TRW & Co · AI, media and content
Generative AI Chatbots: IMDA Transparency Guidelines and a Deployer Checklist
The AI chatbot guidelines in Singapore are IMDA's voluntary Transparency Guidelines for Generative AI Chatbots, published on 20 July 2026. They ask deployers of customer-facing chatbots to publish a Chatbot Info Card explaining capabilities and limits, safety measures, data use and how to report issues, with a safety statement and link shown at first use.
Key pointThe guidelines are voluntary, but what a chatbot tells customers is not: personal data, consumer protection and misrepresentation rules already apply, and a substantive Info Card is the best evidence that a deployer took them seriously.
At a glance
Published by IMDA
The Transparency Guidelines for Generative AI Chatbots were published on 20 July 2026 and are voluntary, though IMDA strongly encourages a minimum baseline of transparency.
Scope
External-facing generative AI chatbots used by customers or the public, including general-purpose, companion and domain-specific enterprise chatbots; internal-only tools are excluded.
Four questions
The Chatbot Info Card should explain what the chatbot can do, how reliable and safe it is, how user data is used, and how to report issues.
Minimum baseline
At least one substantive disclosure per question, a high-level safety statement at first use with a link to the Card, and easy access from within the chatbot.
Timing
Publish the Card by launch, including beta or pilot releases, and update it within a reasonable time when capabilities or safety change meaningfully.
Swipe or scroll →
The short answer: what the AI chatbot guidelines in Singapore ask of you
The AI chatbot guidelines in Singapore are IMDA's Transparency Guidelines for Generative AI Chatbots, published on 20 July 2026. They ask organisations that deploy customer-facing generative AI chatbots to publish a Chatbot Info Card: a single, plain-language reference explaining what the chatbot can and cannot do, how safe and reliable it is, how user data is handled and how to report problems.
The guidelines are voluntary. But IMDA strongly encourages a minimum baseline, and they sit on top of binding law on personal data, consumer protection and misrepresentation that already applies to what a chatbot says. In practice, a deployer that cannot explain its chatbot's limits and safeguards will find those binding obligations harder to meet.
This article gives deployers, from banks and retailers to start-ups building companion apps, a practical checklist for disclosure, content safety and accountability.
What IMDA published and why
IMDA released the Transparency Guidelines for Generative AI Chatbots on 20 July 2026. The guidelines respond to a familiar problem: information about chatbots tends to be too technical, scattered across terms of service, privacy notices and blog posts, or oversimplified for marketing. Users then cannot judge how far to rely on a chatbot, and trust suffers, especially where minors and vulnerable users are involved.
IMDA chose to start with chatbots at the application layer, rather than the underlying models, because that is where most people encounter generative AI. The central tool is the Chatbot Info Card, which IMDA compares to a medicine label: one place where users find the essential information.
The guidelines complement IMDA's broader AI governance work, including the Model AI Governance Framework for Generative AI and the testing tools published through the AI Verify Foundation. For businesses already following those frameworks, the Info Card is largely a matter of surfacing existing information in a usable form. Our page on AI governance in Singapore sets out the wider framework.
Why the timing matters
Although the AI chatbot guidelines in Singapore impose no penalties, they are likely to become the reference point for what reasonable transparency looks like. Regulators, courts and customers assessing a complaint about a chatbot's answer will naturally ask whether the deployer explained the chatbot's limits and safeguards in the way IMDA recommends.
Corporate customers procuring chatbot services can be expected to ask vendors for Info Card content as part of due diligence. Building the Card into the launch process now is far cheaper than retrofitting it across several products later.
