Introduction: Global AI Governance Enters "Singapore Time"

On the fast track of artificial intelligence technological iteration, Singapore has consistently maintained keen institutional awareness. Since the release of the world's first Model AI Governance Framework in 2019, Singapore has established its unique position in global technology governance. Entering 2026, as AI applications evolved from decision-support tools to autonomous agents, the Infocomm Media Development Authority (IMDA) of Singapore formally implemented the AI Governance and Testing Framework 2026 in January 2026, marking Singapore's official transition from the earlier "principle-oriented" approach to a new governance stage that places equal emphasis on "technical standards and mandatory assessments."

I. Evolution of the Governance Paradigm: From Principle-Based Guidance to Mandatory Standards

The evolution of Singapore's AI governance has always followed the core logic of "technology development first, governance rules follow, and standards gradually tighten." From 2019 to 2025, the approach was primarily principle-based guidance, focusing on guiding enterprises to establish compliance awareness and encouraging industry self-regulation. However, the implementation of the AI Governance and Testing Framework 2026 fundamentally reversed this pattern, making "trustworthiness assessment" a prerequisite for AI commercial deployment and establishing a closed-loop governance system of "principles + standards + testing + accountability," marking Singapore's AI governance's entry into a new phase of refinement and mandatory enforcement.

(1) Mandatory Assessment Requirements for Large Model Deployment

With the maturation of large model technologies, their applications in critical industries such as finance, healthcare, government affairs, and transportation have become increasingly widespread. The stability, fairness, and security of large model algorithms directly bear upon public interests and social order. To this end, Singapore's 2026 AI governance framework explicitly proposed, for the first time, a risk-tiered control and mandatory safety assessment mechanism, classifying AI systems into three categories—high-risk, medium-risk, and low-risk—according to application scenario risk levels, with differentiated governance applied accordingly. Among these, high-risk AI systems were required to pass mandatory official certification assessments before commercial deployment.

From the perspective of risk classification standards, high-risk AI systems specifically referred to AI applications deployed in critical industries that directly affected public rights and social security, covering four core domains: first, the financial infrastructure sector, including bank credit assessment, payment and settlement risk control, insurance underwriting and claims, and securities trading algorithms; second, the healthcare sector, including AI-assisted diagnosis, intelligent medical imaging analysis, precision medicine recommendation, and medical robot control algorithms; third, the government digital services sector, including automated government approval, intelligent public service recommendation, livelihood security resource allocation, and citizen identity verification systems; and fourth, the public security sector, including intelligent security surveillance, public transportation scheduling, and emergency management decision support. Medium-risk AI systems were primarily oriented toward commercial applications in non-critical industries, such as e-commerce recommendation algorithms, marketing content generation, and office automation tools. Low-risk AI systems were ordinary consumer-grade applications, such as entertainment AI tools and simple chatbots.

For high-risk AI systems, Singapore imposed stringent mandatory safety assessment requirements—compliance could not be achieved through enterprise self-declaration alone. Instead, enterprises were required to use the official technical toolkits provided by the Singapore government-backed AI Verify Foundation to complete full-process testing across four dimensions: algorithmic robustness, fairness, transparency, and security. Only after passing the tests and obtaining certification could the systems be formally deployed and operated. The AI Verify Foundation, as Singapore's officially designated AI testing and certification body, was established in 2022 and jointly founded by IMDA in collaboration with top universities such as the National University of Singapore and Nanyang Technological University, as well as leading industry enterprises. Its core responsibilities included formulating AI testing standards, developing testing tools, and conducting compliance certifications. The testing reports issued by the Foundation carried legal effect within Singapore and constituted mandatory documentation for high-risk AI system market access.

Specifically, the mandatory safety assessment comprised four core modules: first, algorithmic robustness testing, which focused on verifying the stability and fault tolerance of large models under conditions of data loss, data contamination, malicious attacks, and extreme scenarios, preventing systemic risks caused by algorithm failure; second, algorithmic fairness testing, which screened for bias and discrimination across dimensions such as gender, race, age, region, and income, ensuring that AI decisions did not harm the legitimate rights and interests of specific groups, with particular prohibition of discriminatory determinations by AI algorithms in the finance, healthcare, and government sectors; third, algorithmic transparency testing, which required that large models possess the ability for decision-making logic traceability, core parameter explainability, and operational process reconstructability, eliminating "black-box algorithms" and safeguarding the right to information of regulatory authorities and the public; and fourth, data security testing, which verified the compliance of the entire process of collection, storage, processing, and transmission of AI training data and operational data, preventing data leakage, misuse, and tampering, and ensuring data security and privacy protection.

