Singapore AI Governance 2026. Model Framework, AI Verify, MAS FEAT, and what global operators must understand.

Singapore has built a layered AI governance architecture that distinguishes clearly between voluntary best-practice frameworks and binding sector-specific obligations. For global operators, the key analytical task is determining which layer applies to their activities: the voluntary Model AI Governance Framework and AI Verify carry no direct penalties, but the MAS FEAT Principles and the Personal Data Protection Act impose concrete compliance requirements on regulated financial institutions and any organisation handling personal data of individuals in Singapore. Understanding the structure of each layer, and where it overlaps with the EU AI Act, is the starting point for any cross-border AI compliance programme.

Singapore's governance philosophy: voluntary-first with targeted binding obligations

Singapore does not have a general AI law equivalent to the EU AI Act. The government's stated approach, articulated through the National AI Strategy and the AI Governance Framework series, is that regulation should be proportionate to risk, technology-neutral, and implemented at sector level where binding obligations are genuinely needed. This philosophy reflects Singapore's positioning as a regional AI hub and its concern that premature prescriptive regulation would disadvantage domestic development.

In practice, this means the architecture is two-speed. The IMDA-published Model AI Governance Framework and AI Verify programme sit in the voluntary tier: they provide detailed technical and governance guidance, but organisations choose whether to adopt them. The binding tier is sector-specific. The Monetary Authority of Singapore has issued the FEAT Principles as supervisory expectations for financial institutions. The Personal Data Protection Commission has issued Advisory Guidelines under the PDPA on the use of personal data in AI recommendation and decision systems; those Guidelines are advisory and state on their face that they are not legally binding, so the binding instrument is the PDPA itself. Other regulators, including the Ministry of Health and the Ministry of Education, have issued or are developing sector-specific guidance.

The result is a system where the voluntary tier is genuinely detailed and technically substantive, not aspirational boilerplate, while the binding tier operates through existing regulatory relationships rather than a new cross-sector enforcement body. For operators, this creates a compliance question that depends entirely on sector: a general technology company deploying AI in Singapore faces primarily voluntary guidance, while a licensed bank or insurer faces binding supervisory expectations.

Model AI Governance Framework: structure and the 2024 generative AI extension

The IMDA published the first edition of the Model AI Governance Framework in 2019, followed by a revised second edition in January 2020. The framework is organised around four areas: internal governance structures and measures; determining the appropriate level of human involvement in AI-augmented decisions; operations management (including data quality, model explainability, and incident response); and stakeholder communication and interaction.

The second edition introduced a two-by-two probability-severity risk matrix to guide decisions about human oversight. For decisions where errors carry high probability and severe impact, the framework recommends human-in-the-loop or human-on-the-loop involvement. Where probability and impact are low, a human-out-of-the-loop approach may be acceptable, provided monitoring controls are in place. This is not a prescriptive rule but a structured method for documenting the governance rationale behind deployment decisions.

In May 2024, IMDA and the AI Verify Foundation published the Model AI Governance Framework for Generative AI. It is organised around nine governance dimensions, not around a risk taxonomy: Accountability, Data, Trusted Development and Deployment, Incident Reporting, Testing and Assurance, Security, Content Provenance, Safety and Alignment Research and Development, and AI for Public Good. An earlier version of this guide listed nine invented risk categories in their place, and described a three-level pre-deployment, deployment and monitoring structure that the document does not use. Both have been removed.

The generative AI extension is notable for its treatment of supply chain risk. Unlike the EU AI Act, which places primary obligations on the developer of the AI system, the Singapore framework explicitly addresses the position of the deploying organisation, which may have limited visibility into the training data, safety fine-tuning, and structural properties of the foundation model it is using. The extension recommends contractual due diligence, technical sandboxing, and output monitoring as mitigations for this opacity. This is practically important for organisations using third-party large language models via API: they remain accountable under Singapore governance frameworks for outputs they generate, regardless of who built the underlying model.

AI Verify: open-source testing and the accountability trail

AI Verify is a testing toolkit published jointly by IMDA and the AI Verify Foundation (an industry-led body). The first version was released in 2022; the toolkit was updated in 2024 to incorporate generative AI test cases aligned with the 2024 Model AI Governance Framework extension.

The toolkit provides structured test procedures for eleven AI ethics principles: Transparency, Explainability, Repeatability and Reproducibility, Safety, Security, Robustness, Fairness, Data Governance, Accountability, Human Agency and Oversight, and Inclusive Growth with Societal and Environmental Well-being. An earlier version of this guide named ten and included data privacy, which is not one of them. For each principle, AI Verify specifies test inputs, expected outputs and scoring methods, and an organisation that completes an assessment can generate a standardised report. This guide previously stated that IMDA maintains a public registry of completed assessments. No such registry is described on the AI Verify Foundation site and the claim has been withdrawn.

The practical value of AI Verify is documentation. In Singapore's procurement environment, particularly for public sector contracts, government buyers are increasingly requesting evidence that AI systems in use have been assessed against the Model AI Governance Framework. AI Verify provides a structured method for producing that evidence. For cross-border operators, the toolkit's test procedures are also broadly compatible with the technical documentation requirements under the EU AI Act for high-risk AI systems, allowing a single assessment cycle to support compliance artefacts in multiple jurisdictions.

