TRW & Co · AI governance
Model AI Governance Framework for Agentic AI in Singapore
IMDA's Model AI Governance Framework for Agentic AI, launched in January 2026, is the benchmark for agentic AI governance in Singapore. It asks organisations to bound agent risks upfront, keep humans meaningfully accountable, apply technical controls and inform users. This guide converts it into practical controls on autonomy, oversight checkpoints and contract terms allocating liability.
Key pointBecause IMDA's own discussion paper finds that existing law allocates agent-caused loss imperfectly, the contract and the action log are, in practice, your main liability protection.
At a glance
Launched January 2026
IMDA launched the Model AI Governance Framework for Agentic AI on 22 January 2026 at the World Economic Forum in Davos.
Four governance dimensions
Bound risks upfront, make humans meaningfully accountable, apply technical controls across the lifecycle, and enable end-user responsibility through transparency and training.
Guidance, not statute
The framework is guidance and a living document, but it signals what regulators and counterparties will treat as reasonable practice for AI agents.
Security addendum published
CSA published an addendum on securing agentic AI in June 2026, focused on mapping agent workflows and controls across the development lifecycle.
Liability remains unsettled
IMDA's May 2026 discussion paper noted that AI agents are not legal persons and that contract, negligence and product liability each leave gaps.
Swipe or scroll →
Agentic AI governance in Singapore: the short answer
The reference point for agentic AI governance in Singapore is the Model AI Governance Framework for Agentic AI, launched by the Infocomm Media Development Authority (IMDA) on 22 January 2026 at the World Economic Forum in Davos. It is guidance rather than legislation, but it sets out what regulators, customers and courts are likely to treat as reasonable practice when an organisation lets an AI system plan and take actions on its behalf.
The framework rests on four dimensions: assess and bound risks upfront; make humans meaningfully accountable; implement technical controls across the agent lifecycle; and enable end-user responsibility. Its core message is that autonomy should be designed, limited and supervised, and that humans remain accountable for what agents do.
This article turns those principles into three concrete control sets that a general counsel can own: limits on autonomy, human oversight checkpoints, and contract terms that allocate liability for agent actions.
What the framework says and how it fits with other guidance
The Model AI Governance Framework for Agentic AI builds on IMDA's earlier Model AI Governance Framework and on its testing work, including the Starter Kit for testing LLM-based applications. IMDA describes it as a living document and invites feedback and case studies, so organisations should expect it to evolve.
Three other instruments now sit around it. In June 2026 the Cyber Security Agency of Singapore (CSA) published an addendum on securing agentic AI to its guidelines and companion guide on securing AI systems, focused on mapping agent workflows and the points where attackers could exploit them. In May 2026 IMDA released a discussion paper on the allocation of legal responsibility for AI agents. And the Personal Data Protection Commission's 2026 advisory guidelines on generative AI flag agent activity data as a new category of personal data that deployers must protect.
| Instrument | Issuer | Focus | Status |
|---|---|---|---|
| Model AI Governance Framework for Agentic AI | IMDA | Risk bounding, human accountability, technical controls, end-user responsibility | Guidance; living document |
| Securing Agentic AI addendum | CSA | Security risks in agent workflows and controls across the lifecycle | Guidance read with CSA's AI security guidelines |
| Discussion paper on legal responsibility for AI agents | IMDA | Contract, negligence, product liability and gaps in allocating loss | Discussion paper; no new law |
| Advisory Guidelines on Use of Personal Data in Generative AI | PDPC | PDPA duties, including for prompts, outputs and agent activity data | Advisory guidelines on binding PDPA duties |
| Sector rules (for example MAS guidance) | Sector regulators | Risk management expectations for regulated firms | Varies by sector |
Who should be paying attention
The framework is relevant to any organisation that lets software act with some independence: customer service agents that issue refunds, coding agents with repository access, finance agents that reconcile and pay invoices, and research agents that browse and summarise on staff instructions. It applies whether the agent is built in-house or bought as a feature of an enterprise platform.
Ownership is often unclear. Technology teams build or configure agents, business units decide what they do, and legal and compliance teams are asked to approve after the fact. The framework's emphasis on clear allocation of responsibility across developers, deployers, operators and end users is a prompt to settle internal ownership before the first agent reaches production, with a named accountable executive for each deployment.
For the data protection side, see our analysis of the PDPC generative AI advisory guidelines; financial institutions should also read our note on MAS AI risk management guidelines.
Control set one: limits on autonomy
The first dimension of agentic AI governance in Singapore is about design choices made before deployment. The framework asks organisations to choose suitable use cases and to bound risk by limiting what an agent can reach and do. In practice, autonomy has four levers.
- Tools. Which systems the agent may call: email, payments, code repositories, customer records. Restrict to an approved list.
- Permissions. What each tool connection allows: read, draft, or execute. Default to least privilege.
- Scope of action. Value limits, counterparties, data categories and time windows within which the agent may act.
- Environment. Whether the agent operates in a sandbox, on test data or in production.