For Chinese-invested enterprises establishing a presence in the Singapore market, this requirement meant significantly increased compliance costs and comprehensively elevated technical standards. Chinese-invested AI enterprises not only needed to benchmark against Singapore's testing standards during the algorithm research and development phase, optimizing model architecture, eliminating algorithmic bias, and strengthening security protections in advance, but also needed to dedicate specialized resources to interface with the AI Verify Foundation to complete the full-process testing and certification. Particularly for Chinese-invested enterprises in the finance, healthcare, and government sectors, algorithm models were required to possess quantifiable safety indicators, clear decision-making logic, and complete testing reports, and data processing workflows were required to strictly conform to the substantive requirements of the framework; otherwise, they faced the risk of non-implementation, project suspension, or even administrative penalties. Furthermore, Singapore required that high-risk AI systems undergo reassessment upon subsequent iterative upgrades, model fine-tuning, and data updates, ensuring full-life-cycle compliance and further reinforcing enterprises' ongoing compliance obligations.

(2) Liability System and Reporting Obligations for Generative AI

Since 2025, the rapid proliferation of generative AI has become a defining feature of the global AI industry. The widespread application of large models such as ChatGPT, ERNIE Bot, and Tongyi Qianwen, while empowering industrial upgrading and enhancing production efficiency, also brought a series of novel risks, including deepfake technology abuse, disinformation dissemination, content infringement, public opinion manipulation, and malicious inducement. Generative AI outputs such as deepfake videos, fake news, forged documents, and malicious content could easily trigger social panic, undermine public order, harm individual rights, and even threaten national information security. In response to this serious challenge, Singapore took the lead by amending specialized laws to establish a liability system and risk reporting mechanism covering the entire chain of generative AI, becoming one of the first countries in the world to implement systematic and robust regulation of generative AI.

In March 2026, the Singapore government formally amended the implementing rules of the Info-communications Media Act, adding specialized regulatory provisions for generative AI, clarifying the core responsibilities of generative AI platform providers, risk reporting obligations, and penalty standards for violations, thereby filling the legal vacuum in generative AI regulation. The new rules applied to all platform providers offering generative AI services within Singapore's territory. Regardless of whether an enterprise was registered in Singapore, as long as its generative AI products provided services to Singaporean users or produced effects within Singapore, it was required to comply with the regulations, achieving dual coverage of territorial jurisdiction and effects jurisdiction and avoiding regulatory loopholes.

The core content of the new regulations focused on three dimensions: traceable liability, mandatory risk reporting, and strict content control.

The traceable liability mechanism required all generative AI platforms to embed unique traceability identifiers at the technical design level. All AI-generated content (including text, images, audio, video, code, etc.) was required to carry non-tamperable traceability information, clearly marking key details such as the generating entity, generation time, algorithm version, and training data sources, ensuring that any non-compliant content could be quickly traced to the responsible party. At the same time, platforms were required to establish comprehensive content generation logs and user behavior logs, with log retention periods of no less than two years, for regulatory authority verification and dispute tracing.

The risk reporting obligation stipulated that when generative AI algorithm outputs might significantly impact social order, public security, or public rights and interests (including but not limited to incitement to illegal or criminal activities, dissemination of major disinformation, creation of deepfake or rumor-mongering content, disclosure of state secrets, inducement of minors toward improper behavior, and large-scale infringement of personal privacy, among others), platform providers were required to fulfill immediate risk reporting obligations. Reports were required to be submitted to IMDA through officially designated channels within 24 hours of risk discovery, with content including risk details, scope of impact, remedial measures, and rectification plans, ensuring that regulatory authorities could intervene and respond swiftly to contain risk proliferation. Platforms that failed to fulfill reporting obligations, delayed reporting, or concealed risks faced substantial fines, service restrictions, or even revocation of operating licenses.

Content compliance control required generative AI platforms to establish full-process content control mechanisms encompassing pre-publication review, in-process monitoring, and post-event disposition. Platforms were required to explicitly prohibit the generation of illegal, non-compliant, infringing, or harmful content, regularly update content compliance databases, and optimize algorithmic filtering capabilities. At the same time, platforms were required to clearly disclose to users the technical limitations of generative AI and the risks regarding content authenticity, and were prohibited from engaging in false advertising or misleading users, ensuring users' rights to information and freedom of choice.

