Singapore has no general AI law. AI governance for Singapore organisations rests on the Personal Data Protection Act (PDPA), which applies whenever AI uses personal data, plus a set of voluntary but influential frameworks: the PDPC’s advisory guidelines on AI, IMDA’s Model AI Governance Frameworks for traditional, generative and agentic AI, and the AI Verify testing toolkit. Financial institutions also have MAS’s Guidelines on Artificial Intelligence Risk Management, issued on 7 October 2026 and taking effect from 7 October 2027. Every one of these instruments assumes your people know how to use AI responsibly, so training is part of the answer, not an extra.
This guide is for compliance, risk, data protection, technology and L&D leaders in Singapore. It explains what each instrument expects and gives a practical checklist for governing and training around AI.
How Singapore governs AI
Singapore’s approach combines binding data protection law, practical voluntary frameworks and sector-specific supervision:
| Instrument | Issued by | Binding? | What it asks of you |
|---|---|---|---|
| Personal Data Protection Act 2012 | Parliament; enforced by the PDPC | Yes | Consent, notification, purpose limitation, protection of personal data, breach notification, accountability |
| Advisory Guidelines on Use of Personal Data in AI Recommendation and Decision Systems (1 March 2024) | PDPC | No, but the PDPC is likely to take consistent positions in enforcement | How the PDPA applies when you develop and deploy AI that makes or supports decisions |
| Model AI Governance Framework (2019, second edition 2020) | PDPC and IMDA | No | Internal governance, human involvement, operations management, stakeholder communication |
| Model AI Governance Framework for Generative AI (30 May 2024) | IMDA and the AI Verify Foundation | No | Nine dimensions for a trusted generative AI ecosystem |
| Model AI Governance Framework for Agentic AI (22 January 2026) | IMDA | No | Bounding the risks of AI agents and keeping humans accountable |
| AI Verify | IMDA and the AI Verify Foundation | No | Testing and process checks against 11 governance principles |
| Guidelines on Artificial Intelligence Risk Management (7 October 2026) | MAS | Supervisory expectations for financial institutions | AI oversight, inventories, risk materiality, life cycle controls, third-party AI |
The PDPA: the baseline for any AI that uses personal data
The PDPA does not mention AI, but its obligations apply to any AI system that collects, uses or discloses personal data. Three are especially relevant:
- Consent and notification: individuals must be told the purposes for which their data is used, including AI-driven purposes, unless an exception applies.
- Protection: organisations must make reasonable security arrangements to protect personal data. Employees pasting customer data into an unapproved AI tool is exactly the kind of risk this covers.
- Breach notification: where a breach is likely to cause significant harm or is of significant scale, the organisation must notify the PDPC within three calendar days of assessing that it is notifiable.
Since 1 October 2022, the PDPC can impose a financial penalty of up to 10% of an organisation’s annual turnover in Singapore where that turnover exceeds S$10 million, or S$1 million, whichever is higher.
The PDPC’s advisory guidelines on AI
The PDPC’s Advisory Guidelines on Use of Personal Data in AI Recommendation and Decision Systems, published on 1 March 2024, explain how the PDPA applies when you build and deploy machine-learning systems that make recommendations, predictions or decisions. Key points:
- Organisations can rely on meaningful consent, or on PDPA exceptions such as the business improvement and research exceptions when developing AI, subject to the criteria in the guidelines.
- Give people enough information at the point of collection for consent to be meaningful.
- Document safeguards in written policies, especially where outcomes have a high impact on people.
- Use tools such as data protection impact assessments and AI Verify to support trustworthy deployment.
The guidelines do not cover generative AI. In mid-2026 the PDPC consulted on proposed Advisory Guidelines on Use of Personal Data in Generative AI, which build on the 2024 guidelines. Check the PDPC website for the final version before relying on the proposals.
The Model AI Governance Frameworks
The original framework (first edition 2019, second edition January 2020) organises AI governance into four areas: internal governance structures and measures; determining the level of human involvement in AI-augmented decision-making; operations management; and stakeholder interaction and communication. It remains the clearest structure for an organisation-wide AI policy.
The generative AI framework (30 May 2024) sets out nine dimensions to be considered together: accountability, data, trusted development and deployment, incident reporting, testing and assurance, security, content provenance, safety and alignment research and development, and AI for public good.
The agentic AI framework (22 January 2026) responds to AI agents that can plan and act with tools and system access. It asks organisations to bound risks upfront by choosing suitable use cases and limiting access, keep humans meaningfully accountable with checkpoints for approval, apply technical controls across the agent life cycle, and enable end users to act responsibly through transparency and training. If your teams are building or connecting agents, AccuroAI’s AI agent security platform is designed for exactly this layer: agent permissions, visibility and policy enforcement. Our Securing AI Agents course trains engineering and security teams on the same controls.
AI Verify: testing what you claim
AI Verify was first released by IMDA in May 2022 and handed to the open-source AI Verify Foundation, launched on 7 June 2023. The testing framework covers 11 governance principles, including transparency, explainability, safety, security, robustness, fairness, data governance, accountability and human agency and oversight. It combines technical tests (for fairness, explainability and robustness) with process checks across all 11 principles, and runs inside your own environment so data and models stay in-house.
For generative AI, IMDA and the AI Verify Foundation ran a Global AI Assurance Pilot from February 2025, pairing specialist testers with organisations deploying real generative AI applications, and followed it with a Global AI Assurance Sandbox in July 2025. One of the pilot’s lessons was that human experts were essential at every stage of testing, which is another argument for building skills in-house.
Security teams should also know the Cyber Security Agency’s Guidelines and Companion Guide on Securing AI Systems (October 2024), which cover the AI life cycle from planning and design to end of life.
