Singapore-anchored · Cross-border AI Governance

    AI Governance Policies and Evaluations — Singapore Counsel

    Practical AI governance and AI risk counsel — aligned to the IMDA Model AI Governance Framework, AI Verify, MAS FEAT/Veritas, and bridging to the EU AI Act, US NIST AI RMF and ISO/IEC 42001 for cross-border operators.

    IMDA Model Framework-alignedAI Verify-readyMAS FEAT & EU AI Act bridging

    Last updated

    Schedule a Consultation

    What does AI governance compliance involve for a Singapore company?

    In outline: build an inventory of AI use and tier each use case by risk; set board-level governance and a written AI policy aligned to the IMDA Model AI Governance Framework; run impact assessments and AI Verify testing before deployment; follow PDPC guidance where personal data trains GenAI; and, for MAS-regulated financial institutions, apply MAS FEAT and the MAS AI Risk Management Guidelines, effective 7 October 2027.

    Appoint AI Code Counsel

    When AI systems touch personal data, customer decisions, regulated products, or EU users, counsel can help turn governance frameworks into privileged policies, notifications, contracts, inventories, and board reporting.

    Explore AI Code Counsel

    AI governance services: policy writing and evaluations

    Beyond Horizons by Bethel Chambers LLC offers two AI governance services from Singapore. Both are legal and governance work carried out by counsel. Neither is a certification, an accreditation or an audit opinion.

    1. AI governance policy writing

    What it covers: Drafting your company's AI governance policies: an AI use policy for staff, roles and escalation for decisions that involve AI, risk tiering for AI use cases, rules for buying and managing AI vendors, the use of personal data in AI systems, incident response, and reporting to the board. The policies are aligned to the IMDA Model AI Governance Framework, PDPC guidance and, for financial institutions and their suppliers, the MAS Guidelines on Artificial Intelligence Risk Management.

    Who it is for: Companies that use or build AI and have no written AI policy, or whose policy no longer matches how AI is actually used; boards that want a documented oversight framework; and AI vendors whose customers ask to see one.

    What you receive: A written policy set tailored to your organisation, with a short covering note that explains which framework each policy follows and which decisions are left to management or the board.

    2. AI governance evaluations

    What it covers: A legal and governance assessment of how your company already uses AI and the controls around it: your inventory of AI uses, existing policies, contracts with AI vendors, the use of personal data, human oversight and board reporting, reviewed against the IMDA Model AI Governance Framework, PDPC guidance and, where relevant, the MAS Guidelines.

    Who it is for: Companies already using AI that want to know where their governance stands; boards and risk committees; and financial institutions and their AI vendors preparing for the MAS Guidelines.

    What you receive: A findings and recommendations report setting out what we reviewed, the gaps we found and prioritised recommendations.

    What it is not: An AI governance evaluation is a legal and governance assessment. It is not a certification, accreditation, attestation or certified audit, and it is not technical testing of models. Where technical testing would help, we say so.

    To scope AI governance policy writing or an AI governance evaluation, email HL@beyondhorizons.sg. Where AI governance is part of continuing legal support, it can sit within a fractional general counsel retainer. For AI built into robots and autonomous systems, see robot leasing, financing and import/export counsel.

    How We Advise

    AI Governance Programmes

    Board-level AI policies, RACI, AI inventories and risk tiering aligned to the IMDA Model AI Governance Framework and ISO/IEC 42001 — deployable across global operations.

    AI Impact Assessments

    Pre-deployment AI impact assessments covering data, bias, explainability, human oversight, security and downstream user harm — mapped to Singapore, EU and US frameworks.

    AI Risk Mitigation

    Operational controls, model documentation, red-teaming protocols, incident response playbooks, and AI risk dashboards for senior management and audit committees.

    MAS FEAT & Veritas

    Implementation of FEAT principles and Veritas methodologies for AI use cases in banking, asset management, insurance and payments — coordinated with home-jurisdiction regulators.

    Generative AI & Foundation Models

    Acceptable use policies, model and vendor due diligence, training-data lawfulness and AI-Specific Notifications / consent design under PDPC guidance, output IP and confidentiality, and deepfake response plans.

    International frameworks and other markets

    Mapping Singapore programmes to international standards such as ISO/IEC 42001, with foreign counsel advising on the rules of each other market where they apply.

    Recent Developments

    Generative AI Model Governance Framework

    IMDA and the AI Verify Foundation's framework for generative AI sets out nine dimensions — from accountability and data to incident reporting — that Singapore deployers and developers are expected to operationalise.

    MAS Veritas updates

    MAS continues to refine Veritas methodologies for fairness, ethics, accountability and transparency in financial services AI, with expanding industry consortium participation.

