TRW & Co · Technology, Data & Digital
AI Governance in Singapore
AI governance in Singapore is built from existing law, regulator guidance and voluntary frameworks rather than a single AI Act. With MAS issuing binding supervisory expectations for financial institutions and IMDA setting the benchmark for agentic AI, organisations now need inventories, clear accountability and contracts that reflect how their AI actually works.
Key pointSingapore has no AI statute, but the PDPA, consumer protection and copyright law already apply to every AI deployment; voluntary frameworks tell you how to comply, not whether you must.
At a glance
No standalone AI Act
Singapore regulates AI through existing statutes such as the PDPA, Copyright Act 2021 and consumer protection law, supplemented by sector guidance and voluntary frameworks.
MAS AI guidelines issued
MAS issued AI Risk Management Guidelines on 7 October 2026; oversight expectations apply from 7 October 2027 and lifecycle controls by 7 October 2028.
Agentic AI framework
IMDA launched a Model AI Governance Framework for Agentic AI in January 2026 and updated it in May 2026 with case studies on multi-agent risks.
PDPC AI guidelines
PDPC Advisory Guidelines explain how consent, the business improvement and research exceptions, and notification apply to AI recommendation and decision systems.
Accountability stays put
Deploying a vendor model or an autonomous agent does not transfer legal accountability; the deploying organisation remains answerable for outcomes and data handling.
Swipe or scroll →
What AI governance in Singapore covers
AI governance in Singapore is the set of laws, regulatory guidelines, contracts and internal controls that decide how an organisation may build, buy and deploy artificial intelligence. It covers predictive models in credit and insurance, generative AI assistants used by staff, AI features embedded in consumer products and, increasingly, AI agents that can act on systems without a human approving each step.
There is no single AI statute. Instead, Singapore has chosen a sector-led, principles-based model: existing laws on personal data, consumer protection, copyright, online harms and financial regulation apply to AI, and regulators layer guidance on top. That makes the landscape flexible, but it also means the obligations are scattered and easy to miss.
The legal question usually arrives at one of four moments: when a business procures a third-party model, when it wants to train on customer data, when a regulated firm must show a supervisor how it controls model risk, or when an AI output causes harm and someone asks who is responsible. Each moment has a different answer, and the governance record built beforehand decides how well the organisation can defend its choices.
The legal and regulatory framework
Three layers make up the framework. The first is binding legislation that applies to AI because AI processes data, makes representations or produces content. The second is regulator guidance that sets expectations, some of which is supervisory and therefore carries real weight for licensed firms. The third is voluntary frameworks and testing tools that have become the market's reference point for what "responsible" looks like.
Binding law that already reaches AI
The Personal Data Protection Act 2012 (PDPA) governs any AI system that collects, uses or discloses personal data, including training, fine-tuning and the prompts staff type into tools. The Copyright Act 2021 contains a computational data analysis exception that is relevant to model training, subject to conditions such as lawful access to the source material. The Consumer Protection (Fair Trading) Act 2003 applies when AI-generated claims mislead consumers.
Online harms law also applies. The Elections (Integrity of Online Advertising) (Amendment) Act 2024 prohibits publishing deepfakes of election candidates during the election period. Parliament passed the Online Safety (Relief and Accountability) Bill in November 2025, creating an Online Safety Commission with powers to direct the removal of harmful content, including AI-generated intimate images. The Protection from Online Falsehoods and Manipulation Act 2019 continues to apply to false statements however they are produced.
Regulator guidance and supervisory expectations
The PDPC's Advisory Guidelines on Use of Personal Data in AI Recommendation and Decision Systems explain how consent, the business improvement and research exceptions, notification and accountability apply across the AI lifecycle. They do not create new law, but the PDPC uses them to interpret existing duties.
For financial institutions, the Monetary Authority of Singapore issued its Guidelines on Artificial Intelligence Risk Management on 7 October 2026, after consulting from November 2025. They apply to all forms of AI, including generative AI and AI agents. Oversight and risk management system expectations take effect from 7 October 2027, with lifecycle control and capability expectations following by 7 October 2028.
Voluntary frameworks that set the benchmark
IMDA and the PDPC publish the Model AI Governance Framework, first issued in 2019, a companion framework for generative AI, and since January 2026 a Model AI Governance Framework for Agentic AI, updated in May 2026 with case studies on multi-agent systems, third-party agents and automation bias. AI Verify, the government-developed testing framework and toolkit now stewarded by the AI Verify Foundation, gives organisations a structured way to test and document model behaviour.
