Singapore's Model AI Governance Framework in 2026: The Generative and Agentic AI Frameworks, AI Verify, MAS Guidelines, and the Laws That Bind

What is Singapore’s Model AI Governance Framework?

Singapore’s Model AI Governance Framework is voluntary guidance from the Infocomm Media Development Authority (IMDA) and the Personal Data Protection Commission (PDPC). It shows organisations deploying AI at scale how to put ethical principles into practice in four areas: internal governance, human involvement, operations management, and stakeholder communication. The 2019 edition was released on January 23, 2019 and the second edition on January 21, 2020, both at the World Economic Forum in Davos.

Frameworks for generative AI (2024) and agentic AI (2026) extend it. None is a statute, and the second edition says adopting it “will not absolve organisations from compliance with current laws and regulations.”

Does Singapore have an AI law?

No general one. As of November 2, 2026, Singapore has not enacted a cross-sector AI statute, and none of the bills published in 2025 or 2026 in the Bills Supplement on Singapore Statutes Online is a general AI bill. Three existing laws reach AI in defined situations. The other instruments in the table are frameworks, guidelines, principles, or a testing toolkit, and none of them is a statute.

Singapore AI instruments, as of November 2, 2026

Instrument	Issuer	Binding or voluntary	Who it reaches	Date
Personal Data Protection Act 2012	Parliament; administered by the PDPC	Binding statute	Organisations collecting and using personal data, including to develop, test, monitor, and deploy AI systems	2012; section 48J penalty caps as amended, from October 1, 2022
Advisory Guidelines on Use of Personal Data in AI Recommendation and Decision Systems	PDPC	Advisory; “not legally binding”	Organisations using personal data in systems that embed machine learning models, and their service providers	March 1, 2024
Parliamentary Elections Act 1954, section 61MA (Act 34 of 2024)	Parliament	Binding; criminal offence	Anyone publishing online election advertising in Singapore during an election period	In force January 22, 2025
Online Safety (Relief and Accountability) Act 2025	Parliament; Commissioner of Online Safety	Binding; partly in force	People who communicate online harmful material, administrators of online locations, online service providers	Partly in force June 29, 2026; sections 15 and 16 not listed as commenced
Model AI Governance Framework, second edition, with ISAGO	IMDA and PDPC	Voluntary	Organisations deploying AI at scale	January 21, 2020
Model AI Governance Framework for Generative AI	IMDA and AI Verify Foundation	Voluntary guidance	Policymakers, industry, researchers, the public	May 30, 2024
Model AI Governance Framework for Agentic AI, version 1.5	IMDA	Voluntary guidance; living document	Organisations deploying agents built in-house or by third parties	January 22, 2026; version 1.5 May 20, 2026
AI Verify Testing Framework and Toolkit	IMDA; AI Verify Foundation	Voluntary	Any organisation testing an AI system	May 2022; open source June 2023
Guidelines and Companion Guide on Securing AI Systems	Cyber Security Agency of Singapore	Guidance; CSA says organisational leaders, business owners, and AI and cybersecurity practitioners are “strongly encouraged to adopt” it	Organisations adopting AI, including system owners	October 15, 2024
FEAT principles	MAS	Principles; continue to apply under the 2026 Guidelines	Financial institutions using AI and data analytics	November 12, 2018
Guidelines on Artificial Intelligence Risk Management	MAS	Supervisory expectations in MAS guidelines, not a statute	All financial institutions as defined in the Financial Services and Markets Act 2022	Issued October 7, 2026; effective October 7, 2027; MAS expects Sections 3 and 4 met by then and full implementation, including Sections 5 and 6, by October 7, 2028

Which Singapore laws already reach AI?

Personal Data Protection Act 2012 (PDPA). The PDPC’s Advisory Guidelines on Use of Personal Data in AI Recommendation and Decision Systems, issued March 1, 2024, say the PDPA “applies to all collection and use of personal data by an organisation,” including to develop, test, and monitor AI systems and to deploy them. They explain when an organisation can rely on consent, the business improvement exception, or the research exception to train a machine learning system, and treat third-party developers of bespoke AI systems as data intermediaries. The guidelines themselves “are not legally binding on the Commission or on any other party.”

The PDPA is binding: under section 48J, the PDPC may impose a financial penalty on an organisation that intentionally or negligently contravenes the Act’s data protection provisions (Parts 3, 4, 5, 6, 6A and 6B). For contraventions on or after October 1, 2022, the date Singapore Statutes Online gives for the higher cap added by the Personal Data Protection (Amendment) Act 2020, the cap is 10% of annual turnover in Singapore for an organisation whose annual turnover in Singapore exceeds $10 million, and $1 million in any other case (Singapore dollars).

