> For the complete documentation index, see [llms.txt](https://docs.solcis.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.solcis.ai/references/ai-regulatory-landscape/asia-and-the-pacific/ai-compliance-in-singapore.md).
# AI compliance in Singapore
AI compliance in Singapore: enforce your controls on what your AI systems do, with evidence held onshore, across MAS, the PDPA, the Cybersecurity Act and government ICT rules.
*You bring your adopted compliance controls. Solcis Compliance Studio maps them to whichever Singapore regulations apply, and the Solcis Policy Engine enforces them on what your AI systems do, with evidence held onshore.*
AI compliance in Singapore means enforcing your adopted controls on what your AI systems do, with each decision traceable to the clause it satisfies, independently verifiable evidence of every decision, and that evidence held onshore where you need it to be. It supports your compliance across the Singapore frameworks that apply to you, including the Monetary Authority of Singapore's (MAS) guidelines and notices, the Personal Data Protection Act (PDPA), the Cybersecurity Act and the government's ICT rules. It is the jurisdiction-specific case of [runtime AI compliance](/references/concepts/runtime-ai-compliance.md).
## Key takeaways
* Singapore has no AI-specific law and has not announced one. It governs AI through sector regulation, existing law and voluntary frameworks, including IMDA's Model AI Governance Framework for Agentic AI (January 2026).
* MAS issued its final Guidelines on Artificial Intelligence Risk Management on 7 October 2026. They take effect on 7 October 2027, with lifecycle-control expectations applying from 7 October 2028, and they expressly call on financial institutions to review controls as they use agentic AI.
* MAS's Safeguards for Agentic Finance at Runtime (SAFR) paper describes a runtime layer that evaluates each agent action against a controls repository and records it in a tamper-evident log. It is an industry reference, not supervisory guidance.
* The amended Cybersecurity Act, in force from 31 October 2025, lets CSA designate virtual and cloud-hosted systems as critical information infrastructure (CII), and the 2026 Cybersecurity Code of Practice extends baseline controls to systems connected to CII.
* Singapore has no general data-localisation rule. Onshore requirements come from government cloud policy, CII rules, sector expectations and contracts.
* Sovereignty answers where your data and infrastructure sit. AI compliance answers what your AI systems are allowed to do. Both are required.
* Onshore infrastructure is where the evidence is hosted. The Solcis Policy Engine enforces your adopted controls, and Solcis Compliance Studio holds and reports the resulting evidence.
## What's shaping AI compliance in Singapore?
AI compliance in Singapore is shaped by three forces: regulators writing expectations and controls for AI systems that act, a policy push to strengthen and license the infrastructure those systems run on, and existing laws that reach AI systems whether or not they were written for them.
### Regulators are addressing AI systems that act
MAS's [Guidelines on Artificial Intelligence Risk Management](https://www.mas.gov.sg/regulation/guidelines/guidelines-on-artificial-intelligence-risk-management-for-financial-institutions), [issued on 7 October 2026](https://www.mas.gov.sg/news/media-releases/2026/mas-sets-out-supervisory-expectations-on-responsible-ai-adoption-by-financial-institutions) after consultation from November 2025, apply to all financial institutions and all forms of AI. They expect boards and senior management to set roles, risk appetite and risk management frameworks for AI; institutions to maintain AI inventories and assess the risk materiality of each use case by impact, complexity and reliance; and lifecycle controls covering data governance, testing, human oversight, cybersecurity, monitoring and change management. MAS says institutions should review those controls as they make greater use of agentic AI systems that can operate autonomously and access tools, and that it intends to consult in 2027 on further guidance for agentic AI. Institutions remain accountable for AI provided by third parties.
MAS has also published [Safeguards for Agentic Finance at Runtime](https://www.mas.gov.sg/publications/monographs-or-information-paper/2026/safeguards-for-agentic-finance-at-runtime) (SAFR), developed with banks, insurers, payment networks and technology firms. Version 1.0 was published in July 2026 and version 1.1 in October 2026. SAFR describes a runtime layer in which each agent action is checked against a controls repository drawn from organisational policies, regulatory requirements, product rules and user mandates, evaluated deterministically, and written to a tamper-evident, append-only audit log. SAFR states that it does not constitute regulatory guidance or supervisory expectations. In our reading, it is the clearest public description yet from a financial regulator of what runtime control of AI agents looks like.
