AI governance · Singapore
AI Governance in Singapore: Model AI Governance Framework, AI Verify and MAS Guidelines
Short answer
Singapore governs AI mostly through voluntary frameworks, not an AI law. The Model AI Governance Framework (including the 2026 framework for agentic AI) and AI Verify are voluntary; the PDPA 2012 already applies whenever AI uses personal data; and MAS-regulated financial institutions are expected to meet the MAS AI Risk Management Guidelines, which take effect on 7 October 2027.
Updated 5 November 2026. Official sources checked November 2026.
Singapore AI rules
Status as at November 2026
Four instruments cover almost every Singapore organisation using AI. Of these, only the PDPA is legislation; the MAS guidelines set supervisory expectations for MAS-regulated financial institutions.
| Instrument | Issued by | Status | Applies to | Source |
|---|---|---|---|---|
| Model AI Governance Framework (2020) and Model AI Governance Framework for Agentic AI (January 2026) | Issued byIMDA and PDPC | StatusVoluntary, in effect | Applies toAny organisation that uses or builds AI; the agentic framework covers organisations deploying AI agents, built in-house or bought | SourceMDDI: Singapore launches new Model AI Governance Framework for Agentic AI (22 January 2026) |
| AI Verify | Issued byIMDA and PDPC; open-sourced through the AI Verify Foundation | StatusVoluntary testing framework and toolkit | Applies toOrganisations that want to test and document an AI system against AI governance principles | SourceAI Verify Foundation: What is AI Verify |
| MAS Guidelines on AI Risk Management | Issued byMonetary Authority of Singapore (MAS) | StatusFinal (issued 7 October 2026); take effect 7 October 2027, some sections may be phased in by 7 October 2028 | Applies toAll financial institutions supervised by MAS, for all forms of AI, including generative AI and AI agents | SourceMAS media release: supervisory expectations on responsible AI adoption by financial institutions |
| Personal Data Protection Act 2012 (PDPA) | Issued byPersonal Data Protection Commission (PDPC) | StatusIn force | Applies toOrganisations collecting, using or disclosing personal data in Singapore, including through AI | SourcePDPC: Overview of the Personal Data Protection Act 2012 |
Checked against the official pages listed under each row in November 2026. Guidance changes: read the current text before relying on it.
What Singapore expects in practice
Across the IMDA frameworks, the MAS guidelines and the PDPA, the same five expectations recur. None of them needs new software to start; they need owners and records.
01
Know what AI you run
A register of every AI tool and system, including the ones staff found on their own.
AGK-TPL-01, AGK-PRC-07
02
Classify the risk
Label data from Public to Secrets and decide which AI tool tier may see each label.
AGK-STD-A02
03
Name a human owner
An AI sponsor, an AI Governance Lead and an owner for every AI system.
AGK-001
04
Control third parties
Approved tools only, configured to a baseline; connectors and agents approved before use.
AGK-POL-02
05
Report incidents
A log, a clear route to report, and a plan for any notice the PDPA requires when personal data is involved.
AGK-TPL-06
IMDA · PDPC
The Model AI Governance Framework, explained
The Model AI Governance Framework is Singapore's guidance, from IMDA and PDPC, on how organisations should govern the AI they use and build. It was first introduced in 2020. It is voluntary and in effect, but not legally binding.
In January 2026 IMDA added the Model AI Governance Framework for Agentic AI, which builds on the 2020 framework and is aimed at organisations deploying AI agents that plan and act on someone's behalf. MDDI describes it in four dimensions:
01
Assess and bound risks upfront
Choose suitable use cases and limit an agent's autonomy and its access to tools and data.
02
Make humans meaningfully accountable
Name who is responsible, inside the organisation and with vendors, and set checkpoints that need human approval.
03
Apply technical controls and processes
Test agents before deployment, restrict them to approved services and monitor them across the lifecycle.
04
Enable end-user responsibility
Tell users what an agent can do and what data it can reach, and train them to use it.
In the AI Governance Kit, the agentic framework maps to agent autonomy levels (A0 to A4), named human owners and the connector and browser-agent standards.
Official source, checked November 2026: MDDI: Singapore launches new Model AI Governance Framework for Agentic AI (22 January 2026) · PDPC: Model AI Governance Framework (second edition, 2020)
AI Verify Foundation
AI Verify, explained: when it is useful
AI Verify is a voluntary AI governance testing framework and software toolkit. IMDA and PDPC launched it in 2022 and later open-sourced it through the AI Verify Foundation. An organisation uses it to assess an AI system against 11 internationally recognised AI governance principles and to produce a summary report of what it checked.
