AI Governance for SMEs: Using IMDA's Framework and AI Verify

Singapore's AI governance frameworks at a glance

Four documents form the core. All are free and voluntary, and most are hosted on the AI Verify Foundation resources page.

If you only read one, read the generative AI framework, because that is what most SME chatbots and writing tools are. If you are letting an AI agent send emails, book appointments or update records by itself, add the agentic framework.

What the frameworks ask for, in plain English

Strip out the parts aimed at model developers and governments, and the frameworks ask a business deploying AI to do a handful of things.

• Accountability: someone in the business owns each AI system and answers for it. The agentic framework says humans remain ultimately accountable, even when an agent acts on its own.
• Data: know what data goes into the tool, keep personal data to the minimum, and follow the PDPA.
• Human involvement: decide how much a person checks before the AI's output reaches a customer. The traditional framework describes this as human-in-the-loop, human-over-the-loop or human-out-of-the-loop, based on how serious and likely the harm is.
• Testing: check the tool works and is safe before launch, and keep checking.
• Incident reporting: have a way to notice, fix and record when the AI gets something wrong.
• Transparency: tell customers when they are dealing with AI and how to reach a human.

For AI agents, the January 2026 framework adds two practical rules: limit what an agent can access and do from the start, and define 'significant checkpoints' where a person must approve before it acts.

The one-page AI governance checklist for SMEs

Complete this for each AI tool that touches customers or personal data, such as a website chatbot, an AI email assistant or an automation that drafts replies.

Keep the completed sheets with your PDPA records. Our PDPA checklist for small businesses shows where they fit alongside your data inventory and privacy notice.

How to test an AI chatbot before launch

IMDA's Starter Kit for testing LLM-based applications is voluntary guidance for pre-launch testing. It names five risks to test for: hallucination and inaccuracy, bias in decision-making, undesirable content, data leakage and vulnerability to adversarial prompts. An SME version of its identify, test, assess approach looks like this.

1. 1

   Identify the risks that matter

   For a shop or clinic chatbot, the big ones are wrong prices or policies (hallucination) and revealing other customers' details (data leakage).

2. 2

   Write test questions with known answers

   Use 20 to 30 real customer questions, including tricky ones, and write down the correct answer for each.

3. 3

   Try to break it

   Ask it to ignore its instructions, reveal its system prompt, quote a discount that does not exist or give medical or legal advice.

4. 4

   Set a pass mark

   For example: no wrong prices, no personal data shown, and a hand-off to a human for anything outside its scope.

5. 5

   Fix, retest and save the results

   Adjust the instructions or knowledge base, rerun the same questions and keep the results as evidence.

Repeat the same test when you change the AI model or vendor. Several models are being retired this quarter, as our Q4 2026 AI model roundup explains.

Is AI Verify worth it for a small business?

AI Verify is a testing framework and an open-source toolkit. The framework has 11 principles, including transparency, safety, security, fairness, data governance, accountability and human oversight, each with process checks and the evidence to collect. The Foundation offers the checks as a PDF, an Excel checklist and, for generative AI, a software tool that produces a summary report.

The Excel checklist is a useful reference even if you never complete it. Reading the transparency and data governance checks gives you a good list of questions to ask an AI vendor.

Where the PDPA fits

The frameworks are voluntary, but the PDPA is not. If your AI tool uses personal data, the usual obligations apply: consent or another legal basis, purpose limitation, protection, and care when data goes overseas. The PDPC has also issued advisory guidelines on personal data in AI recommendation and decision systems.

Our guide to AI chatbots for your website covers the PDPA points for chatbots, and is DeepSeek or Qwen safe for business covers overseas data transfers. This is general information, not legal advice.

Do it yourself or get help?

An owner can complete the one-page checklist for two or three AI tools in an afternoon. The testing step takes longer if you have never done it, but the five-step routine above is enough for a FAQ chatbot.

AI Website Assistant (S$790) sets up a website chatbot on your own accounts, with a pre-launch test, a visible AI notice and a hand-off to a human. PDPA Compliance Pack (S$690) produces your privacy policy, data inventory and staff data protection policy, where your AI records belong. IT Sorted is not a law firm and does not give legal advice.