Outside financial services, the Infocomm Media Development Authority (IMDA) launched the [Model AI Governance Framework for Agentic AI](https://www.imda.gov.sg/resources/press-releases-factsheets-and-speeches/press-releases/2026/new-model-ai-governance-framework-for-agentic-ai) on 22 January 2026. It is voluntary and holds that humans are ultimately accountable. Its four dimensions are bounding risks upfront by limiting agents' autonomy and access to tools and data; making humans meaningfully accountable by defining significant checkpoints at which human approval is required; implementing technical controls throughout the agent lifecycle, such as baseline testing and controlling access to whitelisted services; and enabling end-user responsibility through transparency and training. It builds on the [Model AI Governance Framework for Generative AI](https://aiverifyfoundation.sg/resources/mgf-gen-ai/) (May 2024) and the [AI Verify](https://aiverifyfoundation.sg/) testing toolkit.
The Cyber Security Agency of Singapore (CSA) followed its [Guidelines and Companion Guide on Securing AI Systems](https://www.csa.gov.sg/news-events/press-releases/launch-of-guidelines-and-companion-guide-on-securing-artificial-intelligence-systems/) (October 2024) with [Securing Agentic AI – An Addendum](https://www.csa.gov.sg/resources/publications/addendum-on-securing-ai-systems/), consulted on from October 2025 and released in June 2026. It names rogue actions and sensitive data disclosure as the primary agentic risks and asks organisations to assess each agent's level of autonomy, threat-model agentic workflows and apply agent-specific controls.
### Infrastructure policy is strengthening and licensing what AI runs on
The [Cybersecurity (Amendment) Act 2024](https://www.csa.gov.sg/news-events/press-releases/provisions-in-the-cybersecurity--amendment--act-to-come-into-force-on-31-october-2025/) brought its updated CII regime into force on 31 October 2025. CSA can now designate virtual systems as CII, and [the CII owner remains responsible](https://www.csa.gov.sg/faqs/cybersecurity-act) whether the CII is on-premise or virtual. The Act also creates regimes for major foundational digital infrastructure providers, such as cloud and data-centre operators, and for entities of special cybersecurity interest; those parts were not included in the October 2025 commencement.
The [Digital Infrastructure Bill](https://www.mddi.gov.sg/newsroom/new-digital-infrastructure-bill-to-strengthen-the-foundations-for-singapore-s-digital-economy/), introduced in Parliament on 8 September 2026, would require IMDA licences for co-location and cloud data centres of at least 10 MW and for large cloud providers serving Singapore users, with security risk management, business continuity and incident reporting obligations. It had not passed at the time of review.
For government, the [Government on Commercial Cloud](https://developer.tech.gov.sg/products/categories/infrastructure-and-hosting/gcc/overview) (GCC) platform runs on AWS, Microsoft Azure and Google Cloud, hosting systems up to Confidential (Cloud-Eligible) on GCC 2.0 and Confidential on GCC+. Agencies must apply the [Instruction Manual for ICT\&SS Management](https://developer.tech.gov.sg/guidelines/standards-and-best-practices/instruction-manual-for-ict-ss-management) (IM8), whose requirements scale with system criticality and data classification and must be carried into tender specifications.
Singapore is also adding capacity under its [Green Data Centre Roadmap](https://www.imda.gov.sg/how-we-can-help/green-dc-roadmap). In August 2026, 200 MW of new capacity was [provisionally allocated](https://technode.global/2026/08/21/singapore-allocates-200-mw-of-new-data-center-capacity-to-digital-realty-equinix-keppel-st-telemedia/) to Digital Realty, Equinix, Keppel DC and STT GDC.
### Existing laws reach AI systems
The [PDPA](https://www.pdpc.gov.sg/overview-of-pdpa/the-legislation/personal-data-protection-act) applies to AI systems that use personal data. The Personal Data Protection Commission's (PDPC) [Advisory Guidelines on the Use of Personal Data in AI Recommendation and Decision Systems](https://www.pdpc.gov.sg/-/media/files/pdpc/pdf-files/advisory-guidelines/advisory-guidelines-on-the-use-of-personal-data-in-ai-recommendation-and-decision-systems.pdf) (March 2024) explain how consent, notification and accountability apply. Notifications should be proportionate to the risk and autonomy of the system, and organisations should have written policies covering fairness and safeguards that are available on request. The guidelines are not legally binding, but the obligations they interpret are. PDPC [consulted in June 2026](https://www.lw.com/en/insights/singapore-ai-guidance-governance-data-protection-and-legal-responsibility) on further guidelines for generative AI that name agent and tool activity data as covered by the Protection Obligation; these are not yet final.
