Understanding IMDA's Model AI Governance Framework
Abstract
In January 2026, the Infocomm Media Development Authority (IMDA) published an update to Singapore's Model AI Governance Framework, extending its scope to address agentic AI systems — AI that operates with a degree of autonomy to plan and execute multi-step tasks. The Framework provides a structure for responsible AI deployment but does not prescribe how organisations should implement its requirements internally. This guide is produced by Data Bureau (Singapore) to assist Singapore businesses in understanding what the Framework requires and what practical steps are needed to meet those requirements.
Disclaimer
This document is produced by Data Bureau (Singapore) Pte. Ltd. for general informational purposes. It is not legal advice and does not constitute regulatory guidance issued by IMDA or any government body. Readers should refer to IMDA's published Framework directly and seek independent professional advice where required. Data Bureau (Singapore) Pte. Ltd. is an independent certification body. It is not a government agency, statutory board, or regulatory authority, and is not affiliated with IMDA.
What the Framework Is
IMDA's Model AI Governance Framework was first published in 2019 and has been updated progressively as AI technology has evolved. The January 2026 update addresses agentic AI — systems that operate beyond single-turn interactions to autonomously plan, make decisions, and execute sequences of actions, often with access to tools, data, and external services.
The Framework is a voluntary guidance document. It is not legislation and does not impose legal obligations on Singapore businesses. However, it represents IMDA's considered position on responsible AI deployment and is widely referenced by procurement bodies, enterprise buyers, and institutional partners when evaluating an organisation's AI governance posture.
Organisations that can demonstrate alignment with the Framework's principles are better positioned in commercial relationships, enterprise procurement, and regulatory engagement — not because alignment is legally required, but because it signals that AI systems have been deployed with structured accountability.
Who It Applies To
The Framework is directed at organisations that develop, deploy, or procure AI systems in Singapore. The January 2026 agentic AI update is specifically relevant to organisations that:
- Deploy AI systems that operate with autonomy — including chatbots with tool access, automated workflow agents, and AI-driven decision systems;
- Use AI systems that interact with external services, databases, or platforms on behalf of the organisation or its customers;
- Procure AI-powered software from third-party vendors where the AI component makes or influences decisions affecting customers or operations;
- Operate in regulated sectors — financial services, healthcare, education, and professional services — where AI governance is increasingly a procurement and compliance consideration.
Organisations that do not currently deploy AI but intend to do so should use the Framework as a pre-deployment governance checklist.
What the Framework Requires
The Framework organises its requirements around four governance domains. The following is a factual summary drawn directly from IMDA's published document.
a. Internal Governance Structures
Organisations are expected to establish clear accountability for AI systems. This includes designating responsibility for each AI system in use, maintaining an inventory of deployed AI systems, and ensuring that senior leadership is aware of and accountable for the organisation's AI deployment posture.
b. Determining the Level of Human Involvement
For agentic AI systems, the Framework requires organisations to define explicitly how much autonomy an AI system is permitted to exercise. Where AI makes or influences decisions affecting individuals — customers, employees, or the public — human review mechanisms must be in place. The degree of human involvement must be proportionate to the risk of the decision.
c. Operations Management
Organisations must implement processes to monitor AI system performance on an ongoing basis. This includes logging AI decisions or outputs for audit purposes, establishing mechanisms to detect and respond to anomalous AI behaviour, and maintaining documentation sufficient to explain AI system outputs when queried by customers, counterparties, or regulators.
d. Stakeholder Interaction
Where AI systems interact with external stakeholders — customers, partners, or the public — organisations are expected to be transparent about the role of AI in those interactions. Customers should be able to identify when they are interacting with an AI system and understand the basis on which AI-influenced decisions affecting them have been made.
Where Most Organisations Currently Fall Short
Based on the structure of the Framework and the governance expectations it sets out, the following are common implementation gaps observed across organisations deploying AI in Singapore. These are structural observations and do not represent findings about any specific organisation.
- No formal AI inventory. Many organisations use AI-powered tools — in customer service, document processing, or marketing — without maintaining a structured record of what systems are in use, who is accountable for them, and what data they access.
- Undefined autonomy boundaries. Organisations deploy agentic AI without a documented policy on what actions the system is permitted to take without human review. This creates accountability gaps when the system produces an unexpected output.
- No audit trail for AI outputs. Where AI influences a decision affecting a customer or counterparty, organisations frequently lack the logging infrastructure to reconstruct why a particular output was produced.
- Undocumented human oversight mechanisms. Organisations assert that human oversight exists but have not formalised the process — who reviews AI outputs, at what frequency, under what criteria, and what happens when an output is escalated.
- No incident response plan for AI failures. Organisations have IT incident response plans but these do not address AI-specific failure modes, including model drift, biased outputs, or agentic AI acting outside its intended scope.
A Structured Implementation Checklist
The following checklist is designed for use by Singapore organisations as a starting point for internal governance review. It is not an exhaustive compliance framework and does not constitute a formal assessment.
Internal Governance
- Maintain a written inventory of all AI systems in active use, including their function, the data they access, and the decisions they influence.
- Assign named accountability for each AI system at a senior level.
- Brief leadership on the organisation's AI deployment posture at least annually.
Autonomy & Human Oversight
- Document the permitted scope of autonomy for each agentic AI system.
- Define the conditions under which AI outputs must be reviewed by a human before action is taken.
- Establish an escalation path for AI outputs that fall outside expected parameters.
Operations & Monitoring
- Implement logging of AI system outputs sufficient to support audit and reconstruction.
- Establish a process for ongoing monitoring of AI system performance against defined benchmarks.
- Review AI system performance at defined intervals — quarterly at minimum for high-risk applications.
Transparency & Stakeholder Communication
- Where AI interacts with customers, implement a disclosure that clearly identifies the AI's role.
- Ensure customers can request human review of AI-influenced decisions affecting them.
- Maintain documentation sufficient to explain AI outputs to a regulator or counterparty on request.
Incident Preparedness
- Develop an AI-specific incident response plan covering model failure, biased outputs, and out-of-scope agentic behaviour.
- Test the incident response plan at least annually.
- Document and review all AI-related incidents, including near-misses.
Data Bureau (Singapore)'s AGC-02 Certificate of AI Governance and AAC-03 Certificate of Agentic AI Compliance are designed in alignment with Singapore's AI governance framework. Organisations seeking a structured, independently assessed certification pathway may enquire through databureau.com.sg.