Skip to main content

    AI by country · Southeast Asia

    AI in Singapore: the rules, the readiness and where to start

    Last checked: 29 October 2026

    What should a company in Singapore know before starting with AI?

    Singapore has no dedicated AI law as of 29 October 2026. The Personal Data Protection Act 2012 (PDPA) applies when AI uses personal data, and the government relies on detailed but voluntary guidance for most AI use. Financial institutions are the exception to watch: MAS issued AI risk management guidelines on 7 October 2026 that take effect in October 2027.

    At a glance

    Singapore at a glance

    Key facts about Singapore
    Data protection lawPersonal Data Protection Act 2012, in force; breach notification since 1 February 2021
    RegulatorPersonal Data Protection Commission (PDPC); Monetary Authority of Singapore (MAS) for finance
    AI policyNational AI Strategy 2.0 (December 2023, updated May 2026). No dedicated AI law as of 29 October 2026
    Time zoneSGT, UTC+8 (India is 2.5 hours behind)
    CurrencySGD (Singapore dollar)
    Business languageEnglish, with Mandarin, Malay and Tamil

    Why now

    Why Singapore is worth watching

    Each point links to the document it comes from.

    • Singapore launched National AI Strategy 2.0 in December 2023 and released an update with 10 refreshed priorities in May 2026.[5]

    • The government says over 70 companies have set up AI Centres of Excellence in Singapore, and a $150 million Enterprise Compute Initiative supports companies' AI work.[5]

    • IMDA launched a Model AI Governance Framework for Agentic AI on 22 January 2026, covering risk limits, human approval checkpoints, technical controls and user training.[4]

    • The PDPC issued Advisory Guidelines on using personal data in AI recommendation and decision systems on 1 March 2024.[2]

    • MAS issued Guidelines on AI Risk Management for Financial Institutions on 7 October 2026, which apply to all financial institutions and all forms of AI technologies.[3]

    The rules

    The rules that matter for AI

    What each law or policy means when you build or buy an AI system.

    Personal Data Protection Act 2012: transfers and breaches

    In force2012Personal data may only go abroad if the recipient gives protection comparable to the PDPA (section 26). A breach is notifiable if it is likely to cause significant harm or is of significant scale (section 26B). Once you assess a breach as notifiable, you must tell the PDPC within 3 calendar days and, in most harm cases, the people affected (section 26D).[1]

    Personal Data Protection Act 2012: financial penalties

    In force2012For intentional or negligent breaches, the PDPC can impose a penalty of up to 10% of annual turnover in Singapore for an organisation with turnover above S$10 million, or up to S$1 million otherwise (section 48J). These caps have applied since 1 October 2022.[1]

    MAS Guidelines on Artificial Intelligence Risk Management for Financial Institutions

    Passed, not yet in force2026Issued on 7 October 2026, they apply to all financial institutions and all forms of AI, and take effect on 7 October 2027. A law firm summary says they cover board and senior management oversight, risk management policies, life cycle controls and AI capability, with some areas allowed until October 2028.[3]

    Where AI fits first

    Where AI fits first

    Banking, insurance and payments

    Document review, fraud alerts and customer service, with clear human review of decisions.

    The MAS AI risk management guidelines take effect on 7 October 2027 for banks, insurers, fund managers, payment firms and other licensed institutions.[3]

    Retail and e-commerce

    Personalised product recommendations built on existing customer data.

    The PDPC guidelines say the business improvement exception can let a company use data it collected lawfully, without fresh consent, to improve an existing product, subject to conditions.[2]

    Health care and research

    Commercial research on AI with public benefit, such as precision medicine.

    The PDPC guidelines describe a research exception for this kind of work, with conditions, including for joint research between companies.[2]

    Software and AI vendors

    Building bespoke AI systems for clients using the client's data.

    Vendors acting as data intermediaries must protect and not over-retain personal data (sections 24 and 25), and the PDPC suggests data mapping and provenance records.[2]

    Your first steps

    Your first steps

    1. Decide your legal basis for each AI use of personal data: consent, or the business improvement or research exception as the PDPC guidelines describe.
    2. Tell customers in your privacy policy how AI uses their data, and keep records of the safeguards you rely on.
    3. Check that any overseas AI service or cloud gives protection comparable to the PDPA before data leaves Singapore.
    4. Set up a breach process that can assess a breach and notify the PDPC within 3 calendar days.
    5. Put protection and retention terms in contracts with AI vendors who handle your data.
    6. If you deploy AI agents, use the IMDA agentic AI framework to limit their access and set human approval points.
    7. If you are a financial institution, plan now to meet the MAS AI guidelines by 7 October 2027.