Completing an AI Verify assessment does not constitute regulatory approval, certification, or a safe harbour under any Singapore law. It is a governance documentation exercise. Organisations should treat it as one input into their broader AI risk management programme, not as a compliance endpoint.

MAS FEAT Principles: binding supervisory expectations for financial services

The Monetary Authority of Singapore published the Principles to Promote Fairness, Ethics, Accountability and Transparency (FEAT) in November 2018. The FEAT Principles are addressed to financial institutions conducting AI and data analytics activities in Singapore: banks, insurers, capital markets intermediaries, and other MAS-regulated entities.

The four principles establish the following expectations. Fairness requires that AI outcomes do not result in unfair treatment of customers, including through discriminatory outputs from biased training data. Ethics requires that AI use is aligned with professional standards and societal norms, and that institutions identify and manage situations where AI decisions may conflict with ethical expectations. Accountability requires clear ownership of AI decisions within the institution, documented oversight processes, and mechanisms for addressing complaints or errors arising from AI outputs. Transparency requires that customers who are subject to AI-assisted decisions receive sufficient information to understand how those decisions were made and how to seek redress.

MAS examines FEAT compliance as part of its supervisory review process. This means FEAT is functionally binding for MAS-regulated entities: non-compliance is a supervisory risk, not merely a reputational one. MAS has published self-assessment guidance to assist institutions in evaluating their FEAT compliance posture, but the assessment is intended to feed into internal governance processes and supervisory dialogue, not to produce a public certification.

For global financial institutions with Singapore operations, FEAT operates in parallel with home-jurisdiction requirements. An institution subject to both FEAT and the EU AI Act high-risk classification (for example, a bank using AI for credit scoring that distributes products into the EU market) must satisfy both frameworks. The two frameworks share substantive overlaps in accountability and transparency, but they differ in enforcement mechanism: FEAT compliance is examined through the supervisory relationship, while EU AI Act obligations are enforceable by national market surveillance authorities through administrative fines.

Veritas Initiative: fairness methodology for credit, insurance, and talent management

The Veritas Initiative is a collaborative project led by MAS and developed with a consortium of financial institutions. It extends the FEAT Principles with a technical fairness assessment methodology targeting three specific use cases: credit risk scoring, life insurance pricing and underwriting, and talent management (recruitment and promotion).

Version 2.0 of the Veritas Methodology, released in 2022, provides quantitative fairness metrics, a fairness assessment process, and case study implementations across the three use cases. For credit scoring, the methodology addresses proxy discrimination: situations where a model trained on historical data reproduces discriminatory patterns even when protected characteristics are formally excluded from the feature set. For life insurance, it addresses actuarial fairness versus individual fairness tensions. For talent management, it provides methods for assessing whether AI-assisted screening tools produce disparate impact across protected groups.

Veritas is not a regulation and completion of a Veritas assessment is not legally required. However, for financial institutions that use AI in the three covered use cases, Veritas provides the most operationally specific fairness assessment methodology available in the Singapore market. MAS has indicated that it regards the Veritas methodology as consistent with FEAT expectations in the covered use cases. Institutions using AI for credit, life insurance, or talent decisions that cannot demonstrate a structured fairness assessment process are exposed to adverse supervisory findings under FEAT.

The Veritas framework is also relevant to AI insurers and liability underwriters. An organisation underwriting AI liability policies for financial institution clients in Singapore should understand the Veritas assessment process, since the completeness of a client's FEAT and Veritas documentation will be material to underwriting risk. Related analysis on AI insurance market structure is available at agentinsured.eu.

PDPA and the PDPC Advisory Guidelines on AI: what is actually required

The Personal Data Protection Act 2012 (PDPA) applies to any organisation that collects, uses, or discloses personal data of individuals in Singapore, regardless of where the organisation is incorporated or located. The Personal Data Protection (Amendment) Act 2020 introduced mandatory data breach notification, data portability, the legitimate interests and business improvement exceptions, and new offences. It did not introduce provisions on automated decision-making, and an earlier version of this guide said that it did.

The Personal Data Protection Commission (PDPC) issued its Advisory Guidelines on the Use of Personal Data in AI Recommendation and Decision Systems on 1 March 2024. An earlier version of this guide dated them to 2023; 2023 was the public consultation on the draft. The Guidelines state at paragraph 2.2 that they are advisory in nature, are not legally binding on the Commission or on any other party, and do not constitute legal advice. This guide previously placed them in a binding tier alongside the MAS expectations. That was wrong, and the two-speed framing below has been corrected accordingly.

The PDPA does not contain an automated decision-making regime. There is no right to be notified that a decision is automated, no right to human review, and no right to an explanation of an automated decision. Those are GDPR Article 22 rights, and an earlier version of this guide projected them onto Singapore law. What the PDPA does impose, and what the Advisory Guidelines interpret, are the Consent, Notification and Accountability Obligations, together with the Business Improvement and Research exceptions that let an organisation use personal data to develop and improve an AI system without fresh consent in defined circumstances. The Notification Obligation is about telling an individual the purpose for which their personal data is collected, used or disclosed. It is not a duty to disclose that a decision was automated.