Election deepfakes. The Elections (Integrity of Online Advertising) (Amendment) Act 2024 (Act 34 of 2024) added section 61MA to the Parliamentary Elections Act 1954, in force from January 22, 2025. During an election period, it is an offence to publish in Singapore online election advertising that contains an audio, visual, or audiovisual representation of a candidate saying or doing something the candidate did not in fact say or do, where the representation is realistic enough that some members of the public would likely and reasonably believe it, and was created wholly or partly with content generated or manipulated using digital means. The person must also know, or ought reasonably to have known, that the content is online election advertising relating to that election. The section names generative AI as one such digital means.

The penalty on conviction is a fine of up to $1,000, imprisonment of up to 12 months, or both. It is a defence to prove that the person did not know and had no reason to believe that the candidate did not say or do the thing. The offence does not apply to private or domestic communications between individuals, to election news published by an authorised news agency, or to circumstances excluded by regulations. A social media service provider that, without reasonable excuse, fails to comply with a Returning Officer’s corrective direction faces a fine of up to $1,000,000. The Act added a matching section 42LA to the Presidential Elections Act 1991.

Online Safety (Relief and Accountability) Act 2025 (No. 23 of 2025). In its definitions of intimate image abuse (section 13) and image-based child abuse (section 14), an image or recording includes one “that has been altered or generated by any means.” Intimate image abuse also requires that the material is communicated without the victim’s consent and that a reasonable person would conclude it is likely to cause the victim harassment, alarm, distress or humiliation. Section 16, inauthentic material abuse, covers communicating audio, visual, or audiovisual material altered or generated using digital means that falsely or misleadingly depicts a person’s words, actions or conduct, even if the person does not appear in it, is realistic enough that a reasonable person would believe it, and that a reasonable person would conclude is likely to cause the victim harassment, alarm, distress or humiliation because it is false or misleading. Its Explanation 2 names generative AI as an example of digital means.

The Singapore Statutes Online record lists one commencement date, June 29, 2026, which brought into force Parts 1 and 2, including section 5, under which the Minister appoints a Commissioner of Online Safety, and sections 13 and 14, among others. It does not list sections 15 (online impersonation) or 16, or the matching torts in sections 85 and 86, as of November 2, 2026. The Ministry of Law and the Ministry of Digital Development and Information said the Online Safety Commission would start on June 29, 2026 with five harms, including intimate image abuse and image-based child abuse, and that the remaining categories will be progressively implemented.

What are the Model Framework’s principles and four areas?

The framework rests on two guiding principles. Organisations using AI in decision-making should ensure the process is “explainable, transparent and fair,” and “AI solutions should be human-centric.” Its guidance covers four areas:

1. Internal governance structures and measures.
2. Determining the level of human involvement in AI-augmented decision-making: human-in-the-loop, human-out-of-the-loop, or human-over-the-loop. Its matrix uses the probability and severity of harm, which it says are not the only factors.
3. Operations management, including data management.
4. Stakeholder interaction and communication.

It is not intended for organisations deploying updated off-the-shelf software that happens to include AI. Two companions came with it in January 2020: the Implementation and Self-Assessment Guide for Organizations (ISAGO), which IMDA and the PDPC developed with the World Economic Forum Centre for the Fourth Industrial Revolution, and a Compendium of Use Cases.

What does the Model AI Governance Framework for Generative AI add?

IMDA and the AI Verify Foundation released a proposed version on January 16, 2024 and the final framework on May 30, 2024. It sets out nine dimensions to be looked at together:

1. Accountability
2. Data
3. Trusted development and deployment
4. Incident reporting
5. Testing and assurance
6. Security
7. Content provenance
8. Safety and alignment research and development
9. AI for public good

It frames its practical suggestions as initial steps and addresses them to policymakers, researchers, and the public as well as industry.

What does the Model AI Governance Framework for Agentic AI say?

IMDA developed it, and Minister for Digital Development and Information Josephine Teo announced it in Davos on January 22, 2026. It targets organisations deploying agentic AI, whether they build agents in-house or use third-party agentic solutions, and it holds that humans are ultimately accountable. It covers four dimensions:

1. Assess and bound the risks upfront, for example by limiting an agent’s autonomy and its access to tools and data.
2. Make humans meaningfully accountable, including significant checkpoints at which human approval is required.
3. Implement technical controls and processes across the agent lifecycle, such as baseline testing and whitelisted services.
4. Enable end-user responsibility through transparency and education or training.

Version 1.5, published May 20, 2026 and updated June 5, 2026, says it reflects feedback from more than 60 companies. It adds systemic and multi-agent risks, third-party solutions as a risk factor, practices against automation bias such as monitoring human override rates, and case studies.

What is AI Verify?

AI Verify is IMDA’s AI governance testing framework and software toolkit. IMDA and the PDPC launched it in May 2022 and open-sourced it in June 2023. The testing framework assesses an AI system against 11 principles: transparency, explainability, repeatability or reproducibility, safety, security, robustness, fairness, data governance, accountability, human agency and oversight, and inclusive growth, societal and environmental well-being. Each principle has outcomes, process checks, and documentary evidence.

