Singapore

Singapore’s Constitution does not contain explicit provisions addressing AI or digital technologies. That being said, as commented by the Oxford Institute of Technology and Justice on its website (www.techandjustice.bsg.ox.ac.uk/research/singapore), the fundamental liberties found in Part IV of the Singapore Constitution “may be relevant in regulating the use of AI in courts”. Article 14(1), which enshrines the right to freedom of speech and expression, is subject to qualification in the interest of “public order and morality”. In the context of AI usage, as false statements are not “protected speech” in Singapore, the risk of inaccuracies or “hallucinations” generated by AI would have to be addressed.

Furthermore, while Singapore’s Constitution does not directly provide for a right to privacy, the Personal Data Protection Act 2012 (the PDPA) includes certain privacy protections which can be viewed as an extension of Singapore’s broader constitutional order which calibrates the protection of personal data under public interest considerations embodied in Article 14(2) of Singapore’s Constitution.

Singapore is not party to major international human rights treaties such as the International Covenant on Civil and Political Rights (ICCPR) or the International Covenant on Economic, Social and Cultural Rights (ICESCR). Hence, international norms are persuasive rather than binding.

Nonetheless, Singapore is a signatory to the ASEAN Human Rights Declaration 2012. Singapore and ASEAN have published guides and frameworks that are largely aligned with the Organisation for Economic Co-operation and Development’s (OECD) AI principles. These principles promote the use of AI in an innovative and trustworthy way that respects human rights and democratic values.

Singapore’s patent law is governed by the Patents Act 1994 (the Patent Act). The Patent Act adopts a technology-neutral approach, hinging patentability on novelty, inventive step, and industrial applicability. The Intellectual Property Office of Singapore (IPOS) is the statutory board in charge of issuing patents in Singapore. IPOS has issued the Supplemental Guidance for Examination of AI-related Patent Applications in 2024 which clarified that AI-related inventions will be examined using the same criteria as other technological inventions. It also clarified that patent applications must disclose clearly how the AI system achieves its technical effect, including detail on training data, model architecture, and implementation.

A key issue surrounding patents relates to inventorship (i.e. can AI be named an inventor?). Currently, Singapore adopts the orthodox position that only human inventors can be named, aligning with the UK, Australia, and the EU. There has been no legislative move to recognise AI as an inventor as of yet.

The Copyright Act 2021 (the Copyright Act) governs AI-generated works in Singapore. Section 109(1) of the Copyright Act states that for an unpublished authorial work to be copyrighted, it must be original and the author must be a qualified individual. A “qualified individual” is defined as a natural person (i.e. a Singapore citizen or a Singapore resident). Furthermore, Singapore’s Court of Appeal in Global Yellow Pages Ltd v. Promedia Directories Pte Ltd [2017] SGCA 28 further emphasised that for copyright to subsist in relation to literary works, there must be an “authorial creation that is causally connected with the engagement of the human intellect”. Accordingly, based on current law, works that are fully AI-generated and absent meaningful human contribution are unlikely to be afforded copyright protection.

This can be contrasted with the section 9(3) of UK’s Copyright, Designs and Patents Act 1988 which explicitly confers authorship of computer-generated works on the person making the arrangements.

Singapore does not have a stand-alone trade secrets legislation. Instead, protection for confidential information and trade secrets, including AI algorithm, training methodologies and proprietary datasets derive from common law principles of the breach of confidence and contractual non-disclosure obligations.

For a claim of breach of confidence, the Court of Appeal in I-Admin (Singapore) Pte Ltd v. Hong Ying Ting [2020] SGCA 32 reiterated the traditional three elements to be met:

• the information is confidential in nature;
• the information was imparted in circumstances of confidence; and
• it has been used without authorisation and to the detriment of the party.

It then acknowledged the insufficiencies of that approach with the advent of modern technology, setting out a new approach which keeps the first two requirements and modified the third element to situations where confidential information is accessed or acquired without the party’s knowledge or consent. If these prerequisites are met, a breach of confidence is presumed, and the burden then lies on the defendant to prove that its conscience was unaffected. Companies typically protect AI trade secrets using comprehensive non-disclosure agreements (NDAs), employment contracts via restrictive covenants.

Additionally, section 24 of the PDPA requires organisations to make reasonable security arrangements to prevent unauthorised access, collection, use or disclosure of personal data. This seems to intersect with trade secret management where training datasets contain personal or sensitive information.

As of 2025, there are no reported Singapore court decisions that squarely deal with copyright subsistence or infringement in relation to generative AI outputs. Regardless, as mentioned above at Section 2.2, purely-AI outputs would be likely to fall outside copyright protection unless a natural person can demonstrate sufficient intellectual creation.

