In this guide · 8 sections
- 01The short version: no AI Act, but existing laws apply
- 02PDPA: the law that applies to almost every SME using AI
- 03Voluntary frameworks: IMDA and CSA
- 04Copyright, deepfakes and other laws that touch AI
- 05Sector rules: financial services and healthcare
- 06What an SME should actually do
- 07Do it yourself or get help?
- 08Frequently asked questions
Short answer
No single AI law applies to Singapore businesses. Existing laws still do: the PDPA for personal data in AI tools, plus copyright and consumer rules. IMDA's AI frameworks and CSA's AI security guidelines are voluntary. Financial institutions face MAS AI guidelines from 7 October 2027.
The short version: no AI Act, but existing laws apply
Singapore regulates AI through a mix of existing laws, targeted amendments for specific harms, and voluntary frameworks. That means there is no AI licence to apply for and no AI register to join. It also means "the AI did it" is not a defence: if a chatbot leaks customer data or makes a false claim, the business that deployed it answers for it under the usual rules.
| Instrument | Binding? | Date | Who it matters to |
|---|---|---|---|
| Personal Data Protection Act 2012 | Yes (law) | In force; amended 2020 | Every business using personal data in AI tools |
| PDPC Advisory Guidelines on Personal Data in Generative AI | Guidance on how the PDPA is applied | 20 July 2026 | Businesses using or building AI tools |
| IMDA Model AI Governance Frameworks (traditional, generative, agentic) | Voluntary | Gen AI: 30 May 2024; agentic: 22 Jan 2026 | Anyone deploying AI |
| CSA Guidelines on Securing AI Systems | Voluntary | 15 October 2024 | Businesses building or hosting AI systems |
| Copyright Act 2021, s 244 | Yes (law) | In force | AI training and AI-generated content |
| Elections (Integrity of Online Advertising) (Amendment) Act 2024 | Yes (law) | Passed 15 October 2024 | Anyone publishing political content |
| MAS Guidelines on AI Risk Management | Supervisory expectations | Issued 7 Oct 2026; effective 7 Oct 2027 | Banks, insurers and other financial institutions |
| MOH AI in Healthcare Guidelines (AIHGle 2.0) | Guidance | March 2026 | Healthcare AI developers and providers |
PDPA: the law that applies to almost every SME using AI
If you paste customer details into an AI tool, run a chatbot that collects enquiries, or use AI to screen job applicants, the PDPA applies in the normal way: consent and purpose, protection, retention, and care with overseas transfers.
PDPC's Advisory Guidelines on Use of Personal Data in Generative AI, issued on 20 July 2026, explain how. Businesses that use AI tools are treated as deployers with primary responsibility, and prompts, outputs and agent logs are treated as personal data sources to protect. Our guide to the PDPC generative AI guidelines summarises what the final text asks of an SME.
PDPC also has earlier guidelines on personal data in AI recommendation and decision systems, relevant if you use AI to recommend products or make decisions about people.
Voluntary frameworks: IMDA and CSA
These are not law, but they are what customers, auditors and enterprise buyers increasingly ask about, and they are written in a practical way.
- IMDA Model AI Governance Frameworks: the framework for generative AI (30 May 2024) sets out nine dimensions such as accountability, data and security. IMDA added a framework for agentic AI in January 2026. The AI Verify Foundation publishes the frameworks and testing tools.
- CSA Guidelines on Securing AI Systems: launched on 15 October 2024 with a companion guide, they take a secure-by-design approach across the AI life cycle, from planning to disposal. See the CSA publication page.
- CSA and IMDA safe use advisory: a joint advisory in July 2026 on safe use of generative AI, with practices staff can follow.
Our IMDA AI governance guide for SMEs turns the frameworks into a one-page checklist.
Copyright, deepfakes and other laws that touch AI
Several non-AI laws catch common AI uses:
- Copyright: section 244 of the Copyright Act 2021 allows computational data analysis, which covers training, with conditions such as lawful access. It does not protect you if an AI-generated image or text you publish copies an existing work too closely. See our guide to AI image generators for commercial use.
- Elections: the Elections (Integrity of Online Advertising) (Amendment) Act 2024, passed on 15 October 2024, makes it an offence to publish manipulated online election advertising containing a realistic but false representation of a candidate, such as a deepfake, during the election period.
- Online harms: the Online Safety (Relief and Accountability) Act 2025 created the Online Safety Commission, which began operations on 29 June 2026 and handles harms to individuals such as image abuse.
- Consumer protection and advertising: claims your AI-written marketing makes must be true, as with any advertising.
Sector rules: financial services and healthcare
Regulated sectors get more specific expectations.
Financial services: on 7 October 2026, MAS issued Guidelines on AI Risk Management applying to all financial institutions and all forms of AI. They expect board oversight, an inventory of AI use, risk materiality assessments, and accountability for third-party AI. They take effect on 7 October 2027, with some sections due by 7 October 2028. Smaller firms whose AI use is low-impact may use basic policies and procedures.
Healthcare: MOH published version 2.0 of its Artificial Intelligence in Healthcare Guidelines in March 2026, setting responsibilities for developers, deployers and users of healthcare AI. Clinics using AI scribes or triage tools should read the deployer sections.
What an SME should actually do
For most small businesses, compliance comes down to a few habits that also make AI use safer and more reliable.
AI compliance basics for SMEs
Do it yourself or get help?
Most SMEs can cover the basics themselves in a day: list tools, write the one-page rule, update the privacy notice. Regulated firms, or businesses building their own AI products, should get legal advice on the sector rules.
Our PDPA Compliance Pack (S$690) updates your privacy notice, data inventory and internal policies to cover AI tools. Security Awareness Training (S$390) includes safe AI use for staff: what not to paste in, and how to spot AI-made scams.
Frequently asked questions
Not a single, general AI law. Singapore applies existing laws, such as the PDPA, the Copyright Act and consumer protection rules, to AI use, and has passed targeted amendments such as the 2024 ban on election deepfakes. Regulators publish guidance on top, including PDPC's generative AI guidelines and IMDA's voluntary governance frameworks. This is general information, not legal advice.
No. IMDA's Model AI Governance Frameworks, including the ones for generative AI and agentic AI, are voluntary. They are still worth using because enterprise customers, auditors and regulators treat them as the Singapore reference point for responsible AI, and they map closely to what the PDPA already expects when personal data is involved.
Yes, whenever staff put personal data into it. The business remains responsible for protecting that data and using it only for purposes customers were told about. PDPC's July 2026 guidelines treat organisations that use AI tools as deployers with primary responsibility. Use business plans that exclude your data from training and set clear staff rules.
MAS issued its Guidelines on AI Risk Management on 7 October 2026. They take effect on 7 October 2027, with financial institutions expected to meet sections 3 and 4 from that date and sections 5 and 6 by 7 October 2028. They apply to all financial institutions, scaled to the materiality of each firm's AI use.
Generally yes, subject to the AI tool's terms and normal copyright law. Singapore's computational data analysis exception covers training, not your outputs, so an image that closely copies an existing work could still infringe. Avoid prompts naming living artists or brands, and check outputs before using them in advertising.