A useful discipline for agentic AI governance in Singapore is an autonomy register: one line per agent recording its purpose, tools, permissions, limits and the named business owner. The register becomes the evidence that risks were bounded upfront, and it is the first thing an auditor, regulator or counterparty will ask for after an incident.
Agent identity matters too. Each agent should act under its own credentials, not a shared human account, so that its actions can be logged, attributed and revoked.
Control set two: meaningful human oversight
The framework stresses that humans remain accountable and that oversight must be meaningful, not a rubber stamp. That means defining checkpoints where human approval is required, especially before actions with material real-world effect, and ensuring the human has the information and time to say no.
- Classify actions. Sort the agent's possible actions into those it may take alone, those needing approval, and those it may never take.
- Set approval checkpoints. Require human sign-off for irreversible, high-value or externally visible actions such as payments, contract acceptance or public communications.
- Design the approval screen. Show the reviewer what the agent proposes, why, and what data it relied on, so approval is informed.
- Provide a stop control. Give operators the ability to pause, override or roll back an agent quickly.
- Log everything. Keep tamper-evident logs of plans, tool calls and approvals, with retention rules that also satisfy PDPA duties.
- Roll out progressively. Start with limited users and low-risk tasks, monitor in real time, and widen scope only on evidence.
- Review after incidents. Treat unexpected agent behaviour as an incident, record the cause and adjust limits or checkpoints.
Watch for approval fatigue. If reviewers approve hundreds of agent actions a day, oversight quickly becomes nominal. Fewer, better-designed checkpoints on genuinely material actions are more defensible than blanket approval of everything.
Technical controls, testing and end-user responsibility
The third and fourth dimensions of the framework complete the picture. For agentic AI governance in Singapore, technical controls are expected across the whole lifecycle, not just at launch. During design, that means tool guardrails, plan reflection (having the agent check its own proposed steps against policy) and least-privilege access to tools and data. Before deployment, it means testing whole-task execution, policy compliance and the accuracy of tool use, not only the quality of individual answers.
After deployment, the framework points to progressive roll-outs and real-time monitoring. Agents can behave differently once they meet live data, new tools or changed upstream models, so monitoring should look for unusual action patterns as well as errors. The CSA addendum adds a security lens: map each agent workflow end to end and identify where an attacker could inject instructions, poison data or hijack a tool connection.
The fourth dimension concerns the people who use or are affected by agents. Users should be told what an agent can and cannot do, given a clear route to escalate when it misbehaves, and trained so that they keep the skills needed to supervise it. Where customers interact with an agent, plain disclosure that they are dealing with an automated system, and how to reach a human, reduces both complaint risk and the chance that a disclaimer is later found unfair.
Taken together, these controls make agentic AI governance in Singapore auditable. A board or regulator can ask to see the test plan, the monitoring dashboard, the incident log and the user information, and each should exist in writing.
Control set three: contracts and liability for AI agents
IMDA's discussion paper is candid that existing law does not neatly allocate loss caused by AI agents. Its working group took the view that AI agents are not legal persons and so cannot be agents in the legal sense. Contract can allocate risk between the parties to it, but privity limits its protection for third parties. Negligence raises hard questions about duty, standard of care and causation across a long value chain. Product liability rules were seen as too narrow to cover AI-related losses.
The practical consequence for agentic AI governance in Singapore is that contracts do most of the work. A business deploying an agent built on third-party models and platforms should negotiate terms on the following points, which our technology transactions team regularly addresses:
| Issue | What to seek as deployer | Why it matters |
|---|---|---|
| Authority and limits | Clear statement that the agent acts only within configured limits, with logging of every action | Supports arguments on attribution when an agent exceeds instructions |
| Model and tool changes | Notice of material model updates and the right to test before rollout | Behaviour can change without any change on your side |
| Security and incidents | Alignment with CSA guidance, prompt incident notification and cooperation | Agents widen the attack surface through tool access |
| Data use | No training on your data without consent; deletion on exit; PDPA intermediary terms | Prompts and agent logs often contain personal data |
| Liability and caps | Carve-outs or higher caps for data breaches and unauthorised transactions | Standard caps may be small relative to agent-caused loss |
| Audit and evidence | Access to logs and test results for investigations and disputes | Proof of what the agent did is essential in any claim |
Customer-facing terms matter as well. Where an agent transacts with consumers, unfair disclaimers may not survive, and the consumer-protection position should be checked. If a dispute does arise, our technology disputes practice can advise on the evidence needed.
Illustrative scenario: a procurement agent
This scenario is illustrative only and uses generic parties. A regional distributor deploys an AI agent to raise purchase orders with approved suppliers when stock falls below set levels. The agent can read inventory data, draft orders and send them by email.
Applying the framework as a template for agentic AI governance in Singapore, the distributor limits the agent to approved suppliers, caps order values, and requires human approval for any order above the cap or with a new supplier. The agent operates under its own service account and every action is logged.