The PDPA is the primary cross-sector data protection statute in Singapore that applies to organisations’ use of personal data throughout the AI lifecycle, from training and testing to deployment and monitoring. Section 2(1) of the PDPA defines “personal data” as “data, whether true or not, about an individual who can be identified from that data, or from that data and other information to which the organisation has or is likely to have access”. This definition is critical for AI applications, as training data, model inputs, and outputs may all constitute personal data if individuals can be identified.

The PDPC issued the Advisory Guidelines on the Use of Personal Data in AI Recommendation and Decision Systems (the AI Advisory Guidelines) in March 2024 which has since clarified PDPA obligations, such as consent, notification, and purpose limitation across the AI lifecycle. While not legally binding, the AI Advisory Guidelines articulate principles including transparency, explainability, fairness, and human oversight that complement the PDPA’s mandatory obligations. Organisations that adopt the AI Advisory Guidelines may demonstrate compliance with broader obligations of reasonable data practices.

For the development stage, the AI Advisory Guidelines provide that organisations may rely on the Business Improvement Exception or Research Exception to use personal data for training and testing, subject to it being for a reasonable purpose. For the deployment stage, the AI Advisory Guidelines emphasises the need for “meaningful consent” from consumers. While the PDPC acknowledges the challenges uses evolve or are not fully determined at the time of collection, the PDPC encourages organisations to practice transparency and provide information including:

• the product’s function that requires the personal data;
• a general description of the types of personal data collected and processed;
• an explanation of how the processing of personal data is relevant to the product feature; and
• identifying specific features of personal data more likely to influence the product’s development/use.

Singapore is not subject to any international general data protection regulations. Regardless, Singapore organisations that offer goods or services to individuals and organisations in the EU may be subject to the EU’s General Data Protection Regulation (the GDPR) due to the GDPR’s extraterritorial application under section 3.

Additionally, the PDPC has recognised the importance of interoperability with international data protection regimes. In 2022, Singapore joined the Global Cross-Border Privacy Rules (Global CBPR) Forum, demonstrating commitment to international data protection standards. The Global CBPR provides certification to organisations that have demonstrated their commitment to data protection, showcasing their compliance with internationally recognised data protection standards.

Singapore’s Smart Nation initiative, launched in 2014, emphasises data sharing and integration to enable innovation, including for the development of AI. In addition, the Singapore government has open data initiatives such as data.gov.sg, a government portal that provides access to over 1,600 public datasets across multiple sectors.

That being said, the PDPA constrains the sharing of identifiable personal data, requiring either consent, applicable exceptions, or de-identification as set out in the PDPC’s anonymisation guidance. There have also been emerging frameworks such as the IMDA’s AI Verify Toolkit which helps organisations validate AI performance through standardised tests across principles such as transparency, explainability, reproducibility, safety, security, robustness, fairness, data governance, accountability, human agency, inclusive growth, and societal and environmental well-being.

Unlike the GDPR, the PDPA does not distinguish biometric data as a special category requiring heightened protection. Biometric data simply falls under the umbrella “personal data” term in the PDPA when they relate to identified or identifiable individuals and are used for authentication, surveillance or profiling.

The PDPC issued a Guide on the Responsible Use of Biometric Data in Security Applications in 2022, emphasising that collection and use of biometric data must comply with the consent, notification, purpose limitation, and security obligations under the PDPA. Organisations must inform individuals when biometric data is collected, specify purposes for which it will be used, and implement robust security measures including encryption and access controls.

Singapore has no general anti-discrimination statute analogous to the UK Equality Act 2010. Instead, discrimination is addressed through sector-specific legislation, constitutional equality provisions, and the Tripartite Alliance for Fair and Progressive Employment Practices (TAFEP) guidelines in employment contexts. Article 12 of Singapore’s Constitution guarantees equality before the law, prohibiting arbitrary discrimination of its citizens.

The Model AI Governance Framework for Generative AI released by IMDA and the AI Verify Foundation in 2024 addresses fairness and bias mitigation as key principles. The framework encourages organisations to identify potential sources of bias in AI systems, including biased training data, biased algorithms, and biased interpretation of outputs. Organisations are encouraged to implement testing and monitoring to detect discriminatory outcomes and to provide mechanisms for individuals to challenge AI-driven decisions.

Singapore’s approach to cybersecurity for AI systems is governed primarily by the Cybersecurity Act 2018 (the Cybersecurity Act). Pursuant to section 7 of the Cybersecurity Act, the Commissioner of Cybersecurity can designate systems as Critical Information Infrastructure (CII) if their loss, damage, or compromise would have a “debilitating effect” on essential services, defence, foreign relations, the economy, public health, public safety, and/or public order. AI systems deployed in these critical sectors will likely fall within the scope of the CII designation. The Cybersecurity Act also establishes a framework for the protection of CII that includes complying with codes of practice, regular risk assessments and audits, and reporting obligations for cybersecurity incidents.

