Singapore AI Regulatory Hub
Verification required. Claims on this page about Singapore law were compiled on 7 October 2026 from secondary web sources and from memory of the law. On 10 October 2026, rows SG5 and SG6 were checked against the MAS Guidelines on Artificial Intelligence Risk Management of 7 October 2026 and are tagged [Verified]. No other primary text was read, and every other claim is tagged [Reported], [Recalled], [Conflict] or [Unverified] as explained on the section home page. Check the primary text before relying on any of them. This is not legal advice.
This page maps Singapore laws, guidance and standards that bear on AI to the wiki's controls.
1. Regional model
There are four layers [Reported]:
- The PDPA, and the PDPC advisory guidelines on AI recommendation and decision systems.
- Voluntary governance frameworks: the Model AI Governance Framework, its generative and agentic versions, and AI Verify testing.
- MAS guidelines for the financial sector.
- CSA cybersecurity guidance for AI systems.
The voluntary frameworks still shape what buyers expect. Organisations remain legally responsible for the conduct of their AI agents.
2. Instrument register
| # | Instrument | Type / status | Key points | Wiki controls | Tag | To verify |
|---|---|---|---|---|---|---|
| SG1 | Model AI Governance Framework (2019; later editions) | Voluntary | Internal governance, risk management, operations, stakeholder communication | AI-CTRL-012, AI-CTRL-037, AI-CTRL-039 | [Recalled] | Current edition |
| SG2 | Model AI Governance Framework for Agentic AI (IMDA, 22 Jan 2026) | Voluntary | Four dimensions: risk assessment and bounding; human accountability; technical controls; end-user responsibility | AI-CTRL-023, AI-CTRL-025, AI-CTRL-037, AI-CTRL-005 | [Reported] | Full text |
| SG3 | AI Verify testing framework and toolkit; Global AI Assurance Pilot (Feb 2025) | Voluntary testing and assurance | Technical tests and process checks against governance principles | AI-CTRL-038, AI-CTRL-039 | [Reported] | Principle list (11, from memory) |
| SG4 | PDPA and PDPC Advisory Guidelines on AI | Binding law; guidance | Use of personal data in AI recommendation and decision systems | AI-CTRL-013, AI-CTRL-007, AI-CTRL-017 | [Reported] | Guideline title and content; exceptions for research or business improvement |
| SG5 | MAS Guidelines on Artificial Intelligence Risk Management (7 Oct 2026) | Guidance. Issued 7 Oct 2026; sets out supervisory expectations. Takes effect 7 Oct 2027 for Sections 3 and 4, and 7 Oct 2028 for Sections 5 and 6 | Supervisory expectations for all financial institutions, applied in proportion: board and senior management oversight; AI identification, inventory and risk materiality assessment; life cycle controls (data, transparency, fairness, human oversight, third-party AI, selection, evaluation and testing, technology and cybersecurity, reproducibility, pre-deployment review, monitoring, change management and retirement); capability and infrastructure. Generative AI and AI agents are in scope. A lighter route applies to low-impact uses | AI-CTRL-001, AI-CTRL-005, AI-CTRL-006, AI-CTRL-008, AI-CTRL-009, AI-CTRL-010, AI-CTRL-011, AI-CTRL-012, AI-CTRL-013, AI-CTRL-014, AI-CTRL-016, AI-CTRL-017, AI-CTRL-023, AI-CTRL-024, AI-CTRL-025, AI-CTRL-028, AI-CTRL-029, AI-CTRL-030, AI-CTRL-031, AI-CTRL-032, AI-CTRL-033, AI-CTRL-034, AI-CTRL-035, AI-CTRL-037, AI-CTRL-038, AI-CTRL-039, AI-CTRL-040, AI-CTRL-041, AI-CTRL-044, AI-CTRL-045 | [Verified] | Sector notices and other MAS guidelines that the Guidelines refer to |
| SG6 | MAS FEAT principles and Veritas | Voluntary financial-sector principles; the MAS Guidelines say they continue to apply (para 1.2) | Fairness, ethics, accountability, transparency | AI-CTRL-041 | [Verified] | Veritas status |
| SG7 | CSA Guidelines and Companion Guide on Securing AI Systems (2024) and agentic addendum (17 Jun 2026) | Voluntary | Risk identification, lifecycle controls, threat mapping; an addendum for agentic AI. Consultation ran from 22 Oct to 31 Dec 2025 | AI-CTRL-005, AI-CTRL-008, AI-CTRL-025 | [Reported] | Text |
| SG8 | Cybersecurity Act (critical information infrastructure) | Binding | Obligations for owners of critical information infrastructure (CII) | AI-CTRL-005, AI-CTRL-035 | [Recalled] | Scope |
3. Categories, tiers and roles
| Category / role | What it means |
|---|---|
| Organisation | Remains legally responsible for AI and agent behaviour |
| Financial institution | The MAS Guidelines apply to all financial institutions in proportion to size and risk profile, from 7 October 2027 [Verified] |
