A Framework Built for Companies Without a Compliance Team
We’ve written before about ISO 42001 and the EU AI Act — both real, both worth understanding, and both frankly heavier than most Singapore SMEs need for a first AI project. Singapore’s own Model AI Governance Framework, developed by the Infocomm Media Development Authority (IMDA) together with the Personal Data Protection Commission, was built with a very different audience in mind: it’s voluntary, sector-neutral, and designed so a ten-person company can apply it without hiring anyone new.
If you’re using AI anywhere in your business — a chatbot, a recommendation engine, an AI tool that screens job applications or scores leads — this framework is the most relevant starting point you have, more relevant than the heavier international standards most SMEs will never need to certify against.
The Four Ideas the Framework Actually Cares About
Strip away the terminology and the framework asks four practical questions of any AI system you deploy:
- Internal governance — does someone in your company actually own decisions about how AI is used, or did it just happen organically because a staff member signed up for a tool?
- Human oversight — can a person review, override, or explain an AI-driven decision that affects a customer or employee, rather than the system running unsupervised?
- Operations management — do you understand, even roughly, what data the model was trained or tuned on, and where its outputs might be wrong or biased?
- Stakeholder communication — do customers know when they’re talking to an AI system, and is there a way to flag a problem?
None of these require a data science team. They require someone writing down decisions that are usually already being made informally.
A Checklist You Can Run This Week
For most SMEs, an honest first pass looks like this:
- List every AI tool currently in use across the business — including ones staff adopted on their own (see our piece on Shadow AI)
- For each one, name a single owner responsible for how it’s configured and monitored
- Confirm there’s a human review step for any AI output that affects pricing, hiring, credit, or customer disputes
- Check your website or app discloses AI chat or AI-generated content where a reasonable customer would want to know
- Keep a one-page record of what each AI tool does — this becomes your evidence if a customer, auditor, or grant assessor ever asks
Where This Differs From ISO 42001 and the EU AI Act
ISO 42001 is a certifiable management system standard — useful if a client or investor specifically demands it. The EU AI Act is binding law with real penalties, but only bites if you have a genuine EU nexus. Singapore’s framework sits between the two: it’s not law, there’s nothing to certify, but IMDA’s companion AI Verify testing toolkit lets you generate an actual technical report against these principles if you want evidence beyond a checklist. For the vast majority of Singapore SMEs, the framework’s four questions are the right level of rigour — enough to catch real risk, not so much that it becomes a project in itself.
Building It In From the Start
The SMEs who handle this well aren’t the ones with the biggest compliance budgets — they’re the ones who bake governance questions into the AI project itself, rather than bolting them on afterwards. At Oasis Web Asia, every AI tool we build or integrate for a client — chatbots, recommendation engines, internal automation — is scoped with human oversight and a clear owner from day one, so you’re never scrambling to retrofit governance onto something already live. If you’re planning your first AI project and want it built on a defensible footing, our team can walk you through exactly what applies to your case.