Is Your Company Ready for Singapore's AI Governance Requirements?

Most Singapore companies are less ready than they think. The good news is that the requirements are clearer than they look. Singapore has no single AI Act. What binds you is existing law: the Personal Data Protection Act (PDPA), the Cybersecurity Act and any rules for your sector. On top of that sits a growing layer of guidance from the PDPC, IMDA, CSA and, for financial institutions, MAS. Most of that guidance is not legally binding, but it shows how regulators expect you to meet the law when AI is involved. Being "ready" in 2027 comes down to a dozen practical checks, starting with knowing which AI tools your staff already use.

Where your data actually goes when staff use AI tools is covered in where does company data go when using AI, so this post doesn't repeat it.

What is actually law, and what is only guidance?

Source: PDPC, IMDA, CSA, MDDI and MAS publications on the dates shown; the PDPA penalty date is from law-firm commentary (Allen & Gledhill). Summaries only, compiled 9 Nov 2026. Several of these documents describe themselves as living documents, so check the current version before you rely on it.

What does the PDPA require when your company uses AI?

The PDPA doesn't mention AI, and it doesn't need to. If an AI tool touches personal data, the normal obligations apply in full. Four matter most:

• Consent and notification. Reusing customer or staff data to train or feed an AI system may need consent or a notification unless an exception applies. The PDPC's March 2024 guidelines on AI recommendation and decision systems explain when the business-improvement and research exceptions cover this.
• Protection. You must make "reasonable security arrangements" against unauthorised access, use and disclosure. That includes prompt logs and the documents an AI assistant can search.
• Transfer limitation. Personal data sent overseas must get protection "comparable to the protection under this Act". The PDPC says the customer organisation, not the cloud provider, is responsible for this.
• Breach notification. A breach is notifiable if it is likely to cause significant harm or affects 500 or more people. You must notify the PDPC no later than 3 calendar days after you've assessed it.

The maximum financial penalty is 10% of Singapore turnover for organisations whose turnover exceeds S$10 million, or S$1 million otherwise.

What do the PDPC's new generative AI guidelines add?

The guidelines issued on 20 July 2026 split responsibility between model providers, system providers and system deployers. A company that rolls out an AI chatbot or assistant to its staff or customers is a deployer, and paragraph 9.1 says deployers "bear primary responsibility" for making sure the system can meet PDPA obligations. That holds whether the system is built in-house or bought as a service.

In practice the PDPC expects deployers to track new data sources (prompts, outputs, agent and tool activity), tell users which personal data may go into prompts, consider scanning prompts for common identifiers, limit who can read prompt logs, and review safeguards regularly. It singles out systems with agentic features for that review. The guidelines say they are "not legally binding", and they do not address overseas transfers to external AI services. The transfer analysis under the PDPA still applies on its own.

What do regulators expect once AI agents can take actions?

The IMDA framework for agentic AI, launched in January 2026, rests on a simple line: "humans are ultimately accountable". It asks companies to assess and limit an agent's autonomy, tools and data access before deployment, and to put human approval checkpoints in front of consequential actions. CSA's June 2026 addendum turns this into controls: no admin rights by default, sandboxing for AI-generated code, outbound allow-lists, guardrails against direct and indirect prompt injection, and logging of agent actions to your SIEM.

If you are planning agents that send emails or update systems, read what happens when an AI agent controls Excel and Outlook. Our companion post on AI agents vs traditional automation covers when an agent is the right tool at all.

Singapore regulates AI mostly through laws you already follow. The guidance tells you how regulators expect those laws to be met when AI is involved, and that is what an investigation or audit will measure you against.

Do sector rules apply to your company?

Three sectors now have their own AI documents. Financial institutions face the MAS Guidelines on AI Risk Management, final on 7 October 2026 and effective from 7 October 2027. MAS states that institutions "remain accountable for AI used in the services they deliver". Healthcare has the MOH and HSA AI in Healthcare Guidelines 2.0 (13 March 2026), covered in our post on private AI infrastructure for hospitals. Law and accounting firms have the MinLaw guide for the legal sector (6 March 2026) and ACRA's audit practice guidance on AI (2 October 2026), covered in private document AI for law firms.

