What Your Board Must Do Under Singapore’s Corporate Governance Code: AI and Technology Risk

The Requirement: Principle 8 and Guideline 8.2

The Code says:
“The Board is responsible for ensuring that Management maintains sound and effective internal controls to safeguard shareholders’ interests and the company’s assets.”

And:
“The Board should determine the nature and extent of the significant risks which the company is willing to take in achieving its strategic objectives, and ensure that suitable internal controls and risk management systems are in place.”

What regulators mean by this:
Technology—including AI—is now a significant risk category. Your board must:

1. Understand what technology systems (including AI) are in use and their impact on customers, operations, and compliance
2. Assess the risks these systems pose (bias, security, performance, regulatory breach)
3. Ensure controls are in place (testing, monitoring, incident response, vendor oversight)
4. Report regularly to the board on technology risk, not just IT uptime

Most boards treat technology risk as an IT governance issue. Regulators see it as a business risk that affects financial reporting, customer trust, and regulatory compliance.

Why This Matters Now: Recent Regulatory Signals

1. MAS Technology Risk Notices (2022–2025)

The Monetary Authority of Singapore has issued multiple notices on technology risk for financial institutions. While these apply directly to banks and insurers, they signal MAS expectations for all large entities:

• AI and ML models must have documented risk assessments
• High-risk AI decisions (credit, fraud detection, pricing) require explainability and human oversight
• Third-party technology vendors must be audited for compliance and data handling
• Boards must receive quarterly technology risk reports

2. SGX Sustainability and Governance Updates

SGX’s listing rules now require disclosure of governance practices. Technology governance—especially AI governance—is becoming a disclosure expectation for listed companies. Investors are asking: Does your board know what AI you’re using?

3. PDPA Amendments and AI

Singapore’s updated Personal Data Protection Act (PDPA) explicitly addresses algorithmic decision-making. Your board needs to ensure that any AI used in customer decisions (credit, hiring, pricing) complies with PDPA transparency and fairness requirements.

The Four Pillars: What Your Board Needs to Implement

Pillar 1: Risk Identification and Classification

The Code requires: Boards must identify significant risks. Technology and AI are now significant.

What to do:

• Create an AI and technology risk inventory: What AI systems does your company use? Where? What decisions do they make?
• Classify by risk level: Is the AI customer-facing (higher risk)? Does it affect regulatory compliance? Does it process sensitive data?
• Document the business case: Why is the company using AI? What problem does it solve? What could go wrong?

Red flags regulators look for:

• No inventory or list of AI systems
• AI deployed without documented risk assessment
• Board unaware of high-risk AI use

What a compliant board does:

• Reviews the technology/AI inventory quarterly
• Questions new AI deployments before they go live
• Asks: “What’s the risk, and how are we managing it?”

Pillar 2: Internal Controls and Testing

The Code requires: Sound and effective internal controls. For AI, this means testing for bias, performance, security, and compliance.

What to do:

• Bias and fairness testing: For AI that makes decisions about people (hiring, credit, pricing), test for disparate impact and discrimination
• Performance monitoring: Is the model still accurate? Has it degraded over time?
• Security and data handling: Is the training data secure? Who has access? Is it being used as intended?
• Explainability and auditability: Can the company explain why the AI made a specific decision? Are decisions logged?
• Vendor controls: If AI is outsourced (cloud models, third-party platforms), audit the vendor’s controls

Red flags regulators look for:

• No testing process or ad-hoc testing
• Testing owned only by data scientists, not independently verified
• No audit trail or decision logs
• Vendor risk not assessed

What a compliant board does:

• Requires documented testing for high-risk AI before deployment
• Receives quarterly reports on model performance and test results
• Approves the vendor risk assessment and audit process
• Asks: “How do we know the AI is working fairly and securely?”

Pillar 3: Risk Reporting and Governance

The Code requires: The board must oversee risk management and receive regular reporting.

What to do:

• Create a technology/AI risk reporting cadence: Quarterly or twice-yearly reports to the board covering:
  • New AI deployments and their risk classification
  • Test results and any bias or performance issues found
  • Incidents or complaints related to AI decisions
  • Vendor assessments and any third-party risk changes
  • Regulatory developments (PDPA, MAS, SGX updates)
• Establish clear ownership: Who owns technology risk? (Usually CTO, CRO, or Chief Data Officer, with board oversight through Audit Committee or Risk Committee)
• Set escalation criteria: What issues must be escalated to the board immediately (data breach, AI making discriminatory decisions, vendor failure)?

Red flags regulators look for:

• No technology risk reporting to the board
• Technology/AI risk mixed into general IT reporting without prominence
• No clear owner or accountability
• Board unaware of incidents or issues until after the fact

What a compliant board does:

• Receives dedicated technology/AI risk reports
• Questions management on new deployments and incidents
• Tracks action items from prior meetings
• Discusses technology risk in the context of strategic objectives and regulatory compliance

Pillar 4: Compliance and Regulatory Alignment

The Code requires: The board must ensure compliance with applicable laws and regulations.

What to do:

• PDPA compliance: Ensure AI used for profiling, decision-making, or automated processing complies with PDPA transparency and fairness rules
• Sector-specific regulations: If your company is regulated (finance, healthcare, energy), ensure AI complies with sector rules (MAS technology risk notices, healthcare data rules, etc.)
• Contractual obligations: If you serve customers or partners under data-sharing agreements, ensure AI complies with those terms
• International standards: Consider frameworks like ISO/IEC 42001 (AI Management System) or similar

Red flags regulators look for:

• AI used without legal review
• PDPA non-compliance (lack of transparency, inability to explain decisions)
• Contracts with customers/partners that aren’t being honored
• No awareness of sector-specific regulations

What a compliant board does:

• Reviews legal and compliance risks of new AI deployments
• Ensures the company can demonstrate PDPA compliance
• Monitors regulatory developments and updates governance accordingly
• Asks: “Are we compliant, and can we prove it?”

