evidence rate and critical-error rate separately.

Localize the interface and training as well. A policy written only in English will not function as a control for people who work in Thai. Provide acceptable-use rules, warnings, approval screens, help and incident reporting in the user’s language and verify that their meaning remains aligned.

Production operations: build for change and model switching

Launch begins the evaluation cycle; it does not end the project. Models, prices, terms, internal documents, business procedures and attack methods change. Run regression testing monthly or after a material change using the fixed evaluation set plus newly observed failures.

ISO/IEC 42001:2023 is the world’s first AI management system standard and specifies requirements to establish, implement, maintain and continually improve an AI management system. Its PDCA structure can anchor operations, but it does not replace applicable law. Look beyond a certificate to whether accountability, risk assessment, change control, monitoring and improvement connect to the actual workflow.

Maintain an AI use-case register containing the purpose, business owner, model, data class, integrations, acceptance criteria, latest evaluation date, known limitations and stop condition. When the model or retrieval configuration changes, record before-and-after evaluation results, cost, latency and risk.

Portability cannot be proven by contract language alone. During the PoC, switch at least one candidate model and rerun representative tasks. Measure the effect on prompts, output schemas, tool calls, RAG and monitoring. Customer ownership of data and evaluation sets, clear API boundaries and avoidance of deeply embedded model-specific logic reduce future migration cost.

For decisions on internal and external delivery roles, see our AI in-house development support guide for Thailand. Keep business judgment, data accountability and acceptance criteria inside the company; commission architecture, implementation, specialist testing and training as explicit deliverables.

Frequently asked questions

What does LLM implementation cost?

Compare 12-month TCO that includes workflow design, data preparation, integration, permissions, evaluation, security testing, monitoring, training, improvement, support and exit migration—not just licenses and API usage. THB 4.32 million in this article is a hypothetical calculation based on THB 2.40 million initial and THB 160,000 monthly costs, not a market price. Actual cost varies with the workflow, volume, data, integrations and SLA, so require the same cost breakdown from every bidder.

Where should an enterprise begin with LLM adoption?

Choose one or two workflows and measure today’s volume, time, rework and error impact before buying a product. Then define 20–50 representative tasks, prohibited data, failure classes and accountable owners. Compare SaaS, API plus RAG and an agent using that same set. The 20–50 range is a practical PoC design range, not a general guarantee.

How are AI agent implementation and RAG different?

RAG retrieves relevant internal or external sources and supplies them to a model to improve grounding and freshness. An AI agent may plan several steps and use external tools in addition to retrieval; RAG can be one component of an agent. More external action requires stronger design for permissions, approval, duplicate prevention, recovery and audit.

What should we check before using internal data with generative AI?

Review not only the input endpoint but also indexes, embeddings, logs, backups, human support, subprocessors, cross-border handling, retention and deletion. Inherit source access rights during retrieval and record the purpose and necessity for personal and confidential data. “Not used for training” does not necessarily mean “not stored” or “never available to human support,” so verify the exact feature and contract.

Conclusion: procure measurable operating capability, not a model name

Successful LLM implementation is not a bet on the smartest model. It brings the workflow, data boundary, three-language evaluation set, human approval, security tests, 12-month TCO, change management and exit terms into one operating agreement. Compare SaaS, API plus RAG and AI agents under identical conditions, and move to production only within the boundary where value and risk both pass acceptance.

If your Thailand operation is still defining its RFP, evaluation set, internal-data boundary or 90-day PoC, you can speak with TOMAS TECH at the planning stage. We can help turn business workflows and acceptance conditions into a model-neutral comparison plan.