Some will, but not because a regulator says so. No Singapore rule requires a hospital to run AI on its own hardware. The pressure comes from three places. Public healthcare networks were separated from the internet after the 2018 SingHealth cyberattack. The Health Information Bill, passed in January 2026, adds security and incident-reporting duties for anyone connected to the national health record. And MOH's updated AI guidelines expect hospitals to know, control and be able to switch off every AI tool they use. A private system gives that control most directly. A secured cloud service can also meet it, and SingHealth's own clinical note tool takes that route. The right answer depends on the data, the workload and how much the organisation wants to run itself.
The general case for keeping AI in-house is in sovereign AI for Singapore businesses. This post covers what is specific to healthcare.
What changed in Singapore healthcare IT after 2018?
MOH reported in August 2018 that the personal particulars of about 1.5 million SingHealth patients had been "accessed and copied". Outpatient dispensed-medicine records of 160,000 of them were also accessed. In response, Internet Surfing Separation was introduced at SingHealth from 20 July 2018, and at NHG and NUHS from 23 July. Internet-dependent connections such as lab reports, referrals and video consultations had to be reworked, and separate shared workstations were provided where internet access was still needed. The PDPC later fined IHiS S$750,000 and SingHealth S$250,000, then the highest penalties it had imposed. It stated that organisations "must ultimately take responsibility" even when work is delegated to vendors.
For AI, the lesson is structural. A clinical network built to keep the internet out can't simply call an internet AI service. Either the AI runs inside, or the service is reached through a controlled, approved path.
What do MOH's AI guidelines expect from a hospital?
The AI in Healthcare Guidelines 2.0 (AIHGle 2.0), issued by MOH with HSA on 13 March 2026 to all licensees under the Healthcare Services Act, now cover generative AI. They describe themselves as recommendations and good practice that complement the law. Several of them shape the infrastructure.
| AIHGle 2.0 expectation | Reference | What it means for the infrastructure |
|---|---|---|
| A platform to approve AI, with a risk-classified registry | 6.1.1 | Every model and tool, cloud or local, is listed and owned |
| Governance, implementation and audit as separate functions | 6.1.3 | Role-based access and audit logs that the IT team can't edit |
| Local validation, and pilots for higher-risk tools | 6.3 | A test environment with local data before rollout |
| Human oversight "mandatory" for clinical AI; none autonomous | 4.1.1c, 6.2 | Workflows where a clinician approves every output |
| Permitted input data defined by classification; anonymise where possible | 7.1 | Data controls at the point of entry, not only at storage |
| Ability to suspend an AI tool | 4.2e | A tested way to switch it off without stopping care |
| Report breaches to PDPC, device events to HSA and critical cyber incidents to CSA | 6.7.1b | Logging good enough to support three reporting paths |
| Generative AI may present "fictitious content as facts" | 8.2.1a, 8.2.2 | Retrieval with citations, red-teaming and fact-checking steps |
Source: MOH and HSA, Artificial Intelligence in Healthcare Guidelines 2.0, circular dated 13 Mar 2026. Summaries compiled 9 Nov 2026; the guidelines call themselves a living document, so check the current version.
The guidelines don't say where AI must be hosted. They say how it must be governed, and governance is easier to prove when the hospital controls the whole stack.
When does a healthcare AI tool become a medical device?
HSA defines an AI medical device as "an artificial intelligence application intended to be used for medical purposes". Its software device guidelines (Rev 2.0, effective 29 April 2022) require a quality management system, documented training datasets, a separate test set, controls for continuous learning and notification of model changes. A December 2025 revision is reported to bring machine-learning software explicitly into scope and to add a change-management programme for pre-approved updates.
Not every hospital AI tool is a device. Under AIHGle 2.0, an ambient scribe that turns a consultation into notes and gives no diagnosis or treatment recommendation may fall outside device regulation, provided "doctors retain full control and make final decision on the case notes saved". Storing or transferring data and office automation are also outside device rules. Whether a specific tool is regulated is a question for the vendor and HSA, not for the hardware supplier.
Cloud or private: what have Singapore's public hospitals chosen?
Both, which is a useful sign that either can work. SingHealth's Note Buddy, announced in September 2024, transcribes and summarises consultations in English, Mandarin, Malay and Tamil, with clinicians reviewing the notes. It runs on Synapxe Tandem, a secure platform that integrates Microsoft's Azure OpenAI Service. NUHS took the other path. Its RUSSELL-GPT model, trained on NUHS data to summarise case notes and draft referral letters, runs on the Prescience supercomputer, which NUHS describes as "fully internal and not hosted on the internet".
