Compliance
A Singapore CISO should meet their own regulator and a date before they meet a foreign fine. The map below is the order we think in — and the order the evidence is built for.
01The regulatory map
| Instrument | Exact status | How AI Pulse maps |
|---|---|---|
| MAS Guidelines on AI Risk Management (draft) | Consulted on 13 Nov 2025 – 31 Jan 2026; final expected 2026; proposed 12-month transition. All FIs; generative AI and autonomous agents in scope. Not yet in force. Source: MAS, Consultation Paper on Guidelines on Artificial Intelligence Risk Management, 13 November 2025. Consultation closed 31 January 2026; guidelines expected in 2026, with a proposed 12-month transition period. Consulted on — not yet in force. | Evidence packs map to the draft's expectations so you start the transition ready; the enforcement layer governs the agents the draft names. |
| MAS Information Paper on AI Model Risk Management | Published 5 Dec 2024 after a mid-2024 thematic review of banks; spans governance and oversight, risk management systems, and AI development/deployment; generally applicable to other FIs. Source: MAS, Information Paper on AI Model Risk Management, 5 December 2024. | Evidence structure mirrors the paper's three areas — oversight, risk systems, lifecycle — so supervisory questions land on prepared ground. |
| PDPC Advisory Guidelines on Personal Data in AI Systems | Issued 1 March 2024. Not legally binding, but PDPC will take enforcement positions consistent with them. Source: PDPC, Advisory Guidelines on Use of Personal Data in AI Recommendation and Decision Systems, 1 March 2024. | Discovery and tiering identify where personal data meets AI recommendation and decision systems; evidence shows the controls around it. |
| Singapore PDPA — penalty ceiling | In force since 1 Oct 2022: higher of S$1 million or 10% of annual turnover in Singapore. Source: Personal Data Protection Act 2012 (as amended), financial penalty provisions in force since 1 October 2022. Source: IBM Security, Cost of a Data Breach Report 2025 (July 2025). | The local ceiling is why discovery comes first: 1 in 5 breached organisations were compromised through shadow AI. |
| EU AI Act — Article 99 | Maximum fines: €7.5M or 1% (incorrect information to regulators); €15M or 3% (provider and deployer obligations); €35M or 7% (prohibited practices) — whichever is higher. Source: Regulation (EU) 2024/1689 (EU AI Act), Article 99. | For European exposure, framework mapping covers AI Act obligations; the evidence model supports regulator-facing transparency. |
02Precedent
“While a chatbot has an interactive component, it is still just a part of Air Canada's website.”
Source: Moffatt v. Air Canada, 2024 BCCRT 149 (Civil Resolution Tribunal, British Columbia).
The tribunal rejected the argument that a chatbot is a separate entity for liability purposes. Organisations are bound by what their AI tells customers. Controls — and evidence of them — are the only preparation that counts.
03Frameworks
Controls map to 45 frameworks across one shared backbone, so a single evidence set answers many different letters. The depth is deliberately ASEAN-first: Singapore, Malaysia, Indonesia, Thailand and Brunei are covered natively, alongside Europe, the United States, Japan and the international standards. Enable only the regimes that apply to you.
Breadth and depth are separate claims here. Every framework is in scope and evaluated; how deeply each is authored varies — some carry fully written guidance today, others are still being authored — and we never present one as more complete than it is.
SINGAPORE · 8
ASEAN REGIONAL · 2
MALAYSIA · 4
INDONESIA · 3
THAILAND · 4
BRUNEI · 1
AUSTRALIA · 4
EUROPE · 5
UNITED STATES · 6
INTERNATIONAL · 7
JAPAN · 1
Includes the IMDA Model AI Governance Framework for Agentic AI and MAS Project MindForge — the two Singapore instruments written specifically for agentic and financial-sector AI.
