New Generative AI Governance Framework in Singapore

This is a significant development and Singapore’s first governance framework addressing generative artificial intelligence. The Framework adds to the series of guidance on AI already issued by various regulatory bodies in Singapore, all of which aim to provide a systematic and balanced approach to address AI concerns while continuing to facilitate innovation.

The Framework is non-binding. However, given the prevalence and accompanying risks of AI, companies and businesses seeking to deploy or develop AI solutions in Singapore are strongly encouraged to refer to the Framework, together with the other existing guidance.

Key highlights of the Framework are set out below.

1. Accountability
   The Framework emphasises the importance of allocating responsibility during the AI development process and providing guidance on addressing issues that may arise. It advises businesses to draw parallels from the cloud and software development stacks of today, where various players across the tech stack can take initial practical steps – including designing a shared responsibility model that considers the level of control each stakeholder has and updating legal frameworks to provide flexibility in addressing risks specific to AI.
   
   
2. Data
   
   The Framework emphasizes the significance of the data fed into AI models as a crucial aspect of their development, stressing the importance of using high-quality data from trusted sources and acknowledges the potential contentiousness when using certain types of data, such as personal data and copyrighted material. The Framework highlights the necessity of complying with existing personal data laws and suggests implementing privacy-enhancing technologies that enable the use of data in AI model development while safeguarding data confidentiality and privacy.
   
   
3. Trusted Development and Deployment
   
   Ensuring safer model use for all stakeholders requires meaningful transparency regarding baseline safety and hygiene measures, despite the limited visibility that end-users may possess. The Framework promotes the adoption of best practices throughout the development process, including the utilisation of reinforcement learning from human feedback to guide models in generating results aligned with human preferences and values. Furthermore, it advocates for the implementation of "food label"-type transparency and standardized disclosure over time, facilitating comparability across different models.
   
   
4. Incident Reporting
   
   To ensure prompt remediation of incidents and drive continuous improvement in AI systems, the Framework proposes the establishment of regulatory notification structures and practices. This approach aims to facilitate timely identification and resolution of issues. One example highlighted is the adoption of the incident reporting system outlined in the EU AI Act, which implements proportionate reporting requirements. By implementing such structures and practices, it helps fostering accountability and enhancing the overall safety and performance of AI systems.
   
   
5. Testing and Assurance
   
   At the core of building a trusted ecosystem, the Framework emphasizes the importance of third-party testing and assurance. It encourages the establishment of common and consistent standards for AI, which ultimately foster trust among end-users. Drawing inspiration from practices already implemented in the finance and healthcare sectors, such as independent verification processes and audit practices, businesses can adopt similar approaches in the emerging field of AI.
   
   
6. Security
   
   When it comes to generative AI, new threat vectors against the models themselves arise, necessitating the design of a robust security framework. The Framework recommends distinguishing between traditional software security concerns and the unique risks posed to AI models. To address these novel risks, existing frameworks for information security must be adapted, and new testing tools should be developed. For instance, businesses can implement input filters capable of detecting unsafe prompts, while also creating AI-focused digital forensics tools to investigate and analyse digital data.
   
   
7. Content Provenance
   
   The emergence of generative AI has created challenges for consumers in differentiating between AI-generated and original content, leading to an increased risk of misinformation and fraud. In response to this concern, the Framework strongly advocates for the adoption of technical solutions that can effectively flag content created or modified by AI. Promising examples of such solutions include digital watermarking and cryptographic provenance. These methods can help establish a verifiable trail of the content's origin and provide transparency to users, enabling them to make informed judgments about the authenticity and reliability of the information they encounter.
   
   
8. Safety and Alignment Research & Development (R&D)
   
   To keep pace with advancement in AI model capabilities, the Framework advocates for increased R&D investment to ensure that human capacity to align and control generative AI keeps pace with potential risks. For example, R&D in model should be accelerated to improve model alignment with human intention and values.
   
   
9. AI for Public Good
   
   The Framework recognizes the transformative potential of AI. In order to reap the benefits of AI, the Framework highlights the importance of democratizing AI access, improving public sector adoption, as well as upskilling labour and developing systems sustainably, steering AI towards outcomes for the public good.

The Framework is an important step towards building a trusted ecosystem for generative AI, which is developing rapidly and should be read together with existing guidelines on AI which have already been issued in Singapore. The links to these are set out below:

• The Model AI Governance Framework (issued by the IMDA and the Personal Data Protection Commission (“PDPC”) in 2019 and updated in 2020) providing guidance to organizations deploying conventional AI technologies at scale, accessible here, which is complemented by:
  • the Implementation and Self-Assessment Guide for Organizations (published in January 2020), accessible here; and
  • the Compendium of Use Cases, Volume 1 and Volume 2.
• The Advisory Guidelines on use of Personal Data in AI Recommendation and Decision Systems issued by the PDPC in March 2024, accessible here.
• Organizations may also consider leveraging the technical tool AI Verify to validate performance of AI systems, more information accessible here.