Singapore's AI Governance Framework: What Businesses Need to Know in 2026

Singapore governs AI through three layers: IMDA's voluntary Model AI Governance Framework and its generative and agentic AI editions; sector guidance from regulators such as MAS and MOH; and the Personal Data Protection Act (PDPA), which is binding whenever an AI system uses personal data. For most businesses, the practical starting point is an AI inventory.

How Singapore regulates AI in 2026

Singapore relies mainly on voluntary frameworks and sector guidance, with binding obligations coming from existing law such as the PDPA. The second edition of the Model AI Governance Framework describes itself as voluntary and states plainly that adopting it "will not absolve organisations from compliance with current laws and regulations". It also notes that sectors such as finance, healthcare and legal services may be regulated separately. In practice, a business therefore has to look at three things: the national frameworks, any rules from its own sector regulator, and the PDPA.

Sources: IMDA, AI Verify Foundation, MAS, MOH and PDPC pages linked in this article and listed under Sources.

What the Model AI Governance Framework asks of organisations

The framework asks organisations to make AI decision-making explainable, transparent and fair, and to keep AI solutions human-centric. Those are its two guiding principles. It then turns them into practical guidance across four areas:

• Internal governance structures and measures: adapting or setting up governance structures to cover the values, risks and responsibilities of algorithmic decision-making.
• Determining the level of human involvement in AI-augmented decision-making: setting a risk appetite and choosing between human-in-the-loop, human-over-the-loop and human-out-of-the-loop oversight, using a probability-severity of harm assessment.
• Operations management: data management and the development, selection and maintenance of models.
• Stakeholder interaction and communication: how an organisation explains its AI use to customers and manages those relationships.

The generative AI framework expands this into 9 dimensions: accountability, data, trusted development and deployment, incident reporting, testing and assurance, security, content provenance, safety and alignment R&D, and AI for public good. For a business deploying a chatbot or a writing assistant, the most relevant are data, incident reporting, testing and security.

The agentic AI framework

The agentic AI framework applies to any organisation deploying AI agents, whether built in-house or bought from a third party. IMDA's framework document states that "humans must remain accountable" for agents and organises its guidance into four dimensions:

1. Assess and bound the risks upfront: choose suitable use cases and limit agents' autonomy, tools and data access through design.
2. Make humans meaningfully accountable: allocate responsibility clearly and require human approval at significant checkpoints, such as high-stakes or irreversible actions.
3. Implement technical controls and processes: build controls during development, test agents before deployment, and roll out gradually with continuous monitoring.
4. Enable end-user responsibility: tell users what the agent can do and what data it can access, and train employees to oversee it.

Version 1.5 says it incorporates feedback from "60+ companies since v1.0" and describes itself as a living document. If your business is piloting agents, this is the most current Singapore reference to design against; our article on AI agents in business covers how to pick a first use case.

Sector-specific requirements in finance and healthcare

Financial institutions and healthcare providers have their own, more detailed AI guidance on top of the national frameworks.

Financial services: FEAT and the MAS AI risk guidelines

MAS published its FEAT principles (Fairness, Ethics, Accountability and Transparency in the use of AI and data analytics) on 12 November 2018. On 7 October 2026, after a consultation that opened in November 2025, MAS issued its Guidelines on AI Risk Management. They apply to all financial institutions and all forms of AI. MAS expects institutions to:

• have board and senior management oversight of AI risk, using existing governance structures where adequate (a dedicated AI committee is not required solely for this purpose);
• identify their AI use, maintain inventories, assess the risk materiality of each use case and apply proportionate life-cycle controls such as data governance, testing, human oversight, cybersecurity and monitoring;
• remain accountable for third-party AI, obtaining assurance from providers and limiting or replacing a service whose risks cannot be brought within appetite; and
• apply the guidelines proportionately, with basic policies sufficing where AI failure is unlikely to have a material impact.

The guidelines take effect on 7 October 2027, with Sections 3 to 4 expected from that date and Sections 5 and 6 by 7 October 2028. MAS also says it intends to consult the sector in 2027 on further guidance for agentic AI. Vendors selling AI services to banks, insurers or payment firms should expect these assurance requests to flow down to them.

Healthcare: AIHGle 2.0

MOH and the Health Sciences Authority launched AIHGle 2.0 on 10 March 2026, according to MOH circular MOH-MHC-0024-2026, building on the 2021 guidelines. The update clarifies responsibilities for developers, deployers and users, adds guidance on transparency and on assessing deployment risks, and comes with a deployers' toolkit. It complements HSA's regulatory guidelines for software as a medical device.

Data protection and AI under the PDPA

The PDPA applies to any AI system that collects, uses or discloses personal data, and unlike the frameworks above it is law. Its consent and purpose limitation provisions (Part 4 of the Act) apply to training data, inference inputs and outputs alike. The PDPC's advisory guidelines on AI explain how those rules apply to machine-learning systems that make or recommend decisions:

• Consent or an exception. Organisations can use personal data with meaningful consent, or rely on the Business Improvement Exception (for example, improving an existing product with personalised recommendations) or the Research Exception (commercial research with public benefit).
• Data minimisation. Use only the attributes and volume of personal data needed to train the system, and pseudonymise or de-identify data where possible as a basic control.
• Meaningful notification. Tell users which product function needs their data, what types of data are processed, and how that processing relates to the feature.
• Service providers. Third-party developers of bespoke AI systems are data intermediaries with their own protection and retention obligations.

The guidelines are advisory and not legally binding; the PDPA prevails where the two differ. For businesses that commission AI from a developer, the service provider point matters in both directions: your vendor carries obligations, and you remain responsible for the data you hand over.

AI Verify and testing your AI

AI Verify is Singapore's testing framework for showing that an AI system is governed responsibly. According to the AI Verify Foundation, it assesses AI systems against 11 internationally recognised governance principles, including transparency, explainability, fairness, safety, security, accountability and human agency and oversight. It covers traditional and generative AI, and is mapped to frameworks such as the US NIST AI Risk Management Framework and ISO/IEC 42001. For an SME, AI Verify is most useful as a checklist of evidence a client or auditor may later ask for.

How Singapore compares with the EU AI Act

The main difference is legal force: the EU AI Act is binding regulation with a risk-based classification, while Singapore's AI frameworks are voluntary and sit alongside sector rules and the PDPA. Singapore businesses that offer AI systems in the EU should check the Act's timeline, which the European Commission's AI Act page sets out as follows.

Source: European Commission, Regulatory framework on AI. The Commission states that the AI Omnibus amendment entered into force on 27 July 2026.

A practical compliance checklist for SMEs

Most SMEs do not need an AI ethics board; they need an accurate AI inventory and a short set of controls proportionate to risk. MAS now expects financial institutions to maintain AI inventories, and the national frameworks point the same way for everyone else. Start by listing every AI tool your business uses, including AI embedded in SaaS products, and record the following for each.

Then build governance into each new AI project rather than adding it after launch: a data protection assessment before collecting training data, a bias and accuracy test before go-live, a named human approver for high-impact outputs, and recorded performance metrics after deployment. If you want an outside view, Namtech Pte Ltd, a Singapore AI transformation consultancy, runs a 2–4 week AI Opportunity Audit that ends in an AI roadmap, which is a natural point to build this inventory. If you prefer to start alone, our free AI Readiness Audit is a short self-assessment.

Singapore's AI frameworks are voluntary, but the PDPA and sector rules are not, and an up-to-date AI inventory is the simplest way to show you meet both.