AI Governance for Singapore Businesses: How to Set Rules for Staff AI Use
AI use often starts before an organisation has written formal rules for it. Staff paste contracts, customer emails and internal plans into them to save time. In some organisations, it may be unclear what was entered, where it was processed or who approved the tool.
AI governance in a business starts at this practical level: which data may go into which tools, who decides, and where the rules are written down. This guide covers the questions to answer first, how to handle each type of data under the PDPA, and a one-page interim guideline you can adapt.
TL;DR
Treat every AI tool as a system that handles company data.
For each tool, find out what data goes in, where it is processed and stored, and who can see it.
Personal data entered into any AI tool remains subject to the PDPA.
Write rules by data type, because rules built around tool names go out of date quickly.
Five questions to answer for every AI tool
What data goes in?
Customer details, contracts, financial figures, source files and internal plans carry different levels of sensitivity.
Where is it processed and stored?
Check the location, the retention period and whether the provider may use inputs for other purposes. Terms differ between services and change over time.
Who can see it?
Include the provider's staff, your own staff and any systems connected to the tool.
Who approves the tool?
Name one owner for approvals and exceptions, with input from the DPO or compliance team where personal data is involved or the use raises PDPA concerns.
How is use recorded?
If a client or auditor asks how AI is used with their information, there should be a written answer.
What the PDPA means for AI use
The PDPA's Protection Obligation requires organisations to make reasonable security arrangements for personal data in their possession or under their control. Using an AI tool does not remove that obligation where personal data remains in the organisation’s possession or control.
The PDPC's Advisory Guidelines on Use of Personal Data in Generative AI, published in July 2026, set out how the PDPA applies to generative AI. Confirm with your legal or compliance adviser how they apply to your organisation.
How to handle each type of data
The categories below are a practical example for internal AI-use rules, not a classification prescribed by the PDPA.
Data type | Examples | Handling rule |
Public | Published web content, public reports | May be used with approved tools, subject to any applicable copyright, contractual or internal-use restrictions. |
Internal | Meeting notes, internal procedures, draft documents | Use approved tools only. |
Personal data | Customer, employee or supplier records | Do not enter personal data into an AI tool until the use has been assessed against the PDPA. Removing direct identifiers does not automatically make the data anonymous. |
Confidential or high value | Contracts, financial data, design files, source code | Keep out of general-purpose tools. Use only a tool approved in writing for this data class, such as one running in an environment the organisation controls. |
Controlling where data is allowed to go applies to every system, not only AI. See Data Loss Prevention Starts With Knowing Where Data Is Allowed to Go. If you are weighing a tool that runs on your own servers, see Local LLM for Business in Singapore: Compliance and Cost Considerations.
Interim AI use guideline (template)
Copy, adapt and issue this while a full policy is developed.
Purpose. This guideline sets out how staff may use AI tools with company information until a full policy is in place.
Approved tools. [List tools.] Any other tool needs approval from [owner].
Data that must not be entered. Personal data and confidential or high-value data, as classified in your data handling table. [Attach or list the categories.] Also passwords, keys and credentials.
Data that may be entered. Public information, and text written by the user that contains nothing confidential.
Checking output. A person must review AI output before it is sent to a client or used in a decision.
Questions and incidents. Contact [name or team]. If sensitive data was entered by mistake, report it straight away so it can be assessed.
Review. This guideline is reviewed every six months.
FAQ
Should we ban AI tools until we have a policy?
A blanket ban may be simple to communicate, but it does not answer the practical question of which tools and which data are permitted.
What if staff have already entered sensitive data into a tool?
Report it, find out exactly what was entered, check the provider's retention and deletion terms, and record the incident. If personal data is involved, ask your legal adviser whether the PDPA's data breach notification requirements apply.
What about staff using personal AI accounts for work?
Company information should only be entered into tools and accounts approved for business use. Personal accounts may bypass the organisation’s access, retention and oversight controls, increasing the risk of unauthorised data exposure