How ready is your company? A 12-point checklist

Each item below is tied to a source. Together they are a practical synthesis, not a legal standard.

1. An AI inventory, including free and "shadow" tools. CSA Cyber Essentials (March 2025) asks for this, and so do MAS and MOH for their sectors.
2. A named accountable owner for each AI system (IMDA agentic framework; PDPC GenAI guidelines 9.1).
3. A risk tier for each use case, so a meeting summariser isn't governed like an agent that approves refunds.
4. Written rules on what data may go into prompts (PDPC GenAI guidelines 9.3).
5. A consent and notification check before reusing personal data for AI (PDPC 2024 and 2026 guidelines).
6. A transfer check for every overseas AI service (PDPA transfer limitation).
7. Human checkpoints before consequential actions (IMDA agentic framework; CSA addendum 4.4).
8. Logging of AI and agent activity (CSA addendum 4.3; Cyber Essentials).
9. Security controls following CSA's Securing AI guidelines, including prompt injection (PDPC GenAI guidelines 8.2).
10. Vendor clauses on retention, deletion, safeguards and breach timelines (PDPC GenAI guidelines 8.3).
11. A breach playbook that covers AI incidents, with the 3-day and 500-person PDPA thresholds built in.
12. Testing before go-live, for example with AI Verify or Project Moonshot.

Most AI projects stall on governance after the pilot, not on the technology. We look at why in why AI projects fail after the demo.

Where does AI Verify fit?

AI Verify is a voluntary, open-source testing framework from IMDA and the AI Verify Foundation. It assesses systems against 11 internationally recognised AI governance principles. Project Moonshot does the same job for applications built on large language models, with benchmarking and red-teaming. Both produce self-assessed reports. They don't certify a system or guarantee compliance, so treat a report as evidence for your own governance file, not a stamp of approval.

Running AI on your own hardware removes the overseas-transfer question and shortens the vendor chain, but it adds patching, access control and logging work for your own team. The trade-offs are in sovereign AI for Singapore businesses.

This article is general information, not legal, medical or compliance advice. Check the current version of each instrument and speak to your legal counsel or data protection officer about your situation.

Security teams weighing AI for their own operations face the same governance questions in a sharper form; we look at that in whether local AI can help detect threats faster.

Buying in Singapore

Governance is mostly process, but a few tools make the checklist easier to run. For Microsoft 365 organisations, Microsoft Purview Suite (S$185 for a 12-month licence) covers data classification and data loss prevention, and Microsoft Entra Suite (S$185 for a 12-month licence) covers identity and access. If you want sensitive data to stay on your premises, a local AI system such as the ASUS Ascent GX10 64GB (S$6,670) or the NVIDIA DGX Spark 4TB (S$9,300) runs models without an external API (listed 9 Nov 2026; prices change; ask for a current quotation). The Dell Pro Max with GB10 is price on request. SourceIT can quote the configuration, validate it against your use case and handle delivery. To start, use Request for Quotation on the product page, call (65) 6978 3502, email Sales@sourceit.com.sg or use our contact page.

Frequently asked questions

Does Singapore have an AI law? Not a single AI Act. AI is governed through existing laws, mainly the PDPA, the Cybersecurity Act and sector rules, plus non-binding guidance from the PDPC, IMDA, CSA and, for financial institutions, MAS.

Are the PDPC's generative AI guidelines mandatory? No. The 20 July 2026 guidelines say they are "not legally binding". They explain how the PDPC expects organisations to meet the PDPA, which is binding, when they use generative AI.

Who is responsible if a bought-in AI tool mishandles personal data? Under the PDPC's generative AI guidelines, the deploying organisation bears primary responsibility for making sure the system can meet PDPA obligations, whether it built the system or bought it as a service.

Do the MAS AI guidelines apply to my company? Only if you are a financial institution regulated by MAS. The guidelines were finalised on 7 October 2026 and take effect from 7 October 2027.

Does an AI Verify report mean my AI system is compliant? No. AI Verify and Project Moonshot produce self-assessed test reports. They are useful evidence for your governance records, but they don't certify a system or confirm legal compliance.