For Chinese-invested generative AI enterprises expanding into Singapore, the new regulations meant significantly higher compliance thresholds and substantially greater operational responsibilities. Enterprises needed to embed traceability technology at the product research and development stage, build content review and risk monitoring systems that met Singapore's requirements, and establish 24-hour emergency response mechanisms to ensure timely identification, handling, and reporting of major risks. At the same time, enterprises needed to review and establish compliance lists for generated content, strictly avoid generating non-compliant content, and retain complete logs for regulatory inspection. In addition, Singapore imposed severe penalties for violations, with fines up to millions of Singapore dollars and potential global business restrictions. This required Chinese-invested enterprises to place generative AI compliance at the strategic level to avoid significant losses due to compliance oversights.

II. Boundaries of Governance: Compliance Synergy Between Data Sovereignty and Cross-Border Flows

Data is a core factor of production for artificial intelligence. AI model training, algorithmic optimization, and scenario applications all rely heavily on massive high-quality data. Data security, data sovereignty, and cross-border data flows have therefore become central issues in global AI governance. As a highly open digital economy, Singapore deeply understands the importance of free data flows to digital economic development and AI technological innovation, while also clearly recognizing the critical significance of data sovereignty and data security to national security and the public interest. To this end, Singapore has constructed a data governance system of "open flows + security controls + sovereignty protection," balancing the convenience of cross-border data flows with the security of data sovereignty through flexible legislation, building a "security moat" for the AI industry's development.

(1) The "Digital Trade" Legal Cornerstone for Cross-Border Data

As an important participant in global digital trade, Singapore has consistently and actively promoted the free flow of cross-border data, relying on international agreements and domestic legislation to build a cross-border data flow rule system adapted to digital economic development. Among these, the Digital Economy Partnership Agreement (DEPA) and the Personal Data Protection Act (PDPA) constituted the core legal cornerstones, jointly supporting Singapore's overall framework for cross-border data compliance.

The Digital Economy Partnership Agreement (DEPA), signed in 2020, is the world's first dedicated multilateral agreement focusing on the digital economy. As a founding member, Singapore has continued to promote updates and improvements to the agreement. The 2026 version of DEPA further refined rules in areas including cross-border data flows, data localization, digital identity, artificial intelligence, and data innovation, providing member state enterprises with unified, transparent, and predictable cross-border data compliance standards. The core principles of DEPA are the prohibition of data localization requirements, the guarantee of free cross-border data flows, the protection of personal data privacy, and the promotion of innovative data applications. It explicitly stipulates that member states shall not mandate that enterprises store data locally and shall not unreasonably restrict lawful cross-border data flows, facilitating AI enterprises' cross-border acquisition of training data and multinational operations.

Within the DEPA framework, Singapore's domestic legislation centers on the Personal Data Protection Act (PDPA), which regulates the entire process of collecting, using, storing, processing, and cross-border transferring personal data, balancing the relationship between personal privacy protection and commercial data use. The PDPA came into effect in 2012 and underwent major revisions in 2020 and 2025. The 2025 revision added dedicated provisions on AI data processing, clarifying compliance requirements for the use of personal data in AI training, algorithmic optimization, and intelligent applications, effectively linking with Singapore's 2026 AI governance framework and serving as the core domestic legal basis for AI data compliance.

For Chinese-invested enterprises conducting AI business and cross-border data flows in Singapore, strict compliance with both PDPA and DEPA requirements was mandatory. On the one hand, enterprises needed to optimize data collection processes, design user authorization agreements that met Singapore's requirements, clearly disclose AI data usage purposes, and obtain users' explicit consent. On the other hand, they needed to establish professional data desensitization and anonymization teams, improve data processing workflows, and ensure the compliance of AI training data. At the same time, before cross-border data transmission, enterprises were required to assess the data protection levels of receiving countries, build secure cross-border data channels, and retain complete compliance records. It was particularly noteworthy that the PDPA imposed severe penalties for violations, with fines up to 10% of global turnover. Chinese-invested enterprises needed to maintain a high level of vigilance regarding data compliance risks to avoid significant losses due to procedural oversights.

