Far East AI Compliance in 2025–2026: Singapore's Agentic AI Framework, Japan's First AI Act, and What Professional Services Firms Must Do Now

The regulatory landscape across the Far East is no longer a slow-moving story of voluntary guidelines and soft commitments. Singapore, Japan, and South Korea have each introduced substantive AI governance frameworks in 2025 and 2026 that carry real obligations — and in some cases, real penalties. For international professional services businesses operating across these jurisdictions, the window for a "watch and wait" posture has closed.

This briefing sets out what has changed, what it means in practice, and where firms need to act.

Singapore: Agentic AI and the PDPA as a Board-Level Liability

Singapore has moved with notable speed and precision. The Infocomm Media Development Authority (IMDA) published its Model AI Governance Framework for Agentic AI in January 2026, with an updated Version 1.5 released in May 2026. The significance here lies in the subject matter: agentic AI — systems that do not merely generate outputs but take autonomous actions on behalf of users. The framework addresses AI that "not only thinks, but does", covering accountability structures, testing requirements, and disclosure obligations for systems operating with meaningful autonomy.

This is directly relevant to professional services firms deploying AI agents for document review, client communications, procurement workflows, or compliance monitoring. The IMDA framework makes clear that autonomous AI systems require designated accountable owners, thorough pre-deployment testing, and documented incident response procedures. For agentic deployments specifically, firms should treat the framework not as aspirational guidance but as the baseline against which their systems will be assessed.

Alongside this, the Personal Data Protection Commission (PDPC) released its final Advisory Guidelines on the Use of Personal Data in Generative AI in July 2026. These guidelines clarify how Singapore's Personal Data Protection Act (PDPA) applies to personal data used in training AI models — a question that has created significant uncertainty for organisations building or procuring generative AI tools. Critically, the guidelines extend obligations to organisations involved in collecting and curating training datasets, not only those deploying finished models.

Enforcement context matters here. A 2025 PDPA decision against Marina Bay Sands — a fine of S$243,096 for a data breach — illustrates that Singapore's data protection authority is actively using its powers. For large organisations, maximum penalties reach 10% of annual Singapore turnover. PDPA compliance in the context of AI is now a board-level liability, not a matter to be delegated entirely to IT or legal teams.

Practical implications for international firms with a Singapore presence:

• Assign accountable owners to all AI systems, including third-party tools processing personal data
• Document training data sources and assess their compliance with PDPA requirements
• Conduct hallucination testing and red teaming using Singapore's updated AI Verify framework (revised May 2025 to cover generative AI)
• Establish written incident response procedures specific to AI-related data events
• Review vendor contracts to ensure obligations flow downstream to third-party AI providers

Japan: The First Dedicated AI Act and APPI Reform

Japan enacted its first dedicated AI legislation — the Act on Advancing Responsible AI Research, Development and Utilisation — in May 2025, with the Act entering full effect on 1 September 2025. Japan has framed this primarily as a promotional statute: the goal is to encourage responsible AI research and development while establishing baseline transparency and safety obligations. Unlike the EU AI Act, it does not introduce specific monetary penalties in its current form.

That said, professional services firms should not interpret the absence of financial penalties as an absence of risk. The Act creates expectations around transparency, safety documentation, and accountability that will influence how clients, regulators, and courts assess AI-related incidents in Japan. Firms operating in regulated sectors — financial services, healthcare, legal — should treat Japan AI Act compliance as part of their broader risk management posture rather than a standalone tick-box exercise.

More immediately consequential are the amendments to Japan's Act on the Protection of Personal Information (APPI), approved by Cabinet in April 2026 and expected to take effect within approximately two years of formal promulgation. The reforms relax — but do not eliminate — consent requirements for using personal data in statistical analysis and AI development. The key conditions are that data must be non-identifying and subject to safeguards including pseudonymisation and Data Protection Impact Assessments (DPIAs).

For international firms, this creates a specific compliance task: existing data handling policies and consent frameworks built around the previous APPI standard will need revision. Vendor contracts must be reviewed and updated to incorporate APPI-specific cross-border data transfer safeguards and AI incident notification clauses.

Practical implications for international firms with a Japan presence:

• Review and update internal AI ethics guidelines and data handling policies against the Japan AI Act's transparency obligations
• Map current consent frameworks against the forthcoming APPI amendments and identify gaps
• Conduct DPIAs for AI systems that process personal data for training or analytical purposes
• Update vendor and partner agreements to include APPI-compliant cross-border safeguards and incident notification requirements

South Korea: Binding Obligations for High-Impact AI

South Korea's Framework Act on the Development of Artificial Intelligence and Establishment of Trust — commonly referred to as the AI Basic Act — came into force on 22 January 2026, placing South Korea among the first nations globally to enact comprehensive national AI legislation with legally binding requirements.

The Act takes a risk-proportionate, principles-led approach, but its obligations for operators of "high-impact AI" are substantive. High-impact AI is defined as systems with significant potential to affect human life, safety, or fundamental rights — encompassing healthcare, hiring, credit assessment, and similar domains. Operators must perform documented impact assessments and implement safety measures before deployment. Separately, businesses must notify users clearly when they are interacting with high-impact or generative AI systems.

For professional services firms, the South Korean framework raises immediate questions about any AI-assisted tools used in talent acquisition, client risk assessment, or service delivery in regulated sectors. The obligation to document, assess, and disclose is not materially different in structure from what Singapore and the EU require — but it applies independently under Korean law and requires Korean-jurisdiction compliance documentation.

The Regional Picture: What International Firms Must Recognise

Taken together, Singapore, Japan, and South Korea have each introduced frameworks that, while distinct in structure and enforcement posture, share common threads: accountability for AI system owners, documentation of training data and testing, user disclosure for automated or AI-generated outputs, and data protection obligations that extend explicitly into the AI development lifecycle.

For international professional services businesses, compliance cannot be approached jurisdiction by jurisdiction in isolation. The firms that will manage this landscape effectively are those that build AI governance programmes capable of satisfying multiple overlapping regulatory requirements simultaneously — with local adaptation rather than ground-up rebuilds for each market.

How Ops Intel Can Help

Ops Intel works with international professional services firms and global enterprises to design and implement AI compliance programmes that operate across jurisdictions — not just in one market at a time. Whether you are assessing exposure under Singapore's agentic AI framework, preparing for Japan's APPI amendments, or mapping your AI systems against South Korea's AI Basic Act, our team provides the regulatory clarity and practical frameworks you need to act with confidence.

Contact Ops Intel today to discuss a compliance assessment tailored to your AI footprint across the Far East and beyond.