| Source | Status | Who it reaches | Practical effect |
|---|---|---|---|
| PDPA and PDPC AI Advisory Guidelines | Statute plus interpretive guidance | Any organisation using personal data in AI | Consent or exception analysis, notices, accountability records, breach duties |
| MAS Guidelines on AI Risk Management | Supervisory guidelines, phased from October 2027 | Banks, insurers, capital markets and payment firms | AI inventory, materiality assessment, board oversight, lifecycle controls |
| Model AI Governance Frameworks (traditional, generative, agentic) | Voluntary | All sectors | De facto benchmark for procurement, audit and investor questions |
| AI Verify testing framework | Voluntary toolkit | Developers and deployers | Evidence of testing for fairness, robustness and transparency |
| Online harms and elections law | Statute | Platforms, publishers, individuals | Takedown duties and offences for deepfakes and harmful content |
Key decisions and how to approach them
Most organisations face the same handful of decisions. The right answer depends on whether the AI touches individuals, whether the firm is regulated, and whether the organisation builds or buys. The cards below set out the decisions we see most often.
Build, fine-tune or buy
Buying an enterprise model shifts engineering effort but not accountability. Fine-tuning on your own data creates new PDPA and copyright questions about the training set, and building in-house places the full lifecycle burden on you.
Which data may train the model
Training is often a new purpose. Check whether it falls within the purpose notified at collection, whether the business improvement exception applies, or whether anonymised data will do the job.
How much human oversight
The frameworks expect oversight proportionate to impact. A drafting assistant needs review before sending; an agent that can move money or change records needs hard limits, approval gates and kill switches.
What to tell users
Disclose when people interact with AI, what data it uses and how to reach a human. Clear disclosure reduces consumer protection risk and supports PDPA notification.
Who owns the risk internally
Name an accountable executive and a committee with authority to stop deployments. Spreading ownership across IT, legal and business teams without a decision-maker is the most common governance gap.
How to allocate vendor risk
Contracts should cover training on your inputs, retention of prompts, output ownership, model change notices, audit rights and incident reporting, not only uptime.
AI governance in Singapore is proportionate by design. A chatbot answering opening-hours questions does not need the controls of a credit-scoring model. The discipline lies in triaging use cases so that deep review is reserved for systems with material impact on people or the business.
Agentic AI: the new frontier for AI governance in Singapore
Agents differ from chatbots because they plan and act: calling tools, querying databases, sending messages and executing transactions. IMDA's agentic framework organises the response around four dimensions: assessing and bounding risks up front, making humans meaningfully accountable, implementing technical controls and processes, and enabling end-user responsibility.
In legal terms, the key point is that deploying an agent does not move accountability away from the organisation. If an agent sends a misleading message to a customer, discloses personal data to the wrong recipient or enters a contract outside its authority, the deployer will be expected to answer for it. Contracts with counterparties and vendors should therefore address agent identity, authority limits and audit trails.
An AI agent is a new kind of employee with no judgement and perfect speed. Give it the narrowest permissions that do the job, and log everything it does.
Practical controls include giving each agent a verifiable identity, scoping its tool access to the minimum, requiring human approval above set thresholds, rolling out in stages and monitoring continuously. These are technical measures, but their adequacy will be judged legally if something goes wrong.
Building an AI governance programme: step by step
A workable programme can be stood up in months, not years, if it starts with an inventory rather than a policy. The sequence below reflects how we usually structure the work.
- Inventory AI use. List every AI system in use or in development, including features embedded in vendor software and tools staff use informally. Record owner, purpose, data and vendor.
- Triage by materiality. Rate each use case on impact on individuals, financial and operational exposure, autonomy and reliance on third parties. MAS-regulated firms should align the rating with the materiality concept in the MAS guidelines.
- Map legal obligations. For material use cases, run the PDPA analysis, check copyright in training data, review consumer-facing claims and identify sector rules, such as MAS or healthcare guidance.
- Set policy and decision rights. Approve an AI policy, acceptable-use rules for staff, and a committee with authority to approve, condition or stop deployments.
- Test and document. Test material systems for accuracy, bias, robustness and security before launch, using AI Verify or equivalent methods, and record results and residual risks.
- Contract for control. Renegotiate or paper vendor terms to secure data use limits, change notices, audit rights and incident cooperation.
- Monitor and report. Track performance drift, incidents and complaints, and report to the board at least annually, more often for high-impact systems.
Documents and evidence to assemble
Regulators, auditors, investors and courts will all ask the same question: show us how you decided. The evidence file for AI governance in Singapore should be built as you go, not reconstructed after an incident.
- AI inventory and materiality ratings, dated and version-controlled, with named owners.
- Data provenance records for each training and fine-tuning dataset, including source, legal basis and any licence terms.
- PDPA assessments, including data protection impact assessments for high-risk processing and notes on reliance on exceptions. Our data protection and PDPA team prepares these alongside the AI review.
- Testing reports covering performance, fairness, robustness and security, with sign-off and known limitations.
- Vendor due diligence and contracts, including model cards, security attestations and data processing terms. See our technology transactions practice for contract structures.