Under the [Cybersecurity Act](https://www.csa.gov.sg/faqs/cybersecurity-act), CII owners across 11 sectors must meet the Cybersecurity Code of Practice and report prescribed incidents to CSA within two hours of becoming aware. The [updated Code of Practice](https://www.csa.gov.sg/news-events/press-releases/cybersecurity-code-of-practice-for-critical-information-infrastructure-to-be-updated-to-address-apt-and-ai-enabled-threats/), announced in July 2026 to address advanced persistent threats and AI-enabled threats, extends mandatory controls such as least-privilege accounts, multi-factor authentication for privileged accounts and monitoring to systems interconnected with CII. Most new obligations apply from July 2027.
MAS's binding technology risk management notices (for banks, [Notice FSM-N05](https://www.mas.gov.sg/-/media/mas-media-library/regulation/notices/trpd/notice-fsm-n05/mas-notice-fsm-n05.pdf)) require notification to MAS within one hour of discovering a relevant incident and cap unscheduled downtime of critical systems at four hours in any 12 months. Neither the PDPA nor the Cybersecurity Act was written for AI systems, but both apply where AI systems operate.
## Which regulations and regulators bear on AI systems in Singapore?
The table sets out what each instrument requires and how it applies to AI systems that take actions, across financial services, privacy, critical infrastructure and government.
| Regulation / regulator | What it requires | Relevance to AI systems |
| ------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **MAS Guidelines on AI Risk Management**, plus technology risk and outsourcing notices (all financial institutions) | The [AI Risk Management Guidelines](https://www.mas.gov.sg/regulation/guidelines/guidelines-on-artificial-intelligence-risk-management-for-financial-institutions) (issued 7 October 2026) take effect on 7 October 2027 for governance, oversight, inventory and risk-materiality expectations, and from 7 October 2028 for lifecycle controls. They are supervisory expectations applied proportionately. [Notice FSM-N05](https://www.mas.gov.sg/-/media/mas-media-library/regulation/notices/trpd/notice-fsm-n05/mas-notice-fsm-n05.pdf) (banks) is binding: one-hour incident notification, a root-cause report within 14 days, and a four-hour recovery time objective for critical systems. [Outsourcing Notice 658 and the Outsourcing Guidelines](https://www.mas.gov.sg/regulation/third-party-risk-management), in effect from 11 December 2024, govern material outsourcing and services involving customer information. | The guidelines expressly address agentic AI and hold institutions accountable for third-party AI, including compensating controls or limiting, suspending or replacing a service whose risk cannot be brought within appetite. [SAFR](https://www.mas.gov.sg/publications/monographs-or-information-paper/2026/safeguards-for-agentic-finance-at-runtime) gives an industry reference model for runtime safeguards. |
| **PDPA 2012** and PDPC advisory guidelines (all private-sector organisations) | Consent, notification, purpose limitation, protection and accountability obligations apply to personal data used in AI systems. The [AI advisory guidelines](https://www.pdpc.gov.sg/-/media/files/pdpc/pdf-files/advisory-guidelines/advisory-guidelines-on-the-use-of-personal-data-in-ai-recommendation-and-decision-systems.pdf) explain when the Business Improvement and Research exceptions allow use without consent. Notifiable data breaches must be reported to PDPC within three calendar days of assessing them as notifiable. The Transfer Limitation Obligation (section 26) permits overseas transfer where the recipient is bound to a comparable standard of protection. | Covers AI systems that make or support recommendations and decisions using personal data. It does not prohibit automated decisions; it requires transparency proportionate to the system's risk and autonomy, and documented accountability. |