    AI Verify Foundation expansion

    AI Verify continues to add testing modules and international interoperability (including alignment with NIST AI RMF and ISO/IEC 42001), strengthening Singapore's position as a global AI assurance hub.

    PDPC GenAI Advisory Guidelines (July 2026)

    PDPC’s Advisory Guidelines on Use of Personal Data in Generative AI clarify when organisations should use AI-Specific Notifications if personal data will train or fine-tune GenAI models. General “product improvement” notices are often not enough where consent is required for model development.

    MinLaw / IPOS AI × Intellectual Property consultation

    MinLaw and IPOS are consulting on AI and intellectual property issues, including training-data / computational data analysis themes and AI-assisted inventorship, with feedback open through 22 October 2026. Outcomes may refine practice, so treat current statutes and the published consultation papers as the source of truth. AI Code Counsel can help map training-data and inventorship risk while the consultation is open; close dates can move.

    MAS AI Risk Management Guidelines (October 2026)

    MAS issued Guidelines on AI Risk Management on 7 October 2026. They take effect on 7 October 2027, with fuller life-cycle controls expected by 7 October 2028. Financial institutions stay accountable for third-party AI.

    What AI vendors should prepare →

    MAS AI Risk Management Guidelines: What AI Vendors Selling to Banks Should Prepare

    On 7 October 2026, the Monetary Authority of Singapore (MAS) issued its Guidelines on Artificial Intelligence (AI) Risk Management. They apply to all MAS-regulated financial institutions (FIs) and to all forms of AI. That covers traditional models, generative AI and, MAS signals, increasingly autonomous “agentic” systems. MAS plans to consult on more agentic AI guidance in 2027.

    Timeline. The Guidelines take effect on 7 October 2027. By then, FIs are expected to have board and senior management oversight in place, an inventory of their AI use, and a way to assess the risk materiality of each use case. By 7 October 2028, they should apply proportionate life-cycle controls, including data governance, testing, human oversight, cybersecurity, monitoring and change management.

    Why this matters if you sell to banks. MAS says FIs “remain accountable for AI used in the services they deliver”, including AI built, operated or provided by third parties. FIs are expected to get enough assurance from providers and check that a tool fits its intended use. If risks cannot be brought within appetite, they should consider limiting, suspending or replacing the service. In practice, we expect that pressure to flow down to fintechs, SaaS platforms and AI vendors through procurement and contract terms.

    Terms banks and insurers are likely to push for (our view, not MAS wording):

    • Disclosure of where AI sits in your product, including embedded third-party models, so the FI can log it in its inventory
    • Documentation on transparency, explainability, training data and known limitations
    • Testing evidence, and the right to commission or receive independent assessments
    • Notice of material model changes, incidents and unexpected behaviour
    • Human-override, contingency and exit or suspension rights, with transition help
    • Audit, information and data-handling rights consistent with existing outsourcing expectations

    What to do now. Map your AI components and your upstream model providers. Prepare an assurance pack that a bank’s risk team can review. Check your standard terms before the first bank redline arrives. Expectations will vary by institution and use case, so treat this as a starting point, not a checklist.

    We can help you review vendor terms, build an assurance pack, or set up an FI-side AI governance programme. Email HL@beyondhorizons.sg.

    This section is general information, not legal advice. Outcomes depend on your facts and on how each institution applies the Guidelines.

    How-to · Compliance Leaders & CTOs

    Singapore AI Governance: A Practical Guide to AI Verify, the IMDA Model Framework & MAS FEAT

    A step-by-step compliance playbook for boards, CTOs, CISOs and General Counsel deploying AI in or from Singapore — aligning the IMDA Model AI Governance Framework, AI Verify testing toolkit, and MAS FEAT principles into a single, documented programme.

    1. 1

      1. Build an AI inventory and tier each use case by risk

      Catalogue every model in production and procurement — including third-party APIs, embedded vendor features and shadow GenAI tools. For each, capture purpose, data inputs, decision impact, human-oversight model and target users. Tier use cases (low / medium / high / unacceptable) using the IMDA Model AI Governance Framework's risk-impact matrix, factoring severity, probability and reversibility. High-tier and customer-facing models drive your AI Verify and MAS FEAT testing scope.

    2. 2

      2. Stand up board-level governance aligned to the IMDA Model Framework

      Adopt a written AI policy, RACI and escalation pathway covering internal governance, human-AI decision-making, operations management and stakeholder communication — the four pillars of the IMDA Model AI Governance Framework. Designate an AI governance owner reporting to the board or risk committee, and align documentation to ISO/IEC 42001 so the same evidence supports cross-border audits.

