Singapore Model AI Governance Framework for Agentic AI

What it is

The Model AI Governance Framework for Agentic AI is IMDA’s guidance on deploying AI agents responsibly. Minister for Digital Development and Information Josephine Teo launched it at the World Economic Forum in Davos on 22 January 2026. IMDA published version 1.5 on 20 May 2026 and updated it on 5 June 2026.

It builds on Singapore’s earlier Model AI Governance Framework. The framework’s starting point is that agents can take actions, adapt to new information and interact with other agents and systems. Their access to sensitive data and their ability to change their environment, such as updating a customer database or making a payment, bring new risks. Existing principles like transparency, accountability and fairness still apply, but they need translating into practice for agents, and humans remain accountable.

The framework focuses on agents built on generative AI models, while noting that rule-based and other kinds of software agents exist. IMDA describes it as a living document and invites feedback and case studies.

Who it applies to

Organisations deploying agentic AI, whether they build agents in-house or use third-party agentic solutions. It is voluntary and creates no legal obligations. Its reach goes beyond voluntary adoption in one sector, because the MAS Guidelines on AI Risk Management point financial institutions to it for agent-specific risks and governance practices.

What it requires

The framework is organised into four dimensions across the agent lifecycle.

1. Assess and bound the risks upfront. Decide whether a use case suits an agent at all, since some are better served by deterministic workflows. Risk is a function of impact and likelihood. Impact factors include the domain’s tolerance for error, the agent’s access to sensitive data and external systems, whether it can write as well as read, how many actions it can take and whether those actions can be reversed. Likelihood factors include the agent’s level of autonomy, task complexity and its exposure to external systems. Then bound the risk by design, limiting access to tools and systems and setting up identity and permissions for agents. An agent’s identity should be unique, tied to a supervising agent, human or department, and catalogued centrally to prevent agent sprawl. Its authorisations should be scoped, time or session bound, non-transferable and least-privilege by default.

2. Make humans meaningfully accountable. Allocate responsibilities clearly inside the organisation and with external vendors across the agentic value chain. Define significant checkpoints that require human approval, such as high-stakes actions, irreversible actions like deleting data, sending communications or making payments, and outlier behaviour. Keep approval requests short and clear, train the people who give them, and audit whether human oversight stays effective. The framework adapts human-in-the-loop to address automation bias, and version 1.5 adds practices such as monitoring human override rates and response times.

3. Implement technical controls and processes. Build controls for agentic components such as planning, tools and protocols during development. Test agents before deployment for baseline safety and reliability, including execution accuracy, policy adherence and tool use. Roll agents out gradually. Once deployed, continuously monitor and log agent behaviour across the user interaction, tool invocation and reasoning layers, set alert thresholds, define interventions proportionate to risk, and have failsafe and fallback measures for serious malfunction or compromise. Version 1.5 adds guidance on choosing control types and on change management.

4. Enable end-user responsibility. Tell users, as a baseline, what the agent can do, what data it can reach and what their own responsibilities are. Layer on training so employees can oversee agents effectively while keeping their own skills, which version 1.5 links to business continuity.

Key dates

• 22 January 2026. Version 1.0 launched at Davos.
• 20 May 2026. Version 1.5 published.
• 5 June 2026. Version 1.5 updated.

How it relates to other frameworks

The agentic framework extends the 2020 Model AI Governance Framework, carrying its human involvement idea into checkpoints and action boundaries for agents. For financial institutions in Singapore, the MAS AI Risk Management Guidelines, which take effect on 7 October 2027, cover all AI including AI agents, and suggest agent-specific inventory attributes such as identifiers, the tools and systems an agent can reach and its guardrails. MAS names the IMDA framework as one financial institutions may refer to for agentic AI.

Internationally, the dimensions line up with the operational controls in ISO/IEC 42001 and the Manage function of the NIST AI RMF. The agentic framework adds the agent-specific detail on identity, permissions and human checkpoints that neither goes into, so it works as a companion to either.

Putting the practices into operation

Most of the framework’s practices depend on a current record of each agent. That means knowing which agents exist, what tools and systems each can reach, which identity it acts under, who owns it, and what it actually did. Aicura’s agent governance holds agents on the same register as AI systems, records each agent’s tools and the identities it acts under when it runs, enforces which tools it may use and which actions it may take at the AI gateway that sits between agents and the models and tools they call, and logs agent decisions. The guides on governing AI agents and on agent decision logs go further into what to record.

A note on this page

This is Aicura’s reading of the framework, written to help you understand it. It is not legal advice and it is not the framework itself. Read the primary source from IMDA, and take advice on how it bears on your organisation.