Which chatbots the AI chatbot guidelines in Singapore cover
The guidelines apply to external-facing generative AI chatbots used by customers or the public. Chatbots deployed solely for internal use, such as staff knowledge assistants, are outside scope, though many organisations will choose to follow the same discipline.
| Category or factor | What it covers | Disclosure emphasis |
|---|---|---|
| General-purpose chatbots | Open-domain assistants handling a wide range of tasks | Breadth of capability, factual error risk, data use for training |
| Companion chatbots | Designed for social interaction and emotional engagement | Emotional safety, age restrictions, escalation to human help |
| Domain-specific enterprise chatbots | Customer service, banking, healthcare, retail and similar uses | Scope limits, out-of-scope requests, reliance on answers |
| Usage factor | Whether the chatbot only provides information or takes actions for the user | Agentic functions need clearer limits and confirmation steps |
| Domain factor | General use versus specialised fields such as health or finance | Higher-stakes domains warrant more specific safety disclosures |
| User-profile factor | Whether minors or vulnerable users can access the service | Age-related safeguards and parental controls |
A chatbot may fit more than one category, and newer agentic assistants may not fit neatly into any. IMDA's answer is to use the three risk factors to decide which risks and disclosures are most relevant. Our guide to the agentic AI governance framework covers the separate governance issues when a chatbot can take actions on a user's behalf.
Who is responsible
Deployers bear primary responsibility for transparency to end-users, and for conducting pre-deployment risk assessments and putting mitigations in place. Upstream parties, especially model providers, are expected to support deployers with relevant, up-to-date information about the underlying model. Deployers need not attest to upstream information that is not reasonably available to them or that they cannot verify.
The Chatbot Info Card: four questions to answer
At the heart of the AI chatbot guidelines in Singapore is a set of four questions that the Info Card must address.
- What can the chatbot do and not do? Its intended uses, capabilities, limitations and prohibitions, such as age restrictions and out-of-scope uses.
- How reliable and safe is it? The common risks, such as content safety, emotional safety and age-related risks; the safeguards in place; the residual risks; and precautions users should take, such as fact-checking, limited sharing and parental controls.
- How is user data used and protected? What data is collected, who can access it, whether it is used to train models, and what controls users have.
- How can users report issues? The reporting channels, the types of issues that can be raised, and what acknowledgement and follow-up users can expect.
Each answer must be a substantive disclosure: a concrete, specific statement a user can act on. IMDA contrasts a statement that the chatbot can produce factual errors and its answers should be checked before important decisions with a generic assurance that the company takes safety seriously. Only the first counts.
Write the Info Card for the user, not the regulator. If a customer reading it could not tell whether to rely on the chatbot's answer about a refund, a dosage or a loan repayment, the disclosure is probably not substantive enough.
The minimum baseline and how to calibrate disclosure
IMDA organises the guidelines around three principles: relevance, accessibility and timeliness. While the guidelines are voluntary, deployers are strongly encouraged to meet a minimum baseline under each.
Under the AI chatbot guidelines in Singapore, the relevance minimum is at least one substantive disclosure for each of the four questions. Beyond that, deployers calibrate. They should weigh usefulness to users against the effort of producing information, need not publish proprietary details, should withhold details that could expose the system to attack, and need disclose only information reasonably available to them.
On accessibility, the minimum is a high-level safety statement at first use, with a clearly identifiable link to the Info Card, and the Card must be easily reachable from within the chatbot afterwards. IMDA also recommends plain language, layered disclosure and consistent presentation across web and mobile. A family of closely related chatbots can share one consolidated Card if it explains the differences between variants.
On timeliness, the Card should be published by the time the chatbot is available to external users, including in beta or pilot form. Chatbots launched before the guidelines should get a Card as soon as reasonably practicable. Updates are expected within a reasonable time when a change meaningfully affects users' understanding of capabilities or safety, but not for routine maintenance.
The binding law behind voluntary guidelines
The AI chatbot guidelines in Singapore are voluntary, but voluntary does not mean low risk. A chatbot's outputs are statements made by the deploying business, and several binding regimes apply to them.
