Singapore AI governance

What it is

Singapore regulates AI the way it regulates most things, which is pragmatically, through frameworks organisations can actually implement, backed by a government that expects them to be used. The anchor documents come from the Infocomm Media Development Authority (IMDA) and the Personal Data Protection Commission (PDPC). The Model AI Governance Framework, first released in 2019 and expanded in its second edition in 2020, was among the first practical AI governance frameworks published anywhere. The Model AI Governance Framework for Generative AI followed in 2024, extending the approach to the risks generative systems introduce, and AI Verify, developed with industry and now stewarded through the AI Verify Foundation, turned governance principles into a testing framework and open-source toolkit.

The shape of the framework

• Internal governance. Clear roles, responsibilities and escalation for AI decisions, inside the organisation's existing governance rather than beside it.
• Human involvement calibrated to risk. The framework's best-known contribution, deciding where a system sits between human-in-the-loop, human-over-the-loop and human-out-of-the-loop, based on the probability and severity of harm.
• Operations management. The lifecycle disciplines, meaning data quality, model selection, testing, monitoring and the records of each.
• Stakeholder interaction. Transparency to the people affected, meaning disclosure that AI is in use, explanation appropriate to the audience and channels for feedback and recourse.

The Generative AI framework adds the newer surface, with accountability across the model supply chain, content provenance, safety evaluation and incident reporting among its nine dimensions.

Why an Australian organisation might care

Singapore is a natural second market for Australian software and services, and its governance vocabulary is the one Asian customers and partners most often assess against. The frameworks also interlock cleanly with what Australian organisations already run, because the human-oversight calibration maps onto Australia's own guidance and the operations disciplines align with ISO/IEC 42001 and the NIST AI RMF. For a governance function, adding Singapore is mostly a second lens on work already being done, which is exactly how it should be handled.

Common misreadings

"Voluntary framework, small country, safe to ignore." Singapore's frameworks punch far above the country's size. The Model Framework was among the first practical AI governance frameworks anywhere, AI Verify made governance testable rather than aspirational and regulators and companies across Asia and beyond borrow from both. Ignoring it means ignoring one of the main sources the region's expectations are written from.

"AI Verify is a certification we can pass." AI Verify is a testing framework and toolkit, not a certificate. It checks a system's behaviour and documentation against stated principles and produces results to show stakeholders. It deliberately does not declare a system safe or compliant, which is a distinction Aicura has some sympathy for.

"Generative AI changes everything, so the older framework is obsolete." The 2024 Generative AI framework extends the earlier work rather than replacing it. The traditional framework's disciplines, meaning internal governance, human oversight, operations management and stakeholder communication, still carry the load for the systems most organisations run.

How Aicura supports work against it

Singapore framework content is available in Aicura on the Enterprise tier, operating the way every Aicura framework does, as loaded content applied through the product. Risk and impact assessments draw on it, including the human-oversight calibration, governance policy reviews use it as a source and the multi-framework view reads the same systems through the Singapore lens alongside the Australian frameworks and any others in play, with the record in the Evidence Vault throughout.

A note on this page

This is Aicura's reading of the framework, written to help you understand what the product is wired into. It is not legal advice and it is not the framework itself. Read the primary sources from IMDA and the PDPC, and how Singapore's expectations bear on your organisation is a question for your advisors.

For a more complete picture of what Aicura does and doesn't do for any framework, see the boundaries page.