    3. 3

      3. Run pre-deployment AI impact assessments

      Before any high-tier model goes live, complete a documented AI impact assessment covering lawful basis, dataset provenance, bias and fairness, explainability, robustness, security, human oversight and downstream user harm. Map findings to controls, residual-risk acceptance, and the specific AI Verify testing modules you will run.

    4. 4

      4. Test models with the AI Verify toolkit

      Use the AI Verify open-source testing framework and software toolkit to technically test and process-check AI systems against the eleven internationally recognised AI ethics principles. Run the technical tests (fairness, explainability, robustness, security) for classification and regression models, capture the AI Verify report, and address gaps before launch. Re-run on material model updates and on a defined cadence.

    5. 5

      5. Layer the Generative AI Model Governance Framework for LLM and foundation-model use

      For generative AI, extend governance with the nine dimensions of the IMDA / AI Verify Foundation generative AI framework — accountability, data, trusted development, incident reporting, testing and assurance, security, content provenance, safety and alignment, and AI for public good. Embed acceptable-use policies, prompt and output logging, deepfake response playbooks, and vendor due diligence on foundation-model providers.

    6. 6

      6. Apply MAS FEAT and Veritas for financial-services use cases

      Regulated FIs must overlay the MAS FEAT Principles — Fairness, Ethics, Accountability and Transparency — and use the Veritas Initiative methodologies to evidence them, in addition to MAS Notice 655 expectations on technology risk, outsourcing and model risk. Ensure model risk management, vendor governance and customer-impact assessments are documented to MAS supervisory standards.

    7. 7

      7. Operationalise monitoring, incident response and board reporting

      Deploy ongoing monitoring for model drift, performance, bias and abuse. Define AI incident categories, escalation thresholds and notification timelines (including any cross-border regulator obligations). Equip the board and audit committee with a recurring AI risk dashboard covering inventory, tier mix, AI Verify status, open issues and incidents.

    8. 8

      8. Coordinate foreign-law questions with foreign counsel

      Where EU or other foreign rules may apply, we coordinate with foreign counsel; we advise on Singapore law.

    Beyond Horizons works with boards, CTOs and General Counsel to operationalise this playbook end-to-end — from AI inventory and AI Verify testing through to MAS FEAT, EU AI Act and ISO/IEC 42001 readiness.

    Frequently Asked Questions

    Singapore does not yet have a single 'AI law', but AI deployment is shaped by the PDPA, the Model AI Governance Framework, AI Verify, the Generative AI Model Governance Framework, sector regulators (MAS FEAT/Veritas, MOH HealthAI) and adjacent statutes on cybersecurity, copyright and consumer protection.

    Published by IMDA and PDPC, the Model AI Governance Framework is Singapore's voluntary, sector-agnostic guidance for responsible AI deployment, organised around internal governance, human-AI decision making, operations management and stakeholder communication. The Generative AI companion framework extends it to foundation models.

    AI Verify is Singapore's open-source AI governance testing framework and software toolkit, developed by IMDA and the AI Verify Foundation. It lets organisations technically test and process-check AI systems against international AI principles.

    MAS issued the FEAT Principles (Fairness, Ethics, Accountability, Transparency) and, through the Veritas Initiative, published assessment methodologies. AI in regulated activities must also satisfy MAS Notice 655 on technology risk, outsourcing, and model risk expectations.

    Map AI use cases against risk tiers, deploy a written AI policy aligned to the Model Framework, run pre-deployment impact assessments, document datasets and prompts, embed human-in-the-loop controls, vendor-test against AI Verify, and align contracts to allocate liability and IP. Boards should receive periodic AI risk dashboards.

    Singapore's Copyright Act 2021 introduced a computational data analysis exception. Generative AI use raises issues on training data lawfulness, output IP ownership, deepfakes, and confidentiality — typically addressed through acceptable use policies, vendor terms, and DLP controls.

    Often yes when consent is the basis for using personal data to train or fine-tune a generative AI model — per PDPC’s July 2026 GenAI advisory guidelines. Broad product-improvement wording is frequently treated as insufficient for that purpose. Exceptions and deemed consent can change the analysis. See also our AI Code Counsel FAQs for more detail, or schedule a consultation.

    PDPC does not mandate one format. Meaningful notice can sit in privacy policies, terms, in-app copy, or layered pages — as long as people can understand AI/GenAI model development uses and how to decline or withdraw consent where consent applies. We help clients design practical wording; we do not rubber-stamp engineering choices without a use-case review.

    Focus on how computational data analysis exceptions interact with lawful-access and contract limits for training data, and how inventorship is framed for AI-assisted inventions. The consultation is open through 22 October 2026; do not assume the law will stay static afterward. See our AI Code Counsel page for appoint-counsel detail, or schedule a consultation.