The Reality: Where Boards Are Failing

1. No AI Inventory Many boards don’t know what AI their company is using. Marketing uses predictive analytics; HR uses resume screening; Finance uses anomaly detection for fraud. Without an inventory, the board can’t govern it.

2. No Independent Testing Data scientists test their own models. Regulators expect independent verification—an audit function, a separate risk team, or a third party.

3. Technology Risk Isn’t Prominent Technology/AI risk gets buried in IT reports. The board hears about system uptime and cybersecurity patches but not about AI bias, model performance, or regulatory risk.

4. No Vendor Governance Third-party AI is rarely audited. “The cloud provider is responsible” isn’t a governance answer.

5. Board Unawareness Many boards assume AI governance is “handled” without asking for specifics. When an issue arises—a lawsuit over hiring discrimination, a regulatory inquiry, a data breach—the board discovers it’s unprepared.

The Compliance Checklist: What Your Board Should Approve

By the end of Q1, your board should have approved:

• ☐ AI and Technology Risk Policy: A documented framework for identifying, assessing, and controlling AI risk
• ☐ AI Inventory and Risk Classification: A list of all AI systems in use, classified by risk level
• ☐ Testing and Control Standards: Documented requirements for bias testing, performance monitoring, security, and audit trails
• ☐ Vendor Risk Assessment Process: Criteria and audit procedures for third-party AI platforms
• ☐ Reporting Cadence: Who reports what to the board, and when
• ☐ Escalation Criteria: What issues trigger immediate board notification
• ☐ Compliance Framework: How the company ensures PDPA, sector-specific, and contractual compliance

A Practical Example: How This Plays Out

Scenario: Your Company Uses AI for Hiring

What the Code requires (in practice):

1. Identification: The board knows the company uses AI resume screening
2. Risk assessment: HR documents that this is high-risk (discrimination liability, PDPA exposure, regulatory risk)
3. Controls:
   • Before deployment, the company tests the model for bias across protected classes
   • Quarterly, HR reports model performance and any bias findings to the Audit Committee
   • Hiring managers can see the model’s reasoning for top candidates (explainability)
   • The vendor (if third-party) is audited for data handling and compliance
4. Reporting: The board hears, quarterly, whether the model is fair, compliant, and performing as expected
5. Compliance: The company documents its PDPA compliance—how candidates are informed, how the model’s decisions are explainable, how candidates can request human review

If the board doesn’t do this:

• A discrimination lawsuit arises; the company can’t prove the model is fair
• A regulator (MAS, PDPA Commissioner) inquires; the company has no testing records
• Candidates complain they don’t understand why they were rejected; the company has no explainability process
• The board is unprepared and liable

What This Means for Your Board: Three Steps

Step 1: Audit Your Current State

• What AI systems are in use today?
• Who owns technology/AI governance?
• What testing or controls are already in place?
• What’s missing?

Step 2: Build Your Governance Framework

• Document an AI Risk Policy
• Create the inventory and risk classification
• Establish testing and vendor audit standards
• Set up the board reporting process

Step 3: Embed and Sustain

• Quarterly board reports on technology/AI risk
• Annual policy review
• Continuous monitoring of regulatory developments

Key Takeaways

1. Principle 8 of the Corporate Governance Code applies to AI. Your board must oversee technology risk, internal controls, and compliance.
2. Regulators (MAS, SGX, PDPA Commissioner) now expect AI governance. Boards that can’t demonstrate it face regulatory and legal exposure.
3. Most boards are behind. If you don’t have an AI inventory, independent testing, or dedicated risk reporting, your governance is non-compliant.
4. Compliance is a business advantage. Companies with documented AI governance attract investors, win contracts, and avoid lawsuits.

FAQ Section

Q: Does this apply to our company? We’re not a bank or listed company.

A: The Code of Corporate Governance applies to all Singapore companies. While MAS notices target financial institutions, the principles—sound internal controls, risk management, board oversight—apply universally. If your company uses AI, your board needs to govern it.

Q: We use AI, but it’s low-risk (e.g., chatbots, analytics). Do we still need all this?

A: Start with high-risk AI (decisions about people, financial impact, regulatory compliance). But build the framework now, so you can scale as AI use expands. Most companies underestimate their AI risk until asked to justify it.

Q: Our CTO/Data Science team already handles this. Why does the board need to be involved?

A: Technology teams own implementation; boards own risk and accountability. If something goes wrong—a lawsuit, a regulatory inquiry, a data breach—the board is liable. The board must understand the risks and approve the controls.

Q: We use third-party cloud AI (AWS, Google, etc.). Doesn’t the vendor handle governance?

A: The vendor handles their infrastructure. You handle your use of it. If your company uses a vendor’s AI to make decisions about customers, you’re responsible for bias testing, explainability, and compliance. The vendor can help, but the board must verify.

Q: How does this connect to SGX disclosure requirements?

A: SGX doesn’t yet mandate AI governance disclosure, but it’s coming. Companies that build governance now are ahead. Investors increasingly ask about AI governance, and transparent companies win investor confidence.

Q: What if we’re just getting started with AI? Do we need full governance today?

A: Start with your highest-risk use case. Document why you’re using AI, what risks it poses, how you’re testing it, and who’s accountable. Expand from there. The Code requires proportionate governance—the level of rigor should match the risk.