Months later, a supplier price list is altered and the agent drafts an unusually large order. Because the value exceeds the cap, the order is routed for approval and a buyer spots the anomaly. The distributor records the incident, tightens validation of price data and asks its platform vendor, under the contract's cooperation clause, for the relevant logs. Good design turned a potential loss into a near miss.
Risks and common mistakes
Treating agents like chatbots
Governance written for chat assistants focuses on output accuracy. Agents act: they send emails, move money and change records. Policies that only cover content quality miss authority, permissions and reversibility. Review existing AI policies and add specific provisions for tool access, action limits and approval checkpoints before agents go live.
Shared credentials and invisible actions
Agents running under a human employee's login make it impossible to tell who did what. That undermines incident response, PDPA accountability and any later dispute. Give each agent its own identity, least-privilege permissions and logs that can be attributed and preserved.
Relying on vendor assurances alone
Many agents are assembled from third-party models, orchestration platforms and plug-ins. The framework places accountability on the organisation deploying the agent. Vendor marketing that an agent is safe is no substitute for your own testing, monitoring and contractual rights to information when something goes wrong.
Forgetting the personal data trail
Agent plans, tool calls and outputs often contain customer or employee data. These logs need retention limits, access controls and a place in your breach response plan. Our guide to data breach response explains notification duties if agent logs are exposed.
Cross-border angle
Agents frequently run on infrastructure outside Singapore and act in several markets at once. Data flowing to overseas model providers also engages the PDPA transfer limitation obligation, so cross-border data clauses belong in the same contract as the agent terms. Beyond data, agentic AI governance in Singapore intersects with regimes elsewhere. A group deploying the same agent in Singapore, the UK, the EU or the UAE will face different regulatory expectations, including binding rules in some jurisdictions. Designing to the most demanding applicable standard and documenting local variations is usually simpler than maintaining separate agents. Our AI governance practice coordinates such reviews with counsel in other markets.
What to do now: a checklist
As of October 2026, organisations piloting agents should be able to show the following elements of agentic AI governance in Singapore in place:
- An autonomy register naming each agent, its purpose, tools, permissions, limits and owner.
- Documented action classes and human approval checkpoints for material actions.
- Separate agent identities, least-privilege access and tamper-evident logs.
- Pre-deployment testing, progressive rollout and real-time monitoring.
- Contract terms on model changes, data use, incidents, liability and log access.
- User information explaining what agents can do and how to escalate problems.
Further reading is available on IMDA's artificial intelligence pages and the Cyber Security Agency of Singapore website. To discuss an agent deployment, contract or governance review, please contact TRW & Co.
Frequently asked questions
01Is the Model AI Governance Framework for Agentic AI mandatory?
No. It is guidance issued by IMDA and is described as a living document. However, it shapes what is regarded as reasonable practice. Regulators, auditors and counterparties are likely to compare an organisation's controls against it, and binding obligations such as the PDPA Protection Obligation or sector rules still apply to agents. Ignoring the framework therefore increases legal and commercial risk even without a direct penalty.
02Who is liable when an AI agent makes a mistake in Singapore?
There is no agent-specific liability statute. IMDA's discussion paper notes that AI agents are not legal persons, so responsibility falls on the people and organisations involved. Liability may arise in contract between the parties, in negligence where a duty of care is breached, or under sector rules. The deploying organisation is usually the first target, which is why contract terms with vendors, action limits and detailed logs are important.
03What human oversight does the framework expect?
It expects humans to remain meaningfully accountable, with defined checkpoints where human approval is required, particularly before actions with significant real-world effects. Oversight should allow people to intercept, override or review agent actions. In practice this means classifying actions, requiring approval for irreversible or high-value steps, giving reviewers enough context, and providing a quick way to pause or stop an agent.
04How does the PDPA apply to AI agents?
Agents process personal data in their plans, tool calls, outputs and logs. Organisations must protect that data with reasonable security arrangements, limit retention, and handle access and correction requests. The PDPC's 2026 guidelines on generative AI specifically mention agent activity data and recommend regular review of safeguards for agentic systems. Using agents does not reduce the organisation's accountability for personal data.
05What should an AI agent vendor contract include?
Key terms include clear limits on the agent's authority, notice of material model or tool changes, security standards and incident notification, restrictions on using your data for training, data intermediary obligations under the PDPA, liability caps that reflect realistic agent-caused losses, and rights to logs and test results. Without log access, it can be very difficult to prove what happened in a later dispute.
Sources and official materials
- MDDI: Singapore launches new Model AI Governance Framework for Agentic AI — Launch, four dimensions and IMDA feedback process
- IMDA: Artificial intelligence — Model governance frameworks, testing resources and discussion papers
- Cyber Security Agency of Singapore — Guidelines on securing AI systems and agentic AI addendum
- Personal Data Protection Commission — Advisory guidelines on personal data in generative AI
- AI Verify Foundation — AI testing tools and resources
General information only, current as at 20 October 2026. It is not legal advice and does not create a lawyer–client relationship. Singapore law and regulatory practice change; check current official sources and take advice on the facts of your matter.
