AI agents in Singapore: the testing and governance rules

Singapore has the most developed public guidance on AI agents in the region. Most of it is written as guidance for organisations in general, not as a statute, but it sets the vocabulary that procurement, risk and audit teams use when they review a system. For financial institutions, the Monetary Authority of Singapore has issued guidelines that set its supervisory expectations on AI risk, and those expectations reach every AI system a bank or insurer uses, including systems supplied by third parties.

What buyers here ask me first

How to align agents with IMDA guidance so that risk and procurement can approve them without a long review cycle.
What testing evidence is enough, how it is kept current, and who signs it off.
Who is accountable when an agent acts, and how that person can intervene before harm is done.
How a system that works in one language or market is rolled out to others without losing its controls.

The governance framework

IMDA's Model AI Governance Framework for Agentic AI was announced in January 2026 and updated in May 2026. It rests on four dimensions. The first is to assess and bound the risks before deployment. The second is to make humans meaningfully accountable for the agent's actions. The third is to put technical controls and processes in place. The fourth is to enable end users to act responsibly. The framework is written as guidance, so it sets expectations rather than legal duties. It is a living document, so the version and date should be quoted in any submission.

The agentic version adds the parts that matter when a system takes actions rather than only producing text.

The testing kit

In October 2026 IMDA released a starter kit for testing agentic systems, at version 1.0. It is aimed at organisations whose agents use tools, reach sensitive data, and carry out tasks for a user. It sets four steps: identify the relevant risks for testing; create realistic tests that cover the risks; run the tests and analyse the logs; and continuously monitor and re-test after launch. The kit itself says that trajectory analysis at scale is still hard and that sector-specific thresholds do not yet exist. The agentic kit adds the question of what the agent did, step by step, and not only what it said.

The AI Verify Foundation runs an accreditation programme for AI testers. The first testers were accredited alongside the kit. Accreditation is relevant when a buyer asks who performed the testing, and it is worth checking against the foundation's current list.

Financial institutions

The Monetary Authority of Singapore finalised its Guidelines on Artificial Intelligence Risk Management on 7 October 2026. They apply to financial institutions supervised by the Monetary Authority of Singapore. They take effect on 7 October 2027, with phased implementation, and a second phased deadline is set for 7 October 2028. Boards and senior management are expected to oversee AI risk. The controls cover data governance, testing, human oversight, cybersecurity, monitoring and change management.

Financial firms that deploy agents before the guidelines take effect will still be asked how the agent meets these expectations, because supervisors can ask about a system at any time. A builder who prepares the record now avoids a rushed review later.

How an agent is built to meet these expectations

The framework, the testing kit and the MAS expectations point in the same direction. Each agent needs a documented risk assessment before its first run, with the limits on what it may do written down. It needs a test set that checks the steps it takes, not only its final answer, because an agent can reach a correct answer by an unsafe route. It needs a log that lets a reviewer reconstruct a run, including the tools it called and the data it read. And it needs a retest after each change and after launch.

Bounding the risk. The agent's tools are its reach, so each tool is given the narrowest permissions the task needs. Actions that change records or move money are separated from actions that only read, and the separation is enforced by the tool layer, not by the prompt.

Human accountability. A named person owns each agent, with the authority to pause it. The point where a person must approve an action is defined in advance and logged. A risk team will want to see who could have stopped a harmful action, and how quickly.

Technical controls. Guardrails check inputs and outputs, and they stop actions outside the agreed scope. They are tested with known bad cases, which are kept in the evaluation set.

End users. People who work with the agent are told what it can and cannot do, and how to report a problem. Training is recorded.

The human in the loop and guardrails terms set out the design choices in more detail.

Testing an agent in practice

Testing an agent is different from testing a model. A model test asks whether an output is correct. An agent test asks whether a sequence of steps stayed inside its limits and reached the goal safely. The useful measures are the steps taken, the tools called, the data read, the checks that fired, and the outcome. The eval set holds those cases, and the evaluation harness runs them after every change.

Retesting after launch matters as much as the first test. An agent's inputs change over time, and so do the systems it calls. A monitoring plan that flags a change in the outcome pattern is part of the evidence a risk team expects.