Singapore's healthcare rules don't require on-premises AI. They require control: knowing what data goes where, who checks each output and how to switch the tool off. Private infrastructure is one way to prove that control, not the only one.
How much storage does medical imaging AI need?
Imaging is where private infrastructure costs grow fastest. Using per-image sizes published in 2007 (the matrix maths hasn't changed), an uncompressed CT slice at 512 × 512 pixels and 2 bytes per pixel is 0.5 MiB. A 1,000-slice thin-section CT study is therefore about 0.5 GB, and a study with 10,000 images including reconstructions is about 5 GB. A four-view digital mammogram is about 106 MB (CALC, based on those 2007 figures; modern compressed sizes vary). The Health Information Bill will also require licensed providers to contribute radiological images to the national health record, which adds to the volume a provider handles.
Datasets of this size favour fast local NVMe storage for training and validation, plus a separate archive. GPU memory depends on the model. For a guide to when 96 GB of VRAM actually matters, see who actually needs 96GB of VRAM.
What does a clinic need compared with a hospital cluster?
A clinic group piloting an ambient scribe or a document assistant can start with a single compact AI system. That is enough to test transcription and summarisation on local data. We show the transcription workload in transcribing 100 hours of meetings on GB10. A hospital or cluster validating imaging models, or serving many clinicians at once, needs GPU servers or a DGX Station, fast storage, backup and a UPS. That system should be isolated the way the rest of the clinical network is; the controls are in our DGX Station security hardening checklist. Sizing depends on the models, the number of concurrent users and the imaging volumes, so we work from those rather than a standard bundle.
This article is general information, not legal, medical or compliance advice. Healthcare providers should confirm their obligations with their clinical governance, data protection and legal teams, and check the current MOH and HSA documents.
Hospitals that host AI servers on site also inherit their power and heat; our guide to liquid vs air cooling for AI servers covers when a server room needs more than air.
Buying in Singapore
For pilots, the NVIDIA DGX Spark 4TB (S$9,300) runs local models. For imaging and model validation, there's the NVIDIA RTX PRO 6000 Blackwell Workstation Edition (S$29,100) and the data-centre RTX PRO 6000 Blackwell Server Edition (S$32,999). For storage, the Micron 7600 PRO 15.36TB NVMe drive (S$14,932) and the all-flash Synology FS2500 (S$5,221.20) are options. For backup, the Synology ActiveProtect DP340 (S$6,526.80) and the APC Smart-UPS Ultra 3kVA (S$7,258.75) cover recovery and power (listed 9 Nov 2026; prices change; ask for a current quotation). DGX Station GB300 systems such as the Dell Pro Max with GB300 and the MSI XpertStation WS300 are price on request, as are GPU servers such as the Lenovo ThinkSystem SR675 V3. Ask us about diagnostic displays and PACS software, which we don't list. To start, use Request for Quotation on the product page, call (65) 6978 3502, email Sales@sourceit.com.sg or use our contact page.
Frequently asked questions
Do Singapore regulations require hospitals to run AI on-premises? No. MOH's AIHGle 2.0 and the related laws set governance, oversight and security expectations but don't mandate where AI is hosted. SingHealth's Note Buddy runs on a secured cloud platform, while NUHS runs its own internal model.
What are AIHGle 2.0? The Artificial Intelligence in Healthcare Guidelines 2.0, issued by MOH with HSA on 13 March 2026. They cover generative AI and set expectations such as an AI registry, local validation and mandatory human oversight for clinical AI.
Is an AI clinical scribe a medical device in Singapore? Not necessarily. Under AIHGle 2.0, a scribe that only summarises consultations and gives no diagnosis or treatment recommendation may fall outside device regulation, with doctors keeping control of the final notes. Check the specific tool with its vendor and HSA.
How big is a CT study for AI work? Using 2007 per-image figures, an uncompressed 512 × 512 CT slice is about 0.5 MiB, so a 1,000-slice study is about 0.5 GB and a 10,000-image study about 5 GB. Modern scanners and compression change these numbers.
What does the Health Information Bill change? Passed on 12 January 2026, it requires licensed providers to contribute key data, including radiological images, to the national health record, and to meet security requirements and report confirmed incidents. MOH intends it to take effect in early 2027.
SourceIT Approved
Researched and verified by the SourceIT team for Singapore buyers.
