Singapore Model AI Governance Framework implementation for AI decisions you can explain and defend.

What it is

What is the Singapore Model AI Governance Framework?

The Model AI Governance Framework is Singapore's guidance for private sector organisations on deploying artificial intelligence responsibly. It is published by the Infocomm Media Development Authority (IMDA) and the Personal Data Protection Commission (PDPC), and its authors describe it as living and voluntary. It turns ethical principles into practice: who is accountable for AI, how involved people stay in decisions, how data and models are managed and what customers are told.

Its owners describe it as agnostic to algorithm, technology, sector, scale and business model, so a bank, a retailer and a manufacturer can apply the same structure. Companion documents include the Implementation and Self-Assessment Guide for Organisations (ISAGO) and two volumes of a Compendium of Use Cases.

This page covers Singapore's framework family. For the US voluntary framework, see our NIST AI RMF page; for a certifiable AI management system, see ISO/IEC 42001.

Current edition. The first edition appeared on 23 January 2019 and the second edition, the current text, on 21 January 2020. Two further frameworks extend it: the Model AI Governance Framework for Generative AI, released by the AI Verify Foundation and IMDA on 30 May 2024, and the Model AI Governance Framework for Agentic AI, announced by IMDA on 22 January 2026. Being voluntary, it has no transition deadline.

Who it is for

Who should implement the Model AI Governance Framework?

Any organisation whose AI makes or supports decisions about customers, employees or the public, whether built in-house or inside a vendor's software. Four typical starting points:

• Enterprise customers are asking how you govern AI. Security and vendor questionnaires now include sections on model oversight, training data and explainability.
• A tender or partnership expects responsible AI practices. Bid teams need a policy, an owner and evidence of operating controls, not a statement of values written the night before submission.
• Your AI uses personal data. PDPC administers the Personal Data Protection Act, and the same commission co-published this framework. A PDPA programme is a natural base for the framework.
• Your group sets an AI policy and each entity must apply it. A regional headquarters in Singapore often needs one governance model that subsidiaries in other countries can follow and report against.

Requirements

What are the Model AI Governance Framework requirements?

Strictly, the framework sets expectations rather than mandatory requirements. It rests on two guiding principles and organises its practices into four areas; the Generative AI and Agentic AI frameworks add dimensions of their own. The list below follows the owners' titles; your programme adopts the parts that apply to the AI you use.

• Guiding principle one: decisions made with AI should come from a process that is explainable, transparent and fair.
• Guiding principle two: AI solutions should be human-centric.
• Internal Governance Structures and Measures: clear roles, responsibilities and oversight for the AI an organisation deploys.
• Determining the Level of Human Involvement in AI-augmented Decision-making: decide how far people stay involved in decisions that AI supports, in proportion to the risk.
• Operations Management: manage data, models and their performance through development, deployment and review.
• Stakeholder Interaction and Communication: tell customers and others how AI is used and give them a way to respond.
• Generative AI framework, nine dimensions: Accountability; Data; Trusted Development and Deployment; Incident Reporting; Testing and Assurance; Security; Content Provenance; Safety and Alignment R&D; AI for Public Good.
• Agentic AI framework, four dimensions: bound risks upfront, keep humans meaningfully accountable, apply technical controls across the agent lifecycle, and enable end-user responsibility.

Implementation

How do you implement the Model AI Governance Framework?

There is no certification audit at the end, so the route is judged by whether governance actually shapes AI decisions. We take you through it in five steps, using the framework's own areas as the backbone.

1. 01
   Inventory your AI and agree the scope.List the AI systems in use, including features inside purchased software, and decide which frameworks apply: the 2020 framework, the Generative AI framework, the Agentic AI framework or all three.
2. 02
   Gap analysis against the four areas.Compare current governance, oversight, operations and communication with the framework, using ISAGO questions, and agree actions, owners and dates.
3. 03
   Design governance and human oversight.Assign accountability, set a risk-based method for choosing the level of human involvement, and approve the AI policy.
4. 04
   Put operational controls and communication in place.Data and model controls, testing (with AI Verify where it fits), monitoring, incident handling and plain-language disclosures for customers.
5. 05
   Self-assess, report and keep it current.Complete the ISAGO self-assessment, report to management and review as models, vendors and IMDA guidance change.

Check the route before you sign. IMDA and PDPC do not certify organisations against this framework, so treat any offer of a "Model AI Governance Framework certificate" with caution. The AI Verify Foundation's AI Tester Accreditation Programme, which it expects to open in the third quarter of 2026, accredits firms that test AI systems; it does not certify the systems or the organisations. If you need a certificate, ISO/IEC 42001 is certified by an accredited certification body, and the accreditation can be verified directly.

Cost

How much does Model AI Governance Framework implementation cost?

Cost depends on how much AI you run and how consequential its decisions are, more than on headcount. Our proposal shows every component and one all-inclusive proposal.

Timeline

How long does Model AI Governance Framework implementation take?

Most programmes take around three to six months, as an estimate: long enough to inventory the AI, agree governance, embed controls and run at least one review cycle. The pace depends on how many systems are in scope, how quickly owners can be named and how much evidence already exists.

If a customer questionnaire or tender has a date, tell us at the start; we will say what can be evidenced by then and what cannot.

Your engagement

What your Model AI Governance Framework engagement includes

Engagements follow Sterling OS™: Design™ (we guide, your team builds) or Drive™ (we manage the build), as alternatives; Sustain™ keeps governance current; Automate™ is Effivity. Sterling does not certify, attest or validate AI systems; we help you implement the framework and evidence it.

• AI inventory, gap analysis and plan

  Each AI system owned, gaps found, actions dated.

• Governance, policy and oversight model

  Accountability, AI policy and human-involvement method, built with leadership.

• Effivity ISO & GRC software

  Registers, risks and records in Effivity, included with the engagement at no additional cost.

• Training for everyone

  Internal auditor training, as applicable to your standard, and preferential Sterling Academy access, including complimentary awareness training for your people as part of the engagement.

• Operational controls and disclosures

  Data and model controls, testing, incidents and customer explanations.

• Self-assessment and review

  ISAGO self-assessment and management review, actions closed.

No certificate exists for the framework; your organisation remains accountable for its AI.

Often combined with

Standards organisations pair with Singapore Model AI Governance Framework

• EU AI ActEU AI Act compliance consulting: classify each AI system, document high-risk requirements and transparency duties, and prepare conformity assessment evidence.
• ISO/IEC 23894ISO 23894 AI risk management made practical: the ISO 31000-based guidance, its structure, no certificate, and how Sterling builds it, with a route to ISO 42001.
• ISO/IEC 38507ISO 38507 AI governance and requirements explained: the 2022 guidance for boards on AI use, why no certificate exists and how Sterling puts it into practice.
• ISO/IEC 42001ISO/IEC 42001 certification consulting for AI governance: risks and impacts assessed, treated and evidenced, then supported through the certification audit.
• ISO/IEC 42005ISO 42005 guidance on AI system impact assessment: what ISO/IEC 42005:2025 covers, its structure, how to put it into practice and how Sterling helps.
• ISO/IEC 42006ISO 42006 explained: the requirements for bodies that audit and certify ISO/IEC 42001 AI management systems, how accreditation works and what to check.