It is a self-assessment, not a licence or a certificate. It is most useful when someone outside the organisation asks how an AI system was tested:
- A customer or partner asks for evidence before buying or integrating your AI product.
- You build AI in-house and want a documented, repeatable test record for each release.
- A regulator, auditor or board asks how a model was checked for fairness, transparency or robustness.
If you only use vendor AI tools such as ChatGPT, Claude or Copilot, start with an approved tool list, an acceptable use policy and an AI system register. AI Verify adds most value once you build or customise AI yourself.
Official source, checked November 2026: AI Verify Foundation: What is AI Verify
Monetary Authority of Singapore
MAS AI Risk Management Guidelines: who they apply to and what they expect
MAS issued its Guidelines on Artificial Intelligence Risk Management on 7 October 2026. They apply to all MAS-regulated financial institutions and all forms of AI, scaled to the size and nature of each institution's AI use. They take effect on 7 October 2027, and institutions may phase in some sections up to 7 October 2028.
Board and senior management oversight
Clear roles, an AI risk appetite and policies. Existing governance structures can be used; a dedicated AI committee is not required.
AI inventory
Identify where AI is used and keep an inventory at an appropriate level of detail.
Risk materiality
Assess the risk materiality of each AI use case so that controls match the risk.
Lifecycle controls
Proportionate controls across the AI lifecycle: data governance, testing, human oversight, cybersecurity, monitoring and change management.
Third-party AI
The institution stays accountable for third-party AI. Get assurance, check suitability, and limit or replace services outside the risk appetite.
If you are not MAS-regulated, the guidelines do not apply to you directly, but they are a clear benchmark for a mature AI inventory and risk process, and banks may ask their vendors for the same evidence. More on the MAS guidelines in our AI governance FAQ.
Official source, checked November 2026: MAS media release: supervisory expectations on responsible AI adoption by financial institutions · MAS: Guidelines on Artificial Intelligence Risk Management (issued 7 October 2026)
The first 90 days
A 90-day starting plan for Singapore organisations
This is the Lite path from the AI Governance Kit (AGK-001), with the Singapore instrument each step serves. Each step ends with something approved, configured or populated.
Week 1
Name the owners
AI sponsor, AI Governance Lead and a three-person committee. Agree the risk appetite in one paragraph.
MGF: human accountability · MAS: board oversight
Weeks 1–2
Find the AI already in use
Staff survey, expense data, network and SaaS discovery, with a 30-day amnesty for self-declared tools.
MAS: AI inventory
Week 2
Set the rules
Approve the acceptable use policy and data rules. Every user acknowledges before access.
PDPA: personal data in prompts
Weeks 2–3
Configure the platform
Apply the baseline settings. Block personal AI accounts on company devices.
MGF agentic: bound risks upfront
Weeks 3–4
Communicate and train
Key messages, staff FAQ, champions, a safe channel for concerns, fundamentals training.
MGF agentic: end-user responsibility
Weeks 4–6
Pick and risk-rate the first use cases
Score ideas on value, feasibility and risk; pilot two or three quick wins.
MAS: risk materiality
Weeks 4–6
Be ready for problems
Intake form, incident log and who to call when something goes wrong.
PDPA · MAS: lifecycle controls
Weeks 6–12
Pilot, measure, decide
Track benefits. Test AI you build before release; consider AI Verify for customer-facing systems.
AI Verify · MAS: testing
Day 90
Review
The committee reviews what is in use, incidents, benefits and next quarter.
All four
The full plan, adoption tiers and the frameworks behind it are in our AI governance guide for Malaysia and Singapore.
Free AI Governance Lite pack
The documents an organisation starting out needs to govern AI tools in its first 90 days. Word and Excel, ready to edit.