- Personal data. The Personal Data Protection Act 2012 governs collection, use and disclosure of personal data through chatbots, including notification of purposes and any use for model training. The PDPC has issued advisory guidance on AI systems; our guide to the PDPC generative AI advisory guidelines covers training and deployment issues.
- Consumer protection. Misleading statements by a chatbot about price, terms or product qualities can amount to unfair practices under the Consumer Protection (Fair Trading) Act 2003, enforced by the CCCS. Interface designs that steer users into choices may raise the issues discussed in our guide to dark patterns and online consumer protection.
- Contract and misrepresentation. Courts in other common law jurisdictions have already held businesses responsible for inaccurate information given by their website chatbots. Disclaimers help, but they are unlikely to protect a deployer whose chatbot confidently states something false about the customer's rights.
- Sector rules. Financial institutions also need to meet MAS expectations on AI risk management, summarised in our guide to the MAS AI risk management guidelines. Healthcare deployers face professional and medical device considerations.
Our data protection and PDPA team often reviews chatbot privacy flows alongside the Info Card, since the two disclosures need to be consistent.
Implementing the guidelines: a step-by-step plan
- Inventory your chatbots. List every external-facing chatbot, including pilots, embedded widgets and chatbots run by vendors on your behalf. Note the model provider, the domain and whether minors can access it.
- Assess risk using IMDA's factors. For each chatbot, assess usage, domain and user profile. Record the main content, emotional, age-related and data risks, and the mitigations in place.
- Gather upstream information. Ask model and platform providers for documentation on safety testing, data handling and known limitations. Build this obligation into supplier contracts.
- Draft the Info Card. Answer the four questions with substantive, specific disclosures. Have legal, product and customer-service teams review it for accuracy and consistency with privacy notices.
- Design the user journey. Add a short safety statement at first use with a clear link to the Card, and make the Card reachable from within the chatbot on every platform.
- Set up reporting and escalation. Create channels for users to report harmful or wrong outputs, with acknowledgement and follow-up. Provide a route to a human for consequential matters.
- Govern changes. Define which changes, such as a new model, new features or a safety incident, trigger an update to the Card, and who approves it.
Illustrative scenario: an insurer launches a claims assistant
This scenario is illustrative only and does not describe any real matter. A general insurer launches a generative AI assistant on its website and app to answer policy questions and help customers start claims. The assistant can pre-fill a claim form but cannot approve claims.
Applying the guidelines, the insurer publishes an Info Card stating that the assistant explains policy terms but cannot decide coverage, that answers should be checked against the policy wording, that conversation data is retained for a stated purpose and is not used to train third-party models, and how to reach a human claims officer. A short safety statement appears when a conversation begins.
Three months later, the insurer switches to a new underlying model and allows the assistant to submit claims after customer confirmation. That changes the chatbot's capabilities and risk profile, so the Card is updated and the confirmation step is described. The insurer also updates its supplier agreement to require notice of material model changes.
Risks and common mistakes
Boilerplate disclosures
Many existing chatbot notices say little more than that AI can make mistakes. Under the IMDA guidelines, a disclosure should be specific enough for a user to act on. Generic assurances about taking safety seriously do not meet the minimum baseline, and they offer little protection if a customer later argues they were misled about the chatbot's reliability.
Inconsistent privacy and Info Card statements
If the Info Card says conversations are not used to train models but the privacy notice or vendor contract allows it, the inconsistency creates PDPA and consumer protection risk. Map the actual data flows, including those at the model provider, before drafting either document, and update both together.
Forgetting vendor-run and white-label chatbots
A chatbot built and hosted by a vendor but presented under your brand is still your chatbot from the user's perspective. Responsibility for transparency rests primarily with the deployer. Contracts should require the vendor to provide the information you need and to notify you of material changes.
Ignoring minors and vulnerable users
IMDA highlights age-related and emotional safety risks, particularly for companion chatbots. If minors can access the service, the Info Card should explain age restrictions and safeguards, and the product should have age-appropriate controls. Failing to address this is the area most likely to draw regulatory and public attention.