- User-facing disclosures and the version history of each.
- Incident and complaint logs, with root-cause analysis and remediation.
- Board and committee minutes showing approval, challenge and conditions imposed.
Risks and common mistakes
Treating AI as outside existing law
Because Singapore has no AI Act, some teams assume AI is unregulated. It is not. The PDPA applies to every prompt containing personal data, consumer protection law applies to AI-generated marketing, and copyright applies to training material and outputs. Regulators have said they will apply existing duties to AI rather than wait for new legislation. The risk is a deployment that looks compliant under a voluntary framework but breaches a binding statute. Start every assessment with the binding law, then use the frameworks to decide how to meet it.
Relying on vendor marketing instead of contract terms
Enterprise AI products are often sold with assurances that customer data is not used for training. Those statements matter only if they appear in the contract and cover all data, including prompts, outputs, logs and feedback. Check where data is processed, how long it is retained, whether sub-processors are involved and what happens when the vendor updates the model. Under the PDPA, the organisation remains responsible for personal data processed by a data intermediary on its behalf, so a vendor failure is still your regulatory problem.
Shadow AI and unmanaged staff use
Staff use consumer AI tools to summarise documents, draft emails and write code, often pasting in confidential or personal data. Banning everything rarely works and pushes use underground. A better approach is to approve enterprise tools with suitable terms, publish acceptable-use rules that are short enough to follow, and train staff on what not to paste. Log approved use so that the inventory reflects reality. Unmanaged use creates confidentiality, privilege and data protection exposure that is hard to detect until it surfaces in a breach.
Writing a policy without decision rights
An AI policy that sets principles but names no one with authority to approve or stop a deployment is weak evidence of governance. Supervisors, particularly MAS, look for clear accountability at senior management and board level. Set thresholds for escalation, define who signs off material use cases, and record the decisions. When things go wrong, minutes showing that a committee asked hard questions and imposed conditions are far more persuasive than a policy document alone.
Ignoring intellectual property in outputs
Ownership of AI-generated output is not straightforward under Singapore copyright law, which protects works with human authorship. If you depend on AI-generated code, designs or content commercially, consider whether you can enforce rights in them and whether they may reproduce third-party material. Vendor indemnities for output infringement vary widely and often carry exclusions. Brand assets in particular should involve meaningful human creative input so that you can protect them through our copyright and content and trade mark work.
If you are an MAS-regulated firm, treat October 2027 as a hard deadline for your AI inventory, materiality framework and board oversight structure. Supervisors will expect to see them in use, not just approved. Firms that start the inventory now usually find more AI in their vendor estate than they expected.
Cross-border angle
Many organisations operating from Singapore also deploy AI in markets with harder-edged rules. The EU AI Act imposes obligations by risk category on providers and deployers whose systems are placed on the EU market or whose output is used there. The UK relies on sector regulators applying cross-cutting principles. China requires filings and security assessments for certain generative AI and recommendation services. The UAE and Bangladesh are developing their own policies and data protection regimes.
A sensible approach is to build one group-wide inventory and control set anchored in the strictest regime that applies, then add local layers. AI governance in Singapore aligns well with international frameworks, which makes a Singapore programme a useful foundation. Cross-border data flows for training and inference must also satisfy the PDPA transfer limitation obligation, which our cloud and outsourcing team regularly addresses.
Through TRW & Co's offices in Dhaka, London, Dubai and China, and our network elsewhere, we coordinate local advice so that group policies, vendor contracts and disclosures stay consistent. Where a specific market requires local counsel, we instruct and manage them.
How TRW & Co helps with AI governance in Singapore
We advise on the legal side of AI programmes and work closely with technical and risk teams, so that the paperwork reflects how systems actually behave. Typical workstreams include the following.
Programme design
We build AI inventories, materiality frameworks, policies and committee terms of reference calibrated to your sector, including the MAS guidelines for financial institutions.
Use-case reviews
We assess individual deployments for PDPA, copyright, consumer protection and sector compliance, and record the reasoning in a form auditors and regulators can follow.
AI contracts
We negotiate model licences, enterprise AI terms and development agreements, with attention to data use, change control, indemnities and audit rights, drawing on our software licensing experience.
Incidents and disputes
When an AI system causes harm, we coordinate the response with our data breach response and technology disputes teams, working with Singapore-qualified counsel where court or tribunal representation is required.
For an overview of our technology and data work, see our practices or read our note on AI and personal data. To discuss a specific deployment, contact us.
Checklist for decision-makers
- Do we have a complete, dated inventory of AI systems, including features inside vendor products?
- Has each use case been rated for materiality, with deeper review for high-impact systems?
- Is there a documented PDPA basis for every dataset used to train or fine-tune a model?
- Do vendor contracts prohibit unapproved training on our data and require notice of model changes?