Financial services: MAS’s AI risk management guidelines
On 7 October 2026, MAS issued its Guidelines on Artificial Intelligence Risk Management after a November 2025 consultation. They apply to all financial institutions and all forms of AI, scaled to each institution’s AI use and risk materiality. MAS expects:
- boards and senior management to provide effective oversight of AI risk, using existing governance structures where suitable
- AI inventories at an appropriate level of granularity
- risk materiality assessments for AI use cases, with proportionate controls such as data governance, testing, human oversight, cybersecurity and monitoring
- accountability for AI supplied by third parties, with sufficient assurance from providers
- the capabilities needed for responsible AI use as adoption grows
The guidelines take effect on 7 October 2027, with until 7 October 2028 for the sections on life cycle controls and on capability and capacity. MAS has also said it intends to consult the sector in 2027 on further guidance for agentic AI. AccuroAI’s financial services AI security playbook is a useful companion for banks and insurers planning their controls.
A Singapore AI governance and training checklist
- Map your AI use. Build an inventory of AI tools, AI features in existing software and AI agents, including unapproved use. Note which involve personal data and which affect decisions about people.
- Classify by impact. Use the human involvement approach from the Model Framework: decide where a human must be in the loop, over the loop or can be out of the loop, based on the severity and likelihood of harm.
- Check your PDPA basis. For each AI use of personal data, confirm consent and notification, or the exception you rely on, and document it as the PDPC guidelines suggest.
- Protect data at the point of use. Set clear rules on what data may go into AI tools and enforce them. Prompt-level controls such as AccuroAI’s prompt DLP detect and block sensitive data before it reaches a model.
- Govern agents separately. Apply the agentic framework: limit permissions, define approval checkpoints, log agent actions.
- Test and record. Use AI Verify or equivalent testing for higher-impact systems, and keep evidence of what you tested and why.
- Train by role. All staff on safe use and data red lines; managers and decision-makers on human oversight; DPOs and compliance on the PDPA and frameworks; engineers on secure AI and agents; boards on oversight and risk appetite.
- Review regularly. Track the final PDPC generative AI guidelines, MAS’s agentic AI consultation and any framework updates.
Our AI Governance & Compliance training takes compliance, legal and risk teams through this checklist using Singapore’s frameworks, and the Safe AI at Work programme covers the workforce.
Frequently asked questions
Does Singapore have an AI law?
Not a general one. Singapore relies on the PDPA and other existing laws, voluntary frameworks from the PDPC and IMDA, and sector supervision such as MAS’s guidelines for financial institutions.
Are the Model AI Governance Frameworks mandatory?
No. They are voluntary. But they reflect what regulators, auditors, clients and partners in Singapore increasingly expect, and the PDPC’s advisory guidelines point to tools such as AI Verify as ways to show trustworthy AI use.
Does the PDPA allow us to use customer data to train AI?
It can. The PDPC’s 2024 advisory guidelines explain that organisations may rely on consent or on exceptions such as business improvement or research, if the criteria are met. Generative AI is covered by separate proposed guidelines that the PDPC consulted on in 2026.
When do MAS’s AI risk management guidelines apply?
They were issued on 7 October 2026 and take effect on 7 October 2027. Financial institutions have until 7 October 2028 to meet the expectations on life cycle controls and on capability and capacity.
What AI training should Singapore employees receive?
Everyone needs to know the approved tools, what data must never go into a prompt, how to check AI output, and how to report a mistake. People who use AI in decisions about customers or employees, build AI systems or oversee AI risk need deeper, role-specific training.
Get your teams ready
Product Innovation Academy runs AI governance, AI security and AI literacy training for organisations in Singapore, with AI Security & Governance programmes delivered in partnership with AccuroAI. Request a proposal and we will tailor a programme to your sector, tools and regulatory obligations.
Sources
- PDPC, “Advisory Guidelines on the Use of Personal Data in AI Recommendation and Decision Systems”, 1 March 2024. pdpc.gov.sg
- Bird & Bird, “PDPC Advisory Guidelines on the Use of Personal Data in AI Recommendation and Decision Systems”, 2024. twobirds.com
- PDPC, “Public Consultation on the Proposed Advisory Guidelines on Use of Personal Data in Generative AI”, 2026. pdpc.gov.sg
- Allen & Gledhill, “Increased maximum financial penalties under Personal Data Protection Act 2012 from 1 October 2022”. allenandgledhill.com
- PDPC, “Second Edition of Model AI Governance Framework Now Available”, January 2020. pdpc.gov.sg
- Baker McKenzie, “Singapore: New Model AI Governance Framework for Generative AI launched by IMDA and AI Verify Foundation”, 2024. insightplus.bakermckenzie.com
- Ministry of Digital Development and Information, “Singapore Launches New Model AI Governance Framework for Agentic AI”, 22 January 2026. mddi.gov.sg
- IMDA, “Singapore launches AI Verify Foundation”, 7 June 2023. imda.gov.sg
- Singapore Economic Development Board, “Initiative by IMDA, AI Verify Foundation tests AI accuracy, trustworthiness in real-world scenarios”, 2025. edb.gov.sg
- Cyber Security Agency of Singapore, “Guidelines and Companion Guide on Securing AI Systems”, October 2024. csa.gov.sg
- Monetary Authority of Singapore, “MAS Sets Out Supervisory Expectations on Responsible AI Adoption by Financial Institutions”, 7 October 2026. mas.gov.sg
- Monetary Authority of Singapore, “Guidelines on Artificial Intelligence Risk Management for Financial Institutions”. mas.gov.sg