(2) Localization Requirements for Critical Information Infrastructure

Although Singapore generally supports the free flow of cross-border data and adheres to an "openness first" data governance philosophy, for data related to Critical Information Infrastructure (CII) that implicates national security, public safety, and social stability, Singapore has always upheld the bottom line of data sovereignty, implementing strict localization controls and security audit requirements. These requirements were further reinforced in the updated Cybersecurity Act 2026.

Singapore's Cybersecurity Act was originally promulgated in 2018 to safeguard national CII security, prevent cybersecurity risks, and protect national security and the public interest. It underwent a major revision in 2025, with the revised version formally taking effect in 2026, adding provisions on AI critical data control, special cross-border transfer audits, and data storage filing, deeply integrating with the AI governance framework and becoming the core legal basis for CII data compliance.

The Act explicitly defines the scope of CII, covering critical systems and data in eight core sectors: energy, transportation, water, finance, healthcare, government affairs, communications, and public security. AI systems in these sectors are directly related to the normal functioning of the state and the basic livelihood of the public, making data security of paramount importance.

For Chinese-invested enterprises undertaking Singapore government or public utility AI projects or establishing a presence in critical sectors, this requirement constituted a mandatory red line that must be observed. Enterprises needed to plan data storage architectures in advance, deploy core data locally, and complete CSA filing. Before processing CII-related data, they were required to coordinate with the CSA to complete security audits. If cross-border transmission of core data was truly necessary, enterprises were required to strictly follow the approval process and eliminate any non-compliant transmission activities. At the same time, enterprises needed to build professional cybersecurity teams, improve data security protection systems, conduct regular security drills, and prevent data leakage, tampering, and loss. Violations of the Act could result in project termination, substantial fines, and prohibition from entering Singapore's critical sector markets, severely affecting enterprises' strategic positioning in Singapore and the broader Southeast Asian market.

III. Industry-Specific Vertical Governance: The "Pass" for AI Market Access

As AI technology deeply penetrates various industries, the risk characteristics and compliance requirements of different sectors vary significantly, making generic governance rules inadequate for addressing industry-specific needs. To this end, Singapore's 2026 AI governance system further deepened industry-specific vertical governance, focusing on three core sectors—finance, digital healthcare, and government affairs—by issuing specialized governance guidelines, refining AI market access standards, and forming a tiered governance model of "general framework + industry-specific rules." This provided precise guidance for industry AI compliance and established clear industry access "passes" for enterprises.

(1) Regulatory Standards for Financial AI Governance

The financial industry is one of the earliest and most extensive adopters of AI technology. The large-scale application of AI in credit assessment, risk management, investment decision-making, customer service, and anti-fraud has improved financial service efficiency and reduced operating costs, but has also introduced risks such as algorithmic bias, decision-making black boxes, systemic risks, and data leaks, directly affecting financial stability and consumer rights. As a global financial center, Singapore has always maintained the highest standards for financial AI governance. In February 2026, the Monetary Authority of Singapore (MAS) formally issued the Financial AI Governance Guidelines 2026 (FEAT 2.0), a comprehensive upgrade from the 2021 FEAT 1.0, establishing one of the most stringent and practical AI regulatory frameworks in the global financial sector, drawing clear boundaries for financial AI compliance.

FEAT 2.0 was built on four core principles—Fairness, Ethics, Accountability, and Transparency—and focused on full-life-cycle management of financial AI, covering algorithm research and development, model training, testing and validation, deployment and application, iterative optimization, and risk disposition. It clarified the core responsibilities and compliance requirements of financial institutions in AI applications. The key highlights included enhanced algorithmic explainability, strict control of algorithmic bias, strengthened primary responsibilities of institutions, and refined risk control measures.

For Chinese fintech enterprises and financial institutions expanding into Singapore, FEAT 2.0 meant significantly elevated compliance standards and severe tests of technical capabilities. Enterprises needed to align with the guidelines' requirements, reconstruct financial AI algorithm architectures, abandon complex and unexplainable black-box models, and prioritize algorithms with clear logic and strong explainability. They needed to establish professional algorithmic fairness testing teams to eliminate algorithmic bias and build full-process risk control systems, improving record-keeping and contingency plans. It was particularly noteworthy that MAS exercised extremely strict supervision over financial AI compliance, conducting regular on-site inspections, algorithm spot checks, and data audits, with severe penalties for compliance loopholes once discovered. Chinese fintech enterprises needed to plan compliance layouts in advance, allocate sufficient resources to adapt to Singapore's regulatory requirements, obtain the "pass" for financial AI market access, and avoid missing opportunities in the Singapore financial market due to compliance issues.

