What Your Board Must Do Under Singapore’s Corporate Governance Code: AI and Technology Risk
The Requirement: Principle 8 and Guideline 8.2 The Code says:“The Board is responsible for ensuring that Management maintains sound and effective internal controls to safeguard shareholders’ interests and the company’s assets.” And:“The Board should determine the nature and extent of the significant risks which the company is willing to take in achieving its strategic objectives, and ensure that suitable internal controls and risk management systems are in place.” What regulators mean by this:Technology—including AI—is now a significant risk category. Your board must: Most boards treat technology risk as an IT governance issue. Regulators see it as a business risk that affects financial reporting, customer trust, and regulatory compliance. Why This Matters Now: Recent Regulatory Signals 1. MAS Technology Risk Notices (2022–2025) The Monetary Authority of Singapore has issued multiple notices on technology risk for financial institutions. While these apply directly to banks and insurers, they signal MAS expectations for all large entities: 2. SGX Sustainability and Governance Updates SGX’s listing rules now require disclosure of governance practices. Technology governance—especially AI governance—is becoming a disclosure expectation for listed companies. Investors are asking: Does your board know what AI you’re using? 3. PDPA Amendments and AI Singapore’s updated Personal Data Protection Act (PDPA) explicitly addresses algorithmic decision-making. Your board needs to ensure that any AI used in customer decisions (credit, hiring, pricing) complies with PDPA transparency and fairness requirements. The Four Pillars: What Your Board Needs to Implement Pillar 1: Risk Identification and Classification The Code requires: Boards must identify significant risks. Technology and AI are now significant. What to do: Red flags regulators look for: What a compliant board does: Pillar 2: Internal Controls and Testing The Code requires: Sound and effective internal controls. For AI, this means testing for bias, performance, security, and compliance. What to do: Red flags regulators look for: What a compliant board does: Pillar 3: Risk Reporting and Governance The Code requires: The board must oversee risk management and receive regular reporting. What to do: Red flags regulators look for: What a compliant board does: Pillar 4: Compliance and Regulatory Alignment The Code requires: The board must ensure compliance with applicable laws and regulations. What to do: Red flags regulators look for: What a compliant board does: The Reality: Where Boards Are Failing 1. No AI Inventory Many boards don’t know what AI their company is using. Marketing uses predictive analytics; HR uses resume screening; Finance uses anomaly detection for fraud. Without an inventory, the board can’t govern it. 2. No Independent Testing Data scientists test their own models. Regulators expect independent verification—an audit function, a separate risk team, or a third party. 3. Technology Risk Isn’t Prominent Technology/AI risk gets buried in IT reports. The board hears about system uptime and cybersecurity patches but not about AI bias, model performance, or regulatory risk. 4. No Vendor Governance Third-party AI is rarely audited. “The cloud provider is responsible” isn’t a governance answer. 5. Board Unawareness Many boards assume AI governance is “handled” without asking for specifics. When an issue arises—a lawsuit over hiring discrimination, a regulatory inquiry, a data breach—the board discovers it’s unprepared. The Compliance Checklist: What Your Board Should Approve By the end of Q1, your board should have approved: A Practical Example: How This Plays Out Scenario: Your Company Uses AI for Hiring What the Code requires (in practice): If the board doesn’t do this: What This Means for Your Board: Three Steps Step 1: Audit Your Current State Step 2: Build Your Governance Framework Step 3: Embed and Sustain Key Takeaways FAQ Section Q: Does this apply to our company? We’re not a bank or listed company. A: The Code of Corporate Governance applies to all Singapore companies. While MAS notices target financial institutions, the principles—sound internal controls, risk management, board oversight—apply universally. If your company uses AI, your board needs to govern it. Q: We use AI, but it’s low-risk (e.g., chatbots, analytics). Do we still need all this? A: Start with high-risk AI (decisions about people, financial impact, regulatory compliance). But build the framework now, so you can scale as AI use expands. Most companies underestimate their AI risk until asked to justify it. Q: Our CTO/Data Science team already handles this. Why does the board need to be involved? A: Technology teams own implementation; boards own risk and accountability. If something goes wrong—a lawsuit, a regulatory inquiry, a data breach—the board is liable. The board must understand the risks and approve the controls. Q: We use third-party cloud AI (AWS, Google, etc.). Doesn’t the vendor handle governance? A: The vendor handles their infrastructure. You handle your use of it. If your company uses a vendor’s AI to make decisions about customers, you’re responsible for bias testing, explainability, and compliance. The vendor can help, but the board must verify. Q: How does this connect to SGX disclosure requirements? A: SGX doesn’t yet mandate AI governance disclosure, but it’s coming. Companies that build governance now are ahead. Investors increasingly ask about AI governance, and transparent companies win investor confidence. Q: What if we’re just getting started with AI? Do we need full governance today? A: Start with your highest-risk use case. Document why you’re using AI, what risks it poses, how you’re testing it, and who’s accountable. Expand from there. The Code requires proportionate governance—the level of rigor should match the risk.