The AI Verify Foundation, launched June 7, 2023, is a not-for-profit, wholly owned subsidiary of IMDA. It runs Project Moonshot (May 2024), for benchmark testing and red teaming of large language model applications, and, with IMDA, the Global AI Assurance Sandbox (announced July 2025).

What does MAS expect from financial institutions?

Three MAS instruments matter:

• FEAT principles (November 12, 2018) on fairness, ethics, accountability and transparency in the use of AI and data analytics. The 2026 Guidelines say they continue to apply.
• Veritas: a multi-phase MAS project with industry to help institutions evaluate AI and data analytics solutions against FEAT. Toolkit 2.0 came out on June 26, 2023, and the AI Verify Foundation says Veritas was integrated into AI Verify in April 2025.
• Guidelines on Artificial Intelligence Risk Management: proposed in a consultation paper on November 13, 2025 (comments closed January 31, 2026) and issued in final form on October 7, 2026. They set out supervisory expectations for all financial institutions as defined in section 2 of the Financial Services and Markets Act 2022, covering board and senior management oversight, AI identification and inventory, risk materiality assessment, lifecycle controls, and capability and capacity, including AI in services from material third-party service providers. They cover generative AI and AI agents, and apply on a group basis to locally incorporated institutions that are subject to MAS consolidated supervision or own critical information infrastructure as defined in the Cybersecurity Act 2018.

The Guidelines “take effect on 7 October 2027.” Under paragraph 1.8, institutions may meet the expectations in Sections 3 and 4 (oversight, and key systems, policies and procedures such as AI identification, inventory, and risk materiality assessment) from that date, and those in Sections 5 and 6 (lifecycle controls, and capability and capacity) by October 7, 2028. In its response to feedback, MAS said an institution should meet Sections 3 and 4 by 12 months after issuance (October 7, 2027) and complete full implementation, including Sections 5 and 6, by 24 months (October 7, 2028). It also said an institution should apply appropriate lifecycle controls to its high-risk use cases as soon as possible and not wait for the end of the 24-month transition. An institution whose AI use is unlikely to have a material adverse impact on it, its customers, or other stakeholders may instead apply basic AI governance policies and procedures under paragraph 2.3 of the Guidelines, and MAS said such an institution should complete implementation by 12 months.

Does the Model AI Governance Framework map to the NIST AI RMF and ISO/IEC 42001?

The published crosswalks map the AI Verify Testing Framework, not the Model AI Governance Framework itself. NIST hosts the crosswalk between the NIST AI RMF 1.0 and AI Verify, dated October 12, 2023, and a second one against the NIST Generative AI Profile (NIST AI 600-1), dated May 2025. A third crosswalk, dated July 21, 2025 by the Foundation, maps ISO/IEC 42001:2023 controls to AI Verify process checks.

A company already running the NIST AI RMF or ISO/IEC 42001 can use the crosswalks to reuse evidence. A crosswalk is a mapping, not a certification.

What should a company deploying AI in Singapore do now?

• Record the PDPA basis for each AI system that uses personal data, such as consent or an exception to consent; the PDPC’s advisory guidelines explain how the business improvement and research exceptions apply to AI development
• Put the practices and safeguards your AI systems use for personal data in your written PDPA policies; the PDPA requires information about those policies to be available on request, and the PDPC’s advisory guidelines suggest also publishing them on your website
• Check that vendors processing personal data to build bespoke AI systems for you meet their PDPA duties as data intermediaries, including protection, retention, and notifying you of data breaches
• Choose and record a level of human involvement for each use case
• Limit agents’ tool and data access and require human approval for high-stakes or irreversible actions
• Run the AI Verify process checks, reusing NIST AI RMF or ISO/IEC 42001 evidence
• Financial institutions: plan to meet MAS Sections 3 and 4 by October 7, 2027 and complete Sections 5 and 6 by October 7, 2028, as MAS expects, and apply lifecycle controls to high-risk use cases as soon as possible; an institution on the paragraph 2.3 basic-governance path should complete implementation by October 7, 2027
• Screen AI-generated images, audio, and video of real people against the Online Safety (Relief and Accountability) Act 2025, and online election advertising against section 61MA during election periods

How this fits the other guides: the AI compliance guide places cross-border AI laws in context, the AI governance frameworks guide compares the NIST AI RMF and ISO/IEC 42001, the NIST AI RMF guide covers the framework the crosswalks map to, and the agentic AI governance guide covers rules for AI agents elsewhere.

This guide is general information as of November 2, 2026, not legal advice. Confirm current requirements with the issuing body or counsel admitted in Singapore before acting.

By industry: all 8 industry pages