(2) Access Standards for Government Digital Transformation

Singapore has long been committed to government digital transformation, building an efficient, transparent, and citizen-friendly digital government. As a core driving force, AI technology is widely applied in government approval, public services, livelihood security, urban governance, and emergency management. The security, trustworthiness, and compliance of government AI projects directly affect the public interest and government credibility. To this end, Singapore formally implemented the Public Sector Digital Transformation Guide 2026, fully integrating AI governance requirements into the entire process of government digital transformation, clarifying market access standards for government AI projects, and creating substantial competitive barriers. This also set clear thresholds for Chinese-invested enterprises seeking to undertake Singapore government AI projects.

The Public Sector Digital Transformation Guide 2026 was led by the Government Technology Agency of Singapore (GovTech), in collaboration with IMDA, CSA, MAS, and other departments. Its core objectives were to ensure the security and trustworthiness of government AI systems, improve public service efficiency, prevent algorithmic risks, and standardize procurement processes. The Guide covered the entire life cycle of government AI projects, including demand formulation, supplier selection, algorithm development, testing and certification, deployment and launch, operation and maintenance, iterative upgrades, and retirement and decommissioning. The most critical provision was that government projects, when selecting AI suppliers, made "whether the enterprise had passed the AI Verify testing" a mandatory condition. Enterprises that had not obtained AI Verify Foundation certification were not eligible to participate in Singapore government AI project bidding, directly linking technical capability with administrative market access and establishing strict access barriers.

For Chinese-invested enterprises seeking to undertake Singapore government AI projects, the access standards set forth in the Guide represented both challenges and opportunities. The challenges lay in the extremely high access thresholds—enterprises not only needed to pass the stringent AI Verify testing but also needed to meet multi-dimensional requirements regarding qualifications, technology, services, and intellectual property, with significantly increased compliance costs and technical investments. The opportunities lay in that once certified and granted access, enterprises would gain priority cooperation rights for Singapore government projects. The Singapore government digital market is large in scale and highly stable, providing enterprises with sustained and stable business returns, while also leveraging government project endorsements to enhance their brand influence and competitiveness in Southeast Asia and global markets.

IV. Practice-Oriented Guidance: Compliance Navigation for Chinese-Invested Enterprises Establishing AI Operations in Singapore

For Chinese-invested enterprises hoping to use Singapore as a springboard for global expansion, we have identified the following four key compliance dimensions:

(1) Compliance Front-Loading and AI Audit Mechanisms

Enterprises should conduct pre-assessments against the AI Governance and Testing Framework 2026 at the early stages of the product development cycle. By establishing internal AI audit documentation systems that meet the framework's requirements, enterprises can ensure that algorithmic models comply with the requirements of fairness, transparency, and security, reducing the risk of administrative violations after project launch.

(2) Intellectual Property and Algorithm Rights

Singapore's Copyright Act (2021 revision and the 2026 practical guidelines on data mining) provides legal interpretations for the fair use of AI training data. Enterprises should make good use of the law's exemption provisions for data mining, but must retain complete provenance records of training data sets during execution to address potential intellectual property litigation risks.

(3) Dispute Resolution and Legal Forecasting

In disputes involving high-value algorithms, the Singapore International Commercial Court (SICC) is already capable of hearing disputes involving complex AI technical details. It is recommended that enterprises, when signing strategic cooperation agreements, give priority to agreeing on jurisdiction within the Singapore judicial territory. As a common law jurisdiction, SICC precedents will provide clear adjudicatory benchmarks for Chinese enterprises in complex AI legal disputes.

V. Conclusion: Pursuing Global Expansion with Certainty

The competition in AI governance is essentially a contest over rule-making discourse power. The reason why Singapore has been able to become a "safe harbor" for global AI innovation does not lie in its regulatory leniency, but in the certainty of its regulatory standards.

For Chinese-invested enterprises, Singapore offers a kind of "fair competition under transparent rules." Here, policy issuance dates are clear, and legal name systems are complete. By benchmarking against the series of regulations issued in 2026, enterprises can not only obtain tickets to the global market but also enhance their products' international competitiveness through high-standard compliance refinement.

Against the backdrop of dynamically adjusting global digital governance, choosing Singapore as a testing ground for AI compliance is both a rational strategy for avoiding operational risks and a strategic choice for positioning within the global industrial chain.