    AI services for Singapore

    AI consulting and development for teams in Singapore

    We work remotely with companies in Singapore, in your time zone, and keep your data under the rules described above.

    AI agents and automation

    Agents that finish multi-step work across your tools, with people approving what matters.
    Learn more

    Document Q&A (RAG)

    Answers from your own documents, with the source shown for every answer.
    Learn more

    AI governance and data protection

    Policies, review steps and audit trails that fit your local data law.
    Learn more

    Software and cloud engineering

    Web apps, integrations and cloud platforms built around your AI use case.
    Learn more

    How we work with you

    How we work with you

    We work remotely with clients worldwide, in the client's time zone. Singapore is on UTC+8 and India on UTC+5:30, a 2.5 hour gap. Taking a 9:00 to 18:00 day in Singapore and 9:30 to 18:30 in India, the overlap is about 6 hours, from 12:00 to 18:00 Singapore time.

    Questions

    Common questions about AI in Singapore

    Does Singapore have an AI law?

    Not a dedicated one as of 29 October 2026. The PDPA covers personal data in AI, and most AI guidance, such as the IMDA frameworks and the PDPC advisory guidelines, is not legally binding.

    Can we train a model on our customer data without asking again?

    Possibly. The PDPC guidelines say the business improvement exception can apply when improving an existing product, if identifiable data is needed and a reasonable person would see the use as appropriate. Check the conditions before you rely on it.

    How fast must we report a data breach?

    Within 3 calendar days after you assess that it is notifiable. A breach is notifiable if it is likely to cause significant harm or is of significant scale.

    We are a bank. When do the MAS AI guidelines apply?

    They were issued on 7 October 2026 and take effect on 7 October 2027. A law firm summary says some areas may be met by October 2028.

    Complimentary tools

    Try these first

    Three complimentary tools from our AI Toolkit that suit a team starting out.

    AI readiness score

    Answer a few questions and see where your team stands, in about five minutes.
    Open the tool

    AI use case triage

    Test an idea against data, risk and effort before you spend on it.
    Open the tool

    AI project cost estimator

    Get a rough build and run cost range for a first AI project.
    Open the tool

    Read next

    Sources

    Sources

    Facts checked on 29 October 2026. Numbers in square brackets above match this list.
    1. [1] Attorney-General's Chambers, Singapore Statutes Online, 2026-10-29. Personal Data Protection Act 2012(sso.agc.gov.sg)
      Full title and what we used it for

      Personal Data Protection Act 2012. Primary, current consolidated text read on this date. Used for sections 26, 26B, 26C, 26D and 48J.

    2. [2] Personal Data Protection Commission, 2024-03-01. Advisory Guidelines on use of Personal Data in AI Recommendation and De…(pdpc.gov.sg)
      Full title and what we used it for

      Advisory Guidelines on use of Personal Data in AI Recommendation and Decision Systems. Primary. Used for the business improvement and research exceptions, data intermediaries and non-binding status.

    3. [3] Monetary Authority of Singapore, 2026-10-07. Guidelines on Artificial Intelligence Risk Management for Financial Ins…(mas.gov.sg)
      Full title and what we used it for

      Guidelines on Artificial Intelligence Risk Management for Financial Institutions. Primary page. Used for the issue date, 7 October 2027 start and scope. The four areas and the October 2028 allowance come from a Baker McKenzie summary dated October 2026.

    4. [4] Ministry of Digital Development and Information, 2026-01-22. Singapore Launches New Model AI Governance Framework for Agentic AI(mddi.gov.sg)
      Full title and what we used it for

      Singapore Launches New Model AI Governance Framework for Agentic AI. Primary press release. Used for the launch date and four dimensions.

    5. [5] Smart Nation Singapore, 2026-10-29. National AI Strategy(smartnation.gov.sg)
      Full title and what we used it for

      National AI Strategy. Primary, read on this date. Used for the NAIS 2.0 launch, the May 2026 update, the AI Centres of Excellence figure and the Enterprise Compute Initiative.

    6. [6] Baker McKenzie, 2026-10-07. Singapore: MAS issues Guidelines on Artificial Intelligence Risk Manage…(bakermckenzie.com)
      Full title and what we used it for

      Singapore: MAS issues Guidelines on Artificial Intelligence Risk Management. Law firm summary, used for interpretation only: the four areas and the transition timing.

    This is general information, not legal advice. Singapore updates its AI guidance often, and most of it is voluntary. Check with a qualified Singapore lawyer before you act. Facts checked on 29 October 2026.

    Other country guides

    Starting with AI in Singapore?

    Talk to an engineer. The first call is free, and we start with a readiness assessment before any budget is committed.

    Talk to our team Get your AI score