Singapore finalises its Model AI Governance Framework for Generative AI

Singapore's Model AI Governance Framework for Generative AI is voluntary guidance for building a trusted environment around generative AI, and its final version was released on 30 May 2024. The AI Verify Foundation and the Infocomm Media Development Authority (IMDA) developed it, first releasing a proposed version for international views on 16 January 2024.

What it is

The framework extends Singapore's earlier Model AI Governance Framework for traditional AI, whose first edition appeared on 23 January 2019 and whose second edition the Personal Data Protection Commission released on 21 January 2020. It presents itself as practical first steps, on the view that no single intervention can address current and emerging AI risks, and as the basis for more detailed guidelines under each dimension later. It also aims to support international conversations among policymakers, industry and researchers.

What it requires

As guidance, it sets expectations rather than legal duties. Its nine dimensions are accountability, data, trusted development and deployment, incident reporting, testing and assurance, security, content provenance, safety and alignment research, and AI for public good. Two are directly operational for security teams: incident reporting, which calls for an incident management system for timely notification and remediation, and security, which addresses new threat vectors arising from generative AI models. Testing and assurance points to third-party testing and common testing standards.

What security leaders should do

For organisations operating in Singapore, the nine dimensions are a ready-made outline for an AI governance charter, and the incident reporting and security dimensions map cleanly onto existing security operations. Extend your incident response plan to cover AI failures such as harmful outputs, data leakage through prompts and model compromise, and define who is notified and how fast. Where you rely on third-party models, ask suppliers what external testing their systems have undergone.