Where the picture is still moving

The governance framework has been revised and may be revised again. The testing kit is at version 1.0 and its authors say it will change. The MAS guidelines take effect in 2027, and the agentic consultation is planned for 2027. A project that starts now should record the version of each document it relied on, so that its design can be checked against the version in force at each review.

What a first project looks like

The first project is one workflow with one owner, chosen because its tools and data are already known. I start with a readiness review of two weeks. The first week maps the workflow, the tools the agent would call and the data each tool reaches. The second week tests the riskiest assumption with a small spike, usually the tool permissions or the quality of the source records.

The review ends with a written decision. If the decision is to proceed, the first working slice runs outside production. It is tested against the four steps of the IMDA testing kit: the risks are identified and written down, the tests are designed against them, the results and logs are analysed, and a monitoring plan is set for after launch. For a financial institution, the record also shows how the project meets the MAS expectations. The handover then passes the agent to a named owner, with the test results and the monitoring plan.

Where the sources disagree

The date of the updated governance framework is reported differently by different sources, so the version and date quoted in any submission should come from the IMDA document itself. Commentary also describes the framework's structure differently in places. The four dimensions are the most consistent point across sources, and the official wording should be quoted from the document. The testing kit is version 1.0, and its own text says that some thresholds are still missing, so a project should record which parts of the kit it used and why.

A composite example

[Composite] A payments company wanted an agent to answer merchant queries and to open dispute cases. The readiness review found that the dispute tool could change case status without a human check. The team split the tool into a read tool and a write tool that needed an approval, and the testing kit's trajectory checks caught one run where the agent had opened a case before reading the merchant's record. The fix went into the test set, and the monitoring plan watched for the same pattern after launch.

Common questions

Is the Singapore agentic AI framework mandatory?

No. It is voluntary guidance. It is still the reference that most risk teams in the region use to judge an agent deployment, so a design that follows it is easier to approve.

Does the MAS guidelines apply to my company if we are not a bank?

The guidelines apply to financial institutions that MAS supervises. A company outside that group is not directly covered, but its financial clients may ask it to meet the same expectations in its contracts.

What testing evidence do approvers look for?

A written evaluation set, results across the set, a record of the tools and permissions, the logs of the runs and a monitoring plan. These map onto the testing steps in the IMDA kit.

Does the testing kit replace our own evaluations?

No. The kit gives a structure for the testing. The cases that matter to your business are still written by your business owner and kept in your own evaluation set.

Does the same design work across APAC?

The core controls carry over. Languages, data protection rules and approval chains differ by market, so each market needs its own readiness review before the agent goes live there.

What is trajectory evaluation?

It is scoring the sequence of steps an agent took, including which tools it called and what it read, rather than only the final answer. An agent can give a correct answer through an unsafe route, and trajectory evaluation is how that is found.

Who should own an agent after launch?

A named person inside the organisation, with the authority to pause the agent and the responsibility to keep its evaluations current. The handover pack describes what that owner should receive.

Resources

Engagements: the shapes of work I offer. I do not publish prices.
Human in the loop: when a person must approve or stop an action.
Guardrails: checks around a model's inputs and actions.
Tool contract: the written specification of what a tool may do.

Work with me

If you are deciding whether an agent is worth building in Singapore, start with the AI Delivery Readiness Review. It is a two-week check on one workflow that ends in a written decision to proceed, reframe or pause. For teams that want to build the capability themselves, the AIXL Academy forward-deployed AI engineering cohort is the route, with its own schedule and terms on that page. I work with teams in Singapore and the region on engagements, and I travel for engagements. The work location is stated in each engagement. You can also send an enquiry.

Work with me in Singapore

Work with me in Singapore and APAC: overlap hours, travel and the engagement shapes.
FDE consulting in Singapore: forward-deployed AI consulting for banks and enterprises under the IMDA framework.
FDE training in Singapore: team programmes and the public cohort for Singapore teams.

This page summarises public sources as of the date above. It is not legal advice. Where sources disagree, the page says so. Sources marked as commentary are secondary and should be checked against the official text before a decision.

This page summarises public sources as of the date above. It is not legal advice. Where sources disagree, the page says so.

AI agents in Singapore