| CII owner | Cybersecurity Act duties |
| Agentic AI deployer | Use the bounding and accountability dimensions |
| No statutory tiers | Financial institutions assess the risk materiality of each AI use case on impact, complexity and reliance (SG-T2) |
4. Timeline
| Date | Event | Tag |
|---|---|---|
| 2019 | Model AI Governance Framework | [Recalled] |
| Feb 2025 | Global AI Assurance Pilot | [Reported] |
| Nov 2025 | MAS consults on proposed AI risk management guidelines | [Reported] |
| 22 Jan 2026 | Agentic AI framework launched | [Reported] |
| 17 Jun 2026 | CSA agentic AI addendum | [Reported] |
| 7 Oct 2026 | MAS issues the Guidelines on Artificial Intelligence Risk Management | [Verified] |
| 7 Oct 2027 | MAS Guidelines take effect; Sections 3 and 4 (oversight; identification, inventory and risk materiality) to be met | [Verified] |
| 7 Oct 2028 | Sections 5 and 6 of the MAS Guidelines (life cycle controls; capability and capacity) to be met | [Verified] |
5. Mapping of common wiki controls
| Wiki control | Regional hook |
|---|---|
| AI-CTRL-011 Inventory and tiering | MAS Guidelines paras 4.5 to 4.13: inventory and risk materiality assessment (SG-T2) |
| AI-CTRL-023 Human approval | Human accountability checkpoints in the agentic framework (SG-T1) |
| AI-CTRL-025 Kill switch | Technical controls and graded deployment in the agentic framework |
| AI-CTRL-013 Privacy | PDPA and PDPC AI guidelines (SG-T3) |
| AI-CTRL-005 Security | CSA guidance and addendum |
| AI-CTRL-038 Audit evidence | AI Verify test records |
| AI-CTRL-041 Fairness | MAS FEAT, and MAS Guidelines paras 5.7 to 5.8 |
| AI-CTRL-045 Human oversight | MAS Guidelines para 5.9 |
| AI-CTRL-014 Third-party AI | MAS Guidelines paras 5.10 to 5.11 |
| AI-CTRL-034 Testing | MAS Guidelines paras 5.14 to 5.15 and 5.22 |
| AI-CTRL-040 Resilience | MAS Guidelines para 5.3: contingency plans for high-risk use cases |
6. Where the wiki covers this
The topics raised on this page are covered by the following controls, test cases and templates.
| Topic | Covered by |
|---|---|
| Agentic AI governance (IMDA framework) | SG-T1; Agentic AI Security and Tool Governance; AI-CTRL-006, AI-CTRL-022, AI-CTRL-023, AI-CTRL-025 |
| MAS Guidelines on AI Risk Management | Paragraph crosswalk; SG-T2; TC-L01-005, TC-L01-009; Sector Overlays |
| AI Verify test evidence | AI-CTRL-034, AI-CTRL-038; TC-L02-016 |
| AI use under the PDPA | SG-T3; TC-L03-002 |
7. Conflicts and cautions
- The MAS Guidelines are final. They take effect on 7 October 2027, and Sections 5 and 6 are to be met by 7 October 2028. They are supervisory expectations, so confirm with your own advisers how MAS applies them to your licence type.
- The number of AI Verify principles is given from memory and was not verified.
- The voluntary frameworks are still enforced in practice, through tenders and sector supervision.
8. Verification checklist
- [x] MAS final guidelines and effective date (checked 10 October 2026)
- [ ] IMDA agentic framework text
- [ ] PDPC AI advisory guideline title and content
- [ ] AI Verify current principle list and toolkit
- [ ] CSA addendum text
- [x] FEAT status: the MAS Guidelines say the principles continue to apply (checked 10 October 2026)
- [ ] Add the primary URL and retrieval date beside every confirmed row
9. Sources
All sources are secondary unless marked as a regulator or government page. Each fetched page was summarised by a tool and was not read line by line. A source marked "not read" appeared only as a title or snippet in search results, so do not treat it as support for any claim.
| Source | Status | Rows it relates to |
|---|---|---|
| MAS: Guidelines on Artificial Intelligence Risk Management for Financial Institutions | Regulator page; the Guidelines of 7 October 2026 were read in full | SG5, SG6 |
| Bird & Bird: Singapore agentic AI governance framework | Fetched and summarised | SG1, SG2, SG3 |
| Simmons & Simmons: MAS guidelines on AI risk management | Fetched and summarised | SG5 |
| Allen & Gledhill: CSA addendum on securing AI systems | Fetched and summarised | SG7 |
| Allen & Gledhill: MAS consults on AI risk management guidelines | Not read | SG5 status |
| Baker McKenzie: MAS consultation paper | Not read | SG5 status |
The MAS Guidelines are the only primary text read, and they support rows SG5 and SG6. Confirm every other row against its primary source, and add its URL and retrieval date in the Singapore Regulatory Crosswalk.