Allocate responsibility along the AI development chain
Severity MediumDimension: Accountability
Under the Accountability dimension, define the responsibility boundaries of model developers, application integrators and end deployers, reflect them consistently in customer contracts and internal governance documents, and place each risk with the party best placed to control it.
- Applies when
- Chinese companies supplying foundation models, model APIs or AI applications to the Singapore market.
- Evidence to retain
- · AI governance responsibility matrix (RACI)
- · Responsibility allocation clauses in customer contracts
- · AI governance committee charter and meeting minutes
Estimated first-time effort: 4–10 person-days (estimate, not a commitment)
Establish training-data governance and provenance management
Severity HighDimension: Data
Under the Data dimension, govern the source, licensing status, quality and bias risk of training data, and be able to explain how the data was obtained and processed. In the Singapore context this links directly to PDPC’s requirement to document reliance on the Publicly Available Exception.
- Applies when
- Chinese AI companies that train or fine-tune models themselves and deliver them to Singapore customers.
- Evidence to retain
- · Training-data inventory with licensing status
- · Provenance records of source and transformation
- · Data quality and bias assessment report
- · Dataset admission approval records
Estimated first-time effort: 10–25 person-days (estimate, not a commitment)
Run baseline safety evaluations and disclose results downstream
Severity HighDimension: Trusted Development and Deployment
Under the Trusted Development and Deployment dimension, run baseline evaluations of model capabilities, known risks and limitations, and disclose the scope, method and results to downstream integrators and deployers through a model card or equivalent, so they can judge the boundaries of appropriate use.
- Applies when
- Chinese companies distributing model weights, model APIs or embedded AI features into Singapore.
- Evidence to retain
- · Model card or system card covering evaluation method and results
- · Safety evaluation and red-teaming reports
- · List of known limitations and out-of-scope uses
- · Version change and re-evaluation records
Estimated first-time effort: 10–30 person-days (estimate, not a commitment)
Establish detection, reporting and response for AI incidents
Severity HighDimension: Incident Reporting
Under the Incident Reporting dimension, put in place monitoring capable of detecting anomalous model behaviour, misuse and harm events, define internal escalation paths and criteria for external notification, and retain records of how incidents were handled. The mechanism must interlock with the PDPA breach-notification deadline of three calendar days after assessment.
- Applies when
- Chinese companies operating generative AI services in Singapore where harmful outputs or data leakage are possible.
- Evidence to retain
- · AI incident severity criteria and response plan
- · Incident register with closure records
- · Misuse monitoring and content moderation logs
- · Documented interlock with the PDPA breach-notification workflow
Estimated first-time effort: 6–15 person-days (estimate, not a commitment)
Provide provenance signals for generated content
Severity MediumDimension: Content Provenance
Under the Content Provenance dimension, apply labelling, watermarking or metadata so that downstream users and platforms can identify machine-generated content. Where the same product also enters Korea, note that Art. 31 of the Korean AI Framework Act makes labelling of generative output a statutory duty.
- Applies when
- Chinese companies offering text, image, audio or video generation capabilities in Singapore.
- Evidence to retain
- · Technical description of the content-marking scheme
- · Watermark or metadata implementation and robustness test records
- · Screenshots of the user-facing indication
Estimated first-time effort: 8–20 person-days (estimate, not a commitment)
Engage third-party testing and assurance
Severity MediumDimension: Testing and Assurance
Under the Testing and Assurance dimension, supplement self-assessment with independent third-party testing to raise the credibility of external claims. Singapore has built a testing ecosystem around the AI Verify testing framework and toolkit, including tester accreditation, and participation is commonly probed in tenders and large-customer due diligence.
- Applies when
- Chinese AI companies targeting Singapore public procurement or large-enterprise supply chains.
- Evidence to retain
- · Third-party test report with scope statement
- · Remediation closure records for test findings
- · Consistency check between public claims and test conclusions
Estimated first-time effort: 10–30 person-days (estimate, not a commitment)