- Do AI agents have scoped permissions, approval thresholds and full audit logs?
- Are users told when they are dealing with AI and how to reach a person?
- Has the board approved AI risk appetite and does it receive regular reporting?
- If we are MAS-regulated, is our programme on track for the October 2027 and October 2028 milestones?
Organisations that can answer yes to each question are well placed to scale AI with confidence. Those that cannot should treat AI governance in Singapore as a current compliance task rather than a future project.
Frequently asked questions
01Does Singapore have an AI law like the EU AI Act?
No. Singapore has chosen not to enact a horizontal AI statute. Instead, existing laws apply to AI: the PDPA for personal data, the Copyright Act 2021 for training material and outputs, consumer protection law for AI-generated claims, and online harms and elections laws for deepfakes. Regulators add guidance, including the PDPC's AI advisory guidelines and MAS's AI risk management guidelines for financial institutions. Voluntary frameworks from IMDA set the benchmark for good practice. If you also operate in the EU, the EU AI Act may apply to you separately, so map both regimes.
02Who do the MAS AI Risk Management Guidelines apply to and when?
They apply to financial institutions regulated by MAS, including banks, insurers, capital markets intermediaries and payment service providers, and cover all forms of AI, including generative AI and AI agents. MAS issued them on 7 October 2026. Oversight and risk management system expectations take effect on 7 October 2027, and lifecycle control and capability expectations by 7 October 2028. The guidelines are proportionate, so the depth of controls should match the materiality of each AI use case. Firms should start with an inventory and a materiality framework because everything else depends on them.
03Do we need consent to train an AI model on customer data?
Not always, but you need a lawful basis under the PDPA. Start by checking whether training falls within the purpose you notified when collecting the data. If it does not, options include obtaining fresh consent, relying on the business improvement or research exceptions as explained in the PDPC's AI advisory guidelines, or using anonymised data. Each route has conditions, and the analysis should be documented for each dataset. Using customer data to improve a vendor's general model, rather than your own service, usually needs separate scrutiny because the purpose and the party benefiting change.
04Are the Model AI Governance Frameworks legally binding?
No, they are voluntary. In practice, however, they are the reference point that procurement teams, auditors, investors and regulators use to judge whether an organisation's AI controls are reasonable. Following them also helps demonstrate accountability under the PDPA. The agentic AI framework, launched in January 2026 and updated in May 2026, is now the main benchmark for organisations deploying AI agents. Treat the frameworks as the method for meeting binding obligations, and document where you have adopted a different approach and why.
05Who is liable if an AI agent makes a mistake?
Generally the organisation that deployed it. Singapore's frameworks are explicit that humans and organisations remain accountable for agent behaviour, and existing law on contract, negligence, consumer protection and data protection applies to the outcome. Whether you can recover losses from the AI vendor depends on your contract, so review warranties, liability caps and indemnities carefully. Limiting an agent's permissions, setting approval thresholds and keeping full logs both reduces the risk and gives you evidence if a dispute arises.
06How should a small company start on AI governance?
Keep it proportionate. List the AI tools in use, including those staff use informally, and identify the few that touch personal data, customers or significant decisions. Approve one or two enterprise tools with acceptable terms, issue short acceptable-use rules, and name a person responsible for AI decisions. For higher-impact uses, document a simple assessment covering data, accuracy, human review and vendor terms. This can be done in weeks and creates a foundation that scales as the business grows or seeks investment.
07Can we own the copyright in AI-generated content?
Singapore copyright law protects works that originate from human authors, so purely machine-generated output may not attract copyright protection. Where a person makes meaningful creative choices in producing the work, protection is more likely, but the position depends on the facts. For commercially important assets such as logos, product designs or core code, ensure there is substantial human creative input and keep records of it. Also review vendor terms on output ownership and indemnities for third-party infringement claims.
Sources and official materials
- Personal Data Protection Act 2012 — Core statute governing personal data used in AI
- PDPC Advisory Guidelines on Use of Personal Data in AI Recommendation and Decision Systems — How PDPA consent, exceptions and accountability apply to AI
- MAS Guidelines on Artificial Intelligence Risk Management — Supervisory expectations for financial institutions' AI use
- IMDA: Updated Model AI Governance Framework for Agentic AI — 2026 framework for deploying AI agents
- Copyright Act 2021 — Authorship, infringement and computational data analysis exception
- Consumer Protection (Fair Trading) Act 2003 — Unfair practices, including misleading AI-generated claims
General information only, current as at 20 October 2026. It is not legal advice and does not create a lawyer–client relationship. Singapore law and regulatory practice change; check current official sources and take advice on the facts of your matter.
Talk it through
before you decide.
Share the decision, the jurisdictions and the timetable. A partner will tell you what matters, what can wait and what it will take.