AI agents go beyond simply answering user questions. They can plan tasks to achieve specific goals, access external data and systems, and perform actual actions on behalf of users.
For example, an AI agent may analyze a customer inquiry, send an email, modify a database, or execute a payment or refund process. Because AI agents can take real-world actions, rather than merely generate content, errors or security breaches may result in personal data leaks, unauthorized transactions, account changes, or other tangible harm.
To address these risks, Singapore is developing more detailed governance standards focusing on AI agent permissions, human oversight, personal data processing, and security controls.
Singapore Introduces an AI Agent Governance Framework
In January 2026, Singapore’s Infocomm Media Development Authority (IMDA) released the Model AI Governance Framework for Agentic AI. In May 2026, IMDA published a revised draft reflecting operational considerations raised by businesses and other stakeholders. More than 50 organizations, including AWS, DBS, Google, and Salesforce, contributed feedback during the revision process.
The framework does not create a new licensing regime for AI agent operators, nor does it establish binding liability rules. Rather, it is a non-binding governance framework intended to guide businesses in deploying and operating AI agents responsibly.
IMDA emphasizes that even where AI agents perform tasks autonomously, ultimate accountability remains with human operators and organizations.
However, the fact that the framework itself is not legislation does not make it insignificant in practice.
Where an AI agent processes personal data, Singapore’s Personal Data Protection Act (PDPA) may apply. In regulated industries such as finance, insurance, healthcare, and recruitment, sector-specific regulations may also need to be considered. If users suffer harm due to service failures, contractual liability or liability arising from unlawful conduct may also be relevant.
AI Autonomy Should Be Designed According to the Risk Level of the Task
The core principle of Singapore’s framework is not to uniformly restrict the autonomy of AI agents. Instead, the level of authority granted to an AI agent and the degree of human intervention should vary depending on the risk associated with the task.
Tasks such as searching internal documents or preparing draft materials may generally be automated within a relatively broad scope.
By contrast, separate approval procedures may be appropriate for actions that are difficult to reverse or that directly affect individual rights, such as:
- suspending a customer account;
- entering into a contract;
- processing a refund;
- transferring funds; or
- making decisions with legal or financial consequences.
Human oversight should not be reduced to merely approving whatever result the AI proposes.
The responsible person should be able to:
- review what the AI agent did;
- understand the basis for its actions;
- stop the task when necessary; and
- restore the system to a previous state where possible.
Organizations should also clearly designate the person or department responsible for AI agent operations and define who is responsible for responding to incidents.
Access to data and systems should be limited to what is necessary for each task.
Granting an AI agent unnecessary customer information or administrator privileges can allow a single error to spread across multiple systems.
Personal Data Review Is Necessary from the Service Design Stage
AI agents may perform tasks by combining data from multiple sources, including:
- information directly entered by users;
- customer relationship management systems;
- email;
- purchase history; and
- internal corporate documents.
- On July 20, 2026, Singapore’s Personal Data Protection Commission (PDPC) issued the Advisory Guidelines on Use of Personal Data in Generative AI.
The guidelines provide standards for how personal data should be collected, used, and protected when developing and deploying generative AI models and systems.
Where an AI agent operates on a generative AI model or transfers customer data to an external model provider, businesses should first map the relevant data flows.
Key questions include:
- What personal data is entered into the AI agent?
- Does the external model provider store that data?
- Is the data used for training or model improvement?
- When is the data deleted after the processing purpose has ended?
- Where personal data of Singapore users is transferred to Korea or servers located in another country, cross-border transfer requirements must also be reviewed.
Under Singapore’s PDPA, organizations transferring personal data overseas are generally required to ensure that the transferred data receives a level of protection comparable to that required under the PDPA.
Accordingly, it is not sufficient merely to disclose cross-border transfers in a privacy policy.
Contracts with external AI or cloud service providers should specifically address matters such as:
- purposes of data use;
- whether data may be used for model training;
- security obligations;
- incident notification;
- deletion responsibilities after contract termination.
Security Risks of AI Agents Can Lead to Actual System Actions
When an AI agent can access emails, attachments, websites, or other external information sources, attackers may attempt to embed malicious instructions in seemingly normal data.
As a result, an AI agent may:
- execute unauthorized actions;
- disclose confidential or personal information externally; or
- pass malicious instructions to other connected systems.
- Where multiple AI agents delegate tasks to one another, a single malicious instruction can propagate across:
- payment systems;
- customer management systems;
- development systems; or
- other connected tools.
- Singapore’s Cyber Security Agency (CSA) has published guidance on Securing Agentic AI, recommending that system owners map the full workflow of AI agents and identify points at which attackers may intervene through external inputs or tool interactions.
Companies should therefore:
- grant only the minimum permissions necessary to each AI agent;
- restrict the external tools that an agent can use;
- log important commands and execution results;
- implement immediate suspension mechanisms where abnormal behavior is detected.
If the underlying model, plug-in, or external tool changes, companies should reassess whether the existing security controls remain effective.
Using External AI Solutions Does Not Eliminate the Operator’s Responsibility
Even where a company does not develop its own AI agents and instead adopts a third-party solution, responsibility for operating the service does not automatically shift to the vendor.
A company that provides the service to customers and determines the AI agent’s permissions may remain responsible for the way the system is operated and managed.
Where a defect in the model or a security vulnerability contributes to the problem, the responsibility of the developer or solution provider may also need to be examined.
Accordingly, AI solution agreements should address more than:
- pricing; and
- service levels.
-
- They should also clearly define:
- who controls the data and model;
- security incident notification timelines;
- procedures for investigating errors;
- responsibilities when system functionality changes;
- data return and deletion obligations;
- compensation and liability standards.
- The terms of service should also distinguish between:
- tasks performed automatically by the AI; and
- tasks requiring human review.
- Where an incorrect action occurs, users should have a clear mechanism to request:
- correction;
- cancellation; or
- human review.
- Simply disclosing that AI may make mistakes does not automatically eliminate the operating company’s responsibility.
What Companies Should Establish Before Entering Singapore
AI agent governance in Singapore cannot be addressed through a single policy document.
The service structure, development process, personal data handling, security, contractual arrangements, and customer response procedures should be designed together.
Before launching an AI agent service, companies should clearly define:
- tasks the AI agent is permitted and prohibited from performing;
- the data, systems, and permission levels the AI agent may access;
- stages requiring prior human approval or post-action review;
- structures for collecting, storing, transferring, and deleting personal data;
- responsibility and incident-response standards with external AI providers;
- logging, emergency shutdown, and recovery procedures.
- These controls are particularly important where services directly affect user rights or financial interests, including:
- payments;
- financial services;
- insurance;
- recruitment; and
- healthcare.
- In these areas, Singapore’s legal and governance standards should be reflected from the initial design stage, rather than only after the service has launched.
DECENT Law Firm’s Singapore AI Legal Advisory
DECENT Law Firm’s Global Business Practice advises AI, fintech, and platform businesses entering Singapore on the structure of AI services and compliance with local regulations.
We review:
- the scope of tasks performed by AI agents;
- data flows;
- human approval and oversight structures;
- access-control architecture; and
- compliance with Singapore governance and personal data protection standards.
Our advisory services may also cover:
- agreements for the procurement and implementation of external AI solutions;
- terms of service;
- privacy policies;
- cross-border personal data transfers; and
- incident-response frameworks.
This content is provided for general informational purposes only and does not constitute legal advice for any specific matter.