Privacy and data

Confirm what personal data the feature touches and the basis for using it under the PDPA. Minimize data sent to models and tools, and set retention for prompts, outputs, and logs. Check where your model and tooling providers process data and what their terms say about training and retention. Prepare your breach response for AI-specific incidents.

Review the PDPC's advisory guidance on generative AI and on AI recommendation and decision systems for how it reads the Act in this context.

The PDPC has been issuing enforcement decisions on the protection obligation in 2026. Basic security hygiene around AI data stores is a live risk.

Security, governance, and testing

Apply the CSA's guidance on securing AI systems and, if the feature can take actions, its addendum on agentic AI: threat-model the system, limit permissions, validate tool inputs and outputs, gate irreversible actions, and log activity. If the feature is agentic, check it against IMDA's governance framework on accountability and human oversight.

Test before launch with representative requests, adversarial prompts, and data-exposure checks, drawing on the risk areas highlighted by Singapore's AI assurance work. Keep dated reports.

Threat-model and limit access

Scope tools and credentials narrowly and require approval before irreversible actions.

Test, record, repeat

Run representative, adversarial, and data-exposure tests and re-run after changes.

Sector rules and user safety

If the feature serves a financial institution or is sold to one, MAS's final AI risk management guidelines and its existing technology and outsourcing expectations apply to your customer and will flow to you. If users can post or interact with each other, review reporting and response processes against the Online Safety Act. If the feature involves invoicing, check InvoiceNow timing.

Finally, check which support schemes you may be eligible for, since scheme names and rules changed during 2026.

Launching an AI feature for Singapore users? Talk to us about a pre-launch review.

Key takeaways

  • Cover PDPA basics, minimize data, set retention, and verify provider terms.
  • Apply CSA security guidance and IMDA governance if the feature acts autonomously.
  • Test with representative, adversarial, and data-exposure sets and keep dated reports.
  • Check sector overlays: MAS for finance, online safety for user interaction, and InvoiceNow for invoicing.
This is general information, not legal advice. It summarizes public guidance as of October 2026; read the primary documents for your situation.