- Lite Quick Start and Control Checklist AGK-001 · Word
- AI Governance Framework and Document Architecture AGK-000 · Word
- AI Acceptable Use Policy AGK-POL-02 · Word
- AI Data Handling Standard AGK-STD-A02 · Word
- AI Discovery and Shadow AI Procedure AGK-PRC-07 · Word
- AI Adoption Roadmap and Use-Case Prioritisation Guide AGK-GDL-C02 · Word
- AI System Register AGK-TPL-01 · ExcelPreview AI System Register
- AI Use Case Intake Form AGK-TPL-03 · Word
- AI Incident, Nonconformity and CAPA Log AGK-TPL-06 · ExcelPreview AI Incident, Nonconformity and CAPA Log
- AI Acceptable Use Acknowledgement AGK-TPL-07 · Word
- Pengakuan Penggunaan AI (Bahasa Melayu) AGK-TPL-07-BM · Word
- AI Use-Case Prioritisation and Benefits Tracker AGK-TPL-12 · ExcelPreview AI Use-Case Prioritisation and Benefits Tracker
Template release v1.0 · ZIP · 990 KB
Get the free Lite governance pack
Templates for governance purposes, not legal advice.
AI Governance Hub
AI Governance Hub: the AI risk management platform for your risk team
Templates go stale. The Hub keeps every AI system registered, risk-assessed, owned and evidenced, and answers staff questions from your own policy. Launching soon: join the waitlist and we will contact you before it opens.
| Feature | Free | Member |
|---|---|---|
| Templates | 12 Lite documents | All 48 documents, with version history |
| Pre-read and tier check | ||
| 90-day planner with owners and evidence | ||
| Policy assistant: a pack tailored to your company | ||
| AI system and risk register, with a ready AI risk library | ||
| Control owner register with quarterly attestation and evidence | ||
| Connector, agent and AI vendor registries | ||
| Incidents, exceptions and review calendar | ||
| KRI dashboard and one-click board report | ||
| MCP connection: staff ask Claude, ChatGPT or Copilot and get answers from your own policy | ||
| Regulation and vendor-setting update alerts |
Member features are planned for launch and may change.
Enterprise · deploy in your environment · coming later
Run the same AI risk platform in your own cloud account (AWS, Azure or Google Cloud, with your own AI model account), or fully offline on your own servers with a private AI model. For organisations that cannot use shared cloud software. Pricing on request.
Want it set up with you? We run a governance setup sprint: owners, policy, register and an approved AI tool. Book an online meeting
RM 2,400
per organisation per year
AI governance in Singapore: frequently asked questions
What is AI governance in Singapore?
AI governance is the set of rules, roles and records that decide which AI an organisation may use, for what, with which data, and who is accountable. In Singapore it is shaped by IMDA's voluntary Model AI Governance Framework, the AI Verify testing toolkit, the PDPA 2012 and, for financial institutions, the MAS AI Risk Management Guidelines.
What is the Model AI Governance Framework?
It is voluntary guidance from IMDA and PDPC, first introduced in 2020, on how organisations should govern the AI they use and build. In January 2026 IMDA added a framework for agentic AI: bound agent risks upfront, keep humans accountable, apply technical controls, and help end users act responsibly. It is in effect but not legally binding.
What is AI Verify, and is it mandatory?
AI Verify is a voluntary testing framework and toolkit, launched by IMDA and PDPC and open-sourced through the AI Verify Foundation. It helps an organisation assess an AI system against 11 AI governance principles and produce a report. No law requires it; it is most useful when customers or regulators ask how an AI system was tested.
Is there an AI governance certification in Singapore?
There is no mandatory AI governance certification in Singapore. AI Verify is a voluntary self-assessment that produces a report, not a certificate. Organisations that want a certificate usually look at ISO/IEC 42001, the AI management system standard, which accredited certification bodies audit. Anchor Sprint does not issue certifications.
Who do the MAS AI Risk Management Guidelines apply to?
They apply to all financial institutions supervised by MAS and to all forms of AI they use, including generative AI and AI agents. MAS issued them on 7 October 2026 and they take effect on 7 October 2027. They expect board oversight, an AI inventory, a risk materiality assessment for each use case and proportionate lifecycle controls.
Does Singapore have an AI law?
Singapore has no single AI law as at November 2026. AI is governed through voluntary frameworks from IMDA and PDPC, sector guidance such as the MAS AI Risk Management Guidelines for financial institutions, and existing law. The PDPA 2012 applies whenever an AI system collects, uses or discloses personal data.
How do we start an AI governance framework in Singapore?
Start with five things: name an AI owner, list the AI already in use, approve one AI tool and an acceptable use policy, risk-rate each use case, and set up an incident log. That covers the core of the Model AI Governance Framework and the PDPA, and is the base the MAS guidelines build on. Our free Lite pack has the templates.