Cross-border angle and a deployer checklist
Many chatbots serving Singapore users are deployed by regional groups with teams in Bangladesh, the UAE, China or the UK, or by foreign providers. Other jurisdictions are developing their own AI transparency rules, and a well-built Info Card is a good foundation for meeting several regimes at once. Where foreign rules are stricter, align to the higher standard and note local variations.
- Confirm which chatbots are external-facing and in scope.
- Complete a risk assessment for each, using usage, domain and user-profile factors.
- Publish an Info Card with at least one substantive disclosure for each of the four questions.
- Show a safety statement at first use and link to the Card from within the chatbot.
- Align the Card with privacy notices, terms and vendor contracts.
- Set triggers and owners for Card updates after material changes.
- Keep records of decisions to support accountability if issues arise.
Following the AI chatbot guidelines in Singapore is now the clearest way to show responsible deployment. For help reviewing a chatbot, drafting an Info Card or negotiating model provider terms, our technology transactions and media teams can assist. Please contact us to discuss how the AI chatbot guidelines in Singapore apply to your services.
Frequently asked questions
01Are IMDA's generative AI chatbot guidelines mandatory?
No. IMDA's Transparency Guidelines for Generative AI Chatbots are voluntary. However, IMDA strongly encourages deployers to adopt at least the minimum baseline: a substantive disclosure on each of the four key questions, a high-level safety statement at first use with a link to the Chatbot Info Card, and easy access to the Card from within the chatbot. Binding laws on personal data, consumer protection and misrepresentation continue to apply to chatbot outputs.
02What is a Chatbot Info Card?
It is a single, consolidated source of key information about a chatbot, which IMDA likens to a medicine label. It should tell users what the chatbot can and cannot do, how reliable and safe it is and what precautions to take, how their data is collected, used and protected, and how to report problems. It can be a web page, document or in-product notice, as long as it is easy to find and understand.
03Do the guidelines apply to internal AI assistants used by staff?
No. The guidelines focus on external-facing generative AI chatbots used by customers or members of the public. Chatbots deployed solely for internal organisational use, such as staff productivity or knowledge tools, are outside scope. Organisations may still find the Info Card approach useful internally, and internal tools remain subject to data protection and confidentiality obligations.
04Who is responsible for chatbot transparency, the deployer or the model provider?
The deployer bears primary responsibility for transparency to end-users and for pre-deployment risk assessment and mitigation. Upstream parties such as model providers are expected to support deployers with relevant, up-to-date information. Deployers need not attest to upstream information that is not reasonably available to them or that they cannot verify, so supplier contracts should require the information needed.
05Do we have to disclose proprietary details about our chatbot?
No. The guidelines say deployers do not have to publish proprietary details, and should withhold information that could compromise security or expose the chatbot to attack. Where safety measures are a competitive advantage, deployers are encouraged to describe the protections and their effectiveness without implementation details. The aim is proportionate, useful disclosure rather than technical documentation.
06When should the Info Card be updated?
Within a reasonable time whenever a development meaningfully affects users through a change in the chatbot's capabilities or safety profile, whether caused by changes to the chatbot or by external factors. Examples include switching to a new model or adding the ability to take actions. Routine maintenance and minor interface changes generally do not require an update, though periodic review is encouraged.
Sources and official materials
- IMDA: Transparency Guidelines for Generative AI Chatbots — Scope, Chatbot Info Card, minimum baseline, timeliness
- Infocomm Media Development Authority — AI governance frameworks and guidance
- AI Verify Foundation — AI testing tools and governance resources
- Personal Data Protection Commission — PDPA obligations and AI advisory guidance
- Competition and Consumer Commission of Singapore — Consumer protection and unfair practices
General information only, current as at 20 October 2026. It is not legal advice and does not create a lawyer–client relationship. Singapore law and regulatory practice change; check current official sources and take advice on the facts of your matter.