Sectoral regulators (such as MAS and IMDA) issue additional notices and guidelines on technology risk management, third-party outsourcing and cloud use that affect AI deployment, requiring data integrity, adversarial robustness, and incident response. For instance, MAS released the revised Technology Risk Management Guidelines in January 2021 which requires financial institutions to implement robust risk management frameworks for technology systems, including AI. These guidelines required testing and monitoring of algorithms, validation of model performance, and establishment of human oversight mechanisms.

Section 34 of the Competition Act prohibits agreements, decisions, or concerted practices which “have as their object or effect the prevention, restriction or distortion of competition within Singapore”. While this provision was intended to regulate against traditional cartels, it could potentially apply in cases of algorithmic price coordination. For example, if competing businesses deploy pricing algorithms that enable tacit coordination or facilitate parallel pricing behaviour, this would likely constitute a section 34 violation. However, where explicit human agreement is absent (i.e. the distinct algorithm deployed achieve an alignment without prior communication between the businesses), the traditional evidentiary standard of “meeting of the minds” might be harder to prove. The CCCS in its Guidelines on the Section 34 Prohibition 2016 did acknowledge that agreements may be inferred from circumstantial evidence of coordinated conduct, which could extend to situations where competing AI systems achieve coordinated outcomes through learning algorithms, machine communication, or shared data sources.

Additionally, dark patterns, designs that nudge users toward particular choices or obscure opt‑outs, can be further amplified by AI‑driven personalisation, raising concerns about consumer exploitation and behavioural manipulation. The Consumer Protection (Fair Trading) Act 2003 (the CPFTA) provides provisions that prohibits unfair practices. This includes doing or saying anything, or omitting to do or say anything, if as a result a consumer might reasonably be deceived or misled, and to make a false claim. From an AI standpoint, in July 2025, the CCCS announced that it has taken regulatory actions against a business for posting fake AI-generated five-star reviews, amounting to unfair practice, violating the CPFTA.

The Competition Act also prohibits the abuse of a business’s dominant position, pursuant to section 47. This includes predatory pricing, margin squeezing, and refusal to supply. Moreover, the CCCS Guidelines on the section 47 Prohibition recognises that control over essential inputs can confer market power. This provision has particular relevance to the AI industry, which is characterised by strong network effects, data advantages, and vertical integration.

Large technology platforms controlling essential AI infrastructure, such as cloud computing services, foundation models, or proprietary training datasets, may amount to holding dominant positions, especially if competitors cannot reasonably replicate these resources. If such platforms refuse to provide access to competitors, bundle AI services with other products on anti-competitive terms, or use their position in one market to gain advantages in adjacent markets, they may be in violation of section 47.

Under current Singapore laws, AI systems and agents do not possess a legal personality and cannot hold rights or obligations in their own name. This means AI agents do not have the capacity to enter contracts, nor the ability to act independently on behalf of principals. Academic analysis also confirms that artificial agents are not true “legal agents” but tools through which human principals act. If an AI system enters a contract, that contract binds the person who deployed the system, not the AI as an independent entity.

The IMDA published the Model AI Governance Framework for Agentic AI (Framework for Agentic AI) on 22 January 2026. The Framework for Agentic AI identifies risks arising from agentic AI such as erroneous actions, unauthorised actions, biased or unfair actions, data breaches, and disruption to connected systems. It also recommends organisations to assess and bound the risks upfront, make humans meaningfully accountable, implement technical controls and processes, and enable end-user responsibility, in order to properly manage the risks.

Sector-specific regulation of agentic AI in Singapore is emerging through soft law and pilots rather than formal recognition of an AI’s legal personality.

In the financial services industry, the MAS has issued a consultation paper proposing a set of Guidelines for AI Risk Management in November 2025 (the AI Risk Management Guidelines). The AI Risk Management Guidelines aim to establish a general set of expectations applicable across the sector. Additionally, the MAS has published its Principles to Promote Fairness, Ethics, Accountability, and Transparency (FEAT) in the Use of Artificial Intelligence and Data Analytics in Singapore’s Financial Sector, which sets out that there will be an implicit assumption that accountability remains with licensed institutions even where AI models execute tasks autonomously.

In the legal sector, the Singapore Academy of Law (SAL) and IMDA are piloting an agentic tool to automate companies’ Annual General Meeting (AGM) compliance submissions and have also launched LawNet 4.0, which includes a GenAI search engine for legal queries. Regardless, the SAL have emphasised that lawyers retain ultimate responsibility for advice and filings.