An earlier version of this guide described the Guidelines as making data quality a precondition of lawful automated decision-making, breach of which would breach the PDPA accuracy obligation. That reading could not be located in the Guidelines text and has been withdrawn. Data currency and representativeness remain worth managing, on model quality grounds and because the PDPA Accuracy Obligation applies to personal data generally, but not as a distinct AI provision.

For global operators, the PDPA extraterritorial position is important. The Act applies based on the data subjects: if an organisation processes personal data of individuals located in Singapore, PDPA obligations attach regardless of where the processing takes place. A company based in the United States or the European Union that uses AI to make decisions about customers or employees located in Singapore is within scope of the PDPA, in respect of its consent, notification and accountability duties. It is not within scope of an automated decision-making regime, because Singapore does not have one.

Comparison with the EU AI Act: voluntary versus mandatory, domestic versus extraterritorial

The structural contrast between Singapore's framework and the EU AI Act is one of legal architecture rather than substantive values. Both regimes address similar risks: unfair automated decisions, opaque AI systems, accountability gaps, and data quality failures. But they differ sharply in how those concerns are translated into legal obligations.

The EU AI Act is a binding regulation with direct effect in all 27 EU member states. It establishes a risk classification system that applies to any AI system placed on the EU market or used by EU persons, regardless of where the system is developed or operated. High-risk systems in sectors including credit scoring, employment, and critical infrastructure face mandatory conformity assessments, technical documentation requirements, post-market monitoring obligations, and registration in an EU database. Prohibited uses carry fines of up to 35 million euros or 7% of global annual turnover. The Act is explicitly extraterritorial: compliance is determined by where the system's outputs have effect, not where the developer is located. For a full analysis of the EU AI Act's extraterritorial reach, see our separate guide for US and UK operators.

Singapore's framework, by contrast, does not establish a general AI regulator with cross-sector enforcement powers. Voluntary instruments have no penalties. Binding obligations operate through existing sector regulators (MAS, PDPC) using existing supervisory and enforcement tools. There is no Singapore AI Act equivalent pending as of mid-2026, though the government has indicated it will continue to review the adequacy of sector-specific approaches as AI adoption deepens.

The comparison with Canada is also instructive. Canada's Artificial Intelligence and Data Act (AIDA), part of Bill C-27, would create cross-sector mandatory obligations for high-impact AI systems, with penalties and a dedicated AI and Data Commissioner. Bill C-27, which carried AIDA, died on the Order Paper when Parliament was prorogued on 6 January 2025. AIDA is not in force and is not in legislative process. Singapore, by contrast, has a functioning voluntary framework and functioning sector binding frameworks, without waiting for comprehensive AI legislation. For detail on Canada's approach, see our Canada AIDA operators guide.

For organisations operating across Singapore, the EU, and Canada, the practical implication is that the EU AI Act will drive the highest compliance overhead and the most prescriptive documentation requirements. Singapore alignment is achievable at lower cost, particularly where FEAT and PDPA obligations are already being met. A well-constructed EU AI Act compliance programme will typically satisfy most Singapore voluntary framework expectations as a by-product.

Practical operator priorities for Singapore AI compliance

The following operational framework reflects the compliance structure as of May 2026.

For MAS-regulated financial institutions: FEAT compliance is the primary obligation. This requires documented AI governance structures, ownership of AI decision outcomes, customer-facing transparency mechanisms, and a fairness assessment process. For credit, life insurance, and talent management use cases, the Veritas methodology provides the most operationally specific route to demonstrating FEAT alignment. AI Verify assessments are a useful supplement to the FEAT accountability trail but are not a substitute for substantive FEAT compliance.

For any organisation processing personal data of Singapore individuals: PDPA compliance requires that the purposes for which personal data is collected and used are notified and, where required, consented to, that access and correction requests are handled, and that accountability measures are documented. If personal data is being used to develop or improve an AI system, the Business Improvement and Research exceptions are the provisions to read. Do not build a Singapore programme around notification of automated decisions or a right to human review. Those duties do not exist in the PDPA, and an earlier version of this guide told readers to review their privacy notices and complaint procedures against them.

For technology companies and operators not subject to MAS regulation: The Model AI Governance Framework and AI Verify are the relevant instruments. Voluntary adoption provides governance documentation that is increasingly expected in public procurement, and provides a structured basis for managing AI risk. For organisations that also operate in the EU, AI Verify assessments can be aligned with EU AI Act technical documentation requirements to reduce duplicated effort.

For AI liability underwriters and insurers: Singapore presents a structured risk assessment environment. FEAT compliance documentation, Veritas assessment reports, and PDPA data governance records all provide observable indicators of AI governance maturity at covered organisations. The absence of these records in a financial institution's AI programme is a credible risk indicator. Cross-site coverage of AI insurance market development is maintained at agentinsured.eu.

Frequently asked questions