    Current framing generally centres inventorship on natural persons. Confirm Patents Act practice and watch MinLaw/IPOS consultation outcomes after 22 October 2026. General information only — not a filing opinion.

    Toolkits and principles are public; counsel helps turn outputs into policies, board reporting, vendor clauses, and regulated-sector alignment under privilege. Beyond Horizons by Bethel Chambers LLC. Soft next step: schedule a consultation, or instruct via AI Code Counsel: https://beyondhorizons.sg/industry/ai-code-counsel

    SG-anchored groups often face parallel Singapore expectations and extraterritorial regimes (for example EU AI Act exposure where systems affect the EU). Map use cases early; do not assume “Singapore-only” is enough. Beyond Horizons by Bethel Chambers LLC. Soft next step: schedule a consultation.

    When you are ready to appoint counsel for GenAI notifications, governance programmes, or EU readiness — not only educational reading. Soft CTA: https://beyondhorizons.sg/industry/ai-code-counsel · Hui Ling Teo: https://beyondhorizons.sg/team/hui-ling-teo · Beyond Horizons by Bethel Chambers LLC.

    All financial institutions regulated by MAS, and all forms of AI they use, including AI developed or provided by third parties. MAS expects each FI to apply the Guidelines in proportion to the nature and scale of its AI use and the risk materiality involved.

    They take effect on 7 October 2027. FIs should meet the governance, inventory and risk-assessment expectations from that date, and the fuller life-cycle controls, such as testing and monitoring, by 7 October 2028.

    The Guidelines are addressed to FIs, not vendors. But MAS says FIs remain accountable for third-party AI and should obtain sufficient assurance from providers. Vendors selling into banks and insurers should therefore expect more due diligence and tighter contract terms.

    Requirements will vary by institution and use case. Likely asks include disclosure of AI components, documentation and testing evidence, notice of material model changes and incidents, audit and information rights, and contingency, suspension or exit rights. It is sensible to review your standard terms early.

    MAS says the Guidelines apply to all forms of AI. FIs should review their controls as agentic systems that act autonomously and use tools become more common. MAS intends to consult the industry in 2027 on whether more agentic AI guidance is needed.

    Usually two things. The first is writing the company's AI governance policies: how staff may use AI, who decides on higher-risk uses, how AI vendors are chosen and managed, how personal data is handled in AI systems, and what is reported to the board. The second is evaluating how the company already uses AI and the controls around it, and recommending what to fix. At Beyond Horizons by Bethel Chambers LLC, both are done by counsel, and the client receives a written policy set or a findings and recommendations report.

    No. Our AI governance evaluation is a legal and governance assessment of your AI use, policies, contracts and controls. It is not a certification, accreditation, attestation or certified audit, and it does not test the technical performance of AI models. The output is a findings and recommendations report for management and the board.

    The IMDA Model AI Governance Framework starts with internal governance structures and measures: clear roles and responsibilities for AI, with risk management and internal controls. In practice, board reporting usually covers the inventory of AI uses and their risk tiers, material incidents, key AI vendors and the status of open actions. For financial institutions, the MAS Guidelines on Artificial Intelligence Risk Management, which take effect on 7 October 2027, set out MAS's supervisory expectations for financial institutions managing the risks that arise from their use of AI.

    The IMDA Model AI Governance Framework is voluntary. However, the Personal Data Protection Act applies whenever personal data is collected or used to develop, test or run AI systems, as PDPC's Advisory Guidelines on the use of personal data in AI systems explain, and the MAS Guidelines on Artificial Intelligence Risk Management apply to all financial institutions from 7 October 2027. A written policy is usually worth having where AI informs decisions about customers or staff, uses personal data, or is sold to regulated customers.

    No. Beyond Horizons by Bethel Chambers LLC is a law practice, not a software vendor, and we do not run tools that check AI outputs against approved policies or source materials. We can review the governance and contracts around such tools: what the vendor commits to, how people check outputs, and who is accountable when an output is wrong. For technical testing, Singapore's AI Verify Foundation publishes the AI Verify Testing Framework and an open-source testing toolkit.

    Related Insights — AI Governance & Risk

    All insights

    Related Legal Services

    AI Code Counsel

    Schedule an AI Governance Consultation

    We write AI governance policies and carry out AI governance evaluations for companies in Singapore, aligned to the IMDA Model AI Governance Framework, PDPC guidance and the MAS Guidelines, and we coordinate with foreign counsel where other countries' rules apply. To scope either service, email HL@beyondhorizons.sg.

    Book a Consultation Explore AI Code Counsel