Singapore's AI Compliance Hardline: What Professional Services Must Know About 2024–2026 Regulatory Shifts

Singapore has long positioned itself as a pragmatic, innovation-friendly jurisdiction. But pragmatism does not mean permissiveness. The regulatory shifts between 2024 and 2026 make clear that Singapore's authorities are tightening their expectations around AI governance and data protection — and that organisations operating across the Asia-Pacific region, or using Singapore as a hub for wider operations, need to take note now.

This briefing outlines what has changed, what it means in practice, and where international professional services businesses should focus their attention.

The Governance Frameworks You Can No Longer Ignore

Singapore's Model AI Governance Framework has existed in various forms for several years. What changed in 2024 was the introduction of a dedicated extension for generative AI, developed by the Infocomm Media Development Authority (IMDA) and the AI Verify Foundation. This addendum directly addresses the failure modes unique to large language models: hallucinations, embedded bias, intellectual property conflicts, and content provenance — the provenance question being particularly relevant for professional services firms generating client-facing outputs using AI tools.

Then, in January 2026, Singapore went further still, publishing what is recognised as the world's first Model AI Governance Framework for Agentic AI. Updated in May 2026, this framework confronts a challenge most organisations have not yet caught up with: the governance of AI agents capable of autonomous or semi-autonomous decision-making. The risks called out explicitly include "agent sprawl" — where AI agents proliferate across systems without adequate oversight — collaborative failures between multiple agents, and emergent behaviours that no single development team anticipated or planned for.

These frameworks remain voluntary. That distinction matters, but not in the way some compliance teams assume. Voluntary frameworks in Singapore have historically served as the staging ground for binding obligations. They establish the enforcement baseline — the standard against which "reasonable steps" will be judged when something goes wrong. For international businesses, the significance extends beyond Singapore: these frameworks are actively referenced across ASEAN, and they increasingly inform the expectations of regulators in neighbouring markets. Treating them as optional reading would be a mistake.

PDPA Enforcement: The Numbers Have Changed

While governance frameworks set the direction, enforcement actions demonstrate intent. The Personal Data Protection Commission (PDPC) has made a decisive shift in how it approaches AI-related data protection failures — and the financial consequences have escalated sharply.

In 2024, typical penalties sat in the S$5,000 to S$20,000 range. By 2025, high-profile enforcement actions were resulting in fines between S$200,000 and S$1,000,000. Marina Bay Sands received a S$243,096 penalty in 2025 following a data breach affecting more than 665,000 patrons. PPLingo Pte Ltd was fined S$74,000 in May 2024 for breaches involving the personal data of over 300,000 minors.

The figures are instructive, but the reasoning behind them is more so. The PDPC has been consistent in treating data volume and sensitivity as aggravating factors, not as defences. Operating at scale does not reduce an organisation's accountability — it increases it. For organisations with annual Singapore turnover exceeding S$10 million, the exposure now extends to 10% of that turnover. Smaller entities face fines of up to S$1 million. Both figures represent a material escalation of financial risk.

For international businesses operating in Singapore, or processing the personal data of Singapore residents from outside the jurisdiction, this enforcement posture demands a reassessment of AI data governance arrangements — not a review of whether they exist, but whether they are proportionate to the data volumes and risk profiles involved.

Advisory Guidelines and the Consent Question

In March 2024, the PDPC published Advisory Guidelines on the Use of Personal Data in AI Recommendation and Decision Systems. The advisory designation should not encourage complacency. These guidelines define how existing PDPA obligations apply to AI contexts — and they set expectations that enforcement decisions will reference.

Two requirements stand out for professional services firms. First, consent for AI-driven processing must be explicit and specific. Broad, catch-all privacy notices that reference AI use in passing are insufficient. Where personal data is used for automated recommendations, predictions, or decisions, organisations must be able to demonstrate that the individual understood and agreed to that specific use.

Second, there is a proposed requirement for mandatory notification when personal data is used for AI training. Rather than relying on generic privacy notices, firms would be required to provide clear explanations of the model's purpose, how personal data informs it, and a straightforward mechanism for individuals to opt out. This is a significant operational shift for any business using client or employee data to train, fine-tune, or evaluate AI systems.

What This Means for International Operations

Singapore's regulatory trajectory is not an isolated development. It reflects a broader pattern visible across multiple jurisdictions: AI-specific obligations layered on top of existing data protection law, voluntary frameworks acting as precursors to binding rules, and enforcement actions that signal a willingness to hold organisations accountable at scale.

For professional services businesses — law firms, accountancies, consultancies, financial advisers — operating internationally, Singapore's approach carries several practical implications.

Governance frameworks built for the EU AI Act or UK AI assurance guidance may not map cleanly onto IMDA's frameworks, particularly when it comes to generative and agentic AI. Organisations need to assess whether their existing compliance posture addresses the specific risks Singapore has prioritised, or whether material gaps exist.

Data protection arrangements that were adequate under earlier enforcement expectations may no longer be proportionate. The emphasis on consent specificity and notification obligations for AI training requires a direct review of how personal data flows through AI systems — not just at the point of collection, but throughout the model development and deployment lifecycle.

Finally, the agentic AI framework raises questions that many organisations have not yet asked about their own operations. Where AI agents are in use, or under development, governance structures need to address oversight, accountability, and the boundaries of autonomous action. This is not a theoretical concern — it is becoming a live compliance question.

Act Before the Landscape Shifts Again

Singapore's 2024–2026 regulatory evolution demonstrates that AI compliance is not a static obligation. Frameworks are expanding, enforcement is hardening, and the expectations set today will be the baseline for tomorrow's binding requirements. Organisations that treat current frameworks as aspirational guidance — rather than operational benchmarks — are accumulating compliance risk with each passing quarter.

If your organisation operates in Singapore, processes data from Singapore residents, or uses Singapore as a regional hub for AI deployment, the time for a structured compliance assessment is now.

Ops Intel works with international professional services businesses and global enterprises to navigate multi-jurisdictional AI compliance obligations. From gap assessments against Singapore's Model AI Governance Frameworks to PDPA data protection reviews and AI training data consent audits, our team provides the clarity and practical guidance your organisation needs to stay ahead of regulatory change.

Contact Ops Intel to discuss your AI compliance obligations across Singapore and beyond.