In the healthcare sector, the Health Sciences Authority (HSA) regulates AI-enabled medical devices under the Health Products Act 2007 (the Health Products Act). AI systems that diagnose, treat, or monitor patients are classified as medical devices pursuant to Schedule 1 of the Health Products Act and must obtain regulatory approval before deployment.

Singapore does not have a statutory strict product liability regime comparable to the EU’s Product Liability Directive or the UK’s Consumer Protection Act 1987. Instead, redress for harms arising from AI systems is available under contract law, tort law (negligence), and a patchwork of statutes related to consumer protection via the Unfair Contract Terms Act 1977 (the UCTA), CPFTA, and the Health Products Act.

Whether AI is treated as a “product” or “service” depends on the context. Embedded AI in physical devices (e.g. medical devices, vehicles, IT equipment) is likely analysed as part of the product, whereas cloud-based AI decision tools may be treated as services governed by contractual terms. To establish a tort, claimants must still prove the traditional requirements of duty, breach, causation, and damage. However, there are AI-specific complications such as establishing the applicable standard of care for design, training, and monitoring of models. Likewise, establishing that an AI system’s defect caused harm requires technical evidence linking system behaviour to the adverse outcome. Complex AI systems with opaque decision-making processes may make causation difficult to prove, particularly where multiple factors contribute to harm or where the AI system operated in conjunction with human decisions.

As mentioned above, Singapore does not have a general strict liability regime for AI-related harms. Instead, strict liability for AI-related harms arises mainly on a case-by-case basis. Parties often negotiate indemnities, limitations of liability and service-level obligations in AI supply contracts, which may shift risk of malfunctioning models or erroneous outputs, subject to controls such as the UCTA’s reasonableness test for exclusion clauses in business-to-business contexts. Generally, Singapore policymakers have so far favoured technology-neutral application of existing private law doctrines coupled with sectoral safety regulations rather than enacting an AI-specific strict liability regime.

Singapore lacks a general product recall framework comparable to the US Consumer Product Safety Commission. Product recalls are instead sector-specific, with different regulatory agencies having recall powers in their respective domains. For example, the HSA, under the Health Products Act, is conferred powers to mandate the recall of products it deems defective or unsafe.

Generally, manufacturers and service providers also owe duties to monitor products post-deployment and to issue safety updates when new risks are discovered. This is particularly salient for AI systems that evolve through online learning or frequent re-training.

There are, to date, no widely reported Singapore court decisions directly addressing liability for harms caused by autonomous or generative AI systems. Regardless, Singapore’s Law Society has published practice guidance that highlight the need for careful documentation of data sources, validation procedures and human oversight to defend against negligence claims and to satisfy the expectations of the legal industry.

There have been several trends suggesting increasing AI liability in disputes across various industries. For example, with increasing use of AI in employment matters such as hiring, performance evaluation, or termination decisions, the TAFEP has published articles on ensuring fair hiring when deploying AI use.

Singapore has not enacted a standalone AI Act, but has instead built a governance stack comprising statutes, binding sectoral rules, and soft-law frameworks. In May 2022, the IMDA and the PDPC jointly launched AI Verify, an AI governance testing framework and toolkit. This initiative enables organisations to conduct technical testing of AI systems against principles in Singapore’s Model AI Governance Framework. In 2023, AI Verify was then released as an open-source tool, with version 2.0 launched in 2024 incorporating expanded testing capabilities for generative AI systems. The IMDA then established the AI Verify Foundation in June 2024, an independent entity to govern and develop the AI Verify testing framework. The AI Verify Foundation operates as a multi-stakeholder body that includes government, industry, and academic representatives. This ensures the framework evolves with technological developments and international standards alignment.

Singapore’s PDPA, in relation to AI, is covered above at Section 3.1.

As mentioned in the Introduction, the Singapore government has introduced NAIS 2.0, which reinforces Singapore’s ambition to be a global hub for trusted AI, anchored by the vision of AI for the public good.

Other initiatives such as the AI Verify Foundation further highlight Singapore’s strategy of fostering collaboration between various stakeholders (such as industry players, academia, and government agencies) to ensure regulations reflect the industry standards, balancing both consumer safeguards and flexibility for growth of the AI industry. In addition, various agencies operate regulatory sandboxes that facilitate the control of AI experimentation (such as MAS’s FinTech Regulatory Sandbox, Land Transport Authority’s Sandbox for Autonomous Vehicles).

Singapore’s government has also emphasised international cooperation on AI standards. For example, Singapore is a signatory to the United Nations Education, Scientific and Cultural Organisation’s (UNESCO) Recommendation on the Ethics of Artificial Intelligence, adopted in 2021, and led the development of ASEAN’s Guide on AI Governance and Ethics, adopted in 2024.