| **Cybersecurity Act 2018**, as amended, and the Cybersecurity Code of Practice (CII owners) | The [amended Act](https://www.csa.gov.sg/faqs/cybersecurity-act) (in force 31 October 2025) covers CII in 11 sectors, including virtual and provider-hosted CII, and adds Systems of Temporary Cybersecurity Concern. CII owners must report prescribed incidents within two hours. The [2026 Code of Practice](https://www.csa.gov.sg/news-events/press-releases/cybersecurity-code-of-practice-for-critical-information-infrastructure-to-be-updated-to-address-apt-and-ai-enabled-threats/) extends mandatory controls to interconnected systems, with most new obligations from July 2027. | An AI system that is part of, or connected to, CII falls within the owner's obligations, including access control, monitoring and incident reporting. CSA's [agentic AI addendum](https://www.csa.gov.sg/resources/publications/addendum-on-securing-ai-systems/) sets out the voluntary agent-specific controls. |
| **Government ICT: IM8 and GCC** (ministries, organs of state and statutory boards) | [IM8](https://developer.tech.gov.sg/guidelines/standards-and-best-practices/instruction-manual-for-ict-ss-management) is compulsory for public agencies, with requirements tiered by system criticality and data classification, and must be carried into tender specifications. Systems up to Confidential are hosted on [GCC 2.0 and GCC+](https://developer.tech.gov.sg/products/categories/infrastructure-and-hosting/gcc/overview). | AI systems built for or supplied to government inherit IM8 requirements through procurement. The full text of IM8 is not public, so suppliers should confirm applicable requirements with the agency. |
| **IMDA and CSA agentic AI frameworks** (voluntary, all sectors) | The [Model AI Governance Framework for Agentic AI](https://www.imda.gov.sg/resources/press-releases-factsheets-and-speeches/press-releases/2026/new-model-ai-governance-framework-for-agentic-ai) (January 2026) sets four dimensions: bound the risks, keep humans meaningfully accountable through approval checkpoints, apply technical controls across the lifecycle, and enable end-user responsibility. CSA's addendum adds autonomy assessment, threat modelling and agent-specific security controls. | Not binding, but the reference point regulators, customers and auditors use. The human-approval checkpoints and technical controls map closely to runtime enforcement at the action boundary. |
*Singapore's AI compliance landscape across financial services, privacy, critical infrastructure and government.*
Other reference points include MAS's [Project MindForge AI risk management toolkit](https://www.mas.gov.sg/news/media-releases/2026/mas-partners-industry-to-develop-ai-risk-management-toolkit-for-the-financial-sector) (March 2026), which covers traditional, generative and agentic AI; and, for healthcare, the Ministry of Health's [AI in Healthcare Guidelines 2.0](https://isomer-user-content.by.gov.sg/7/f5b5f08c-4c34-499c-89d4-3368b5d93088/MOH%20MHC%20Cir%200024_2026%20Updated%20MOH%20Artificial%20Intelligence%20in%20Healthcare%20Guidelines%20\(AIHGle%202.0\).pdf) (March 2026), the Health Sciences Authority's [regulation of software as a medical device](https://www.hsa.gov.sg/medical-devices/digital-health/), and the [Health Information Act 2026](https://sso.agc.gov.sg/Act/HIA2026/Uncommenced/20260524024313?DocDate=20260212), passed but not yet in force.
## Why does data sovereignty matter for AI systems in Singapore?
Data sovereignty keeps AI system activity, and the evidence of it, under Singapore jurisdiction. Evidence held onshore stays within reach of a Singapore court or regulator.
Singapore's approach is accountability rather than localisation. The PDPA's Transfer Limitation Obligation allows personal data to leave Singapore if the recipient is bound by legally enforceable obligations, or holds a recognised certification, that give a standard of protection comparable to the PDPA. Since March 2026, the recognised certifications include the Global Cross-Border Privacy Rules.
Location still matters in specific places. CII is defined as a system located wholly or partly in Singapore and necessary for an essential service, and its owner stays accountable even when it runs on a provider's virtual infrastructure. Government data up to Confidential is hosted on GCC, which runs in the hyperscalers' Singapore regions. MAS's outsourcing framework requires institutions to retain oversight of material outsourced services, including audit rights for the institution and MAS. Where onshore hosting is required, it provides the physical boundary, and AI compliance enforces what happens inside it. Neither substitutes for the other.
Ownership is a separate question from location. Several of Singapore's largest data-centre operators changed hands or took on foreign investors in 2024–2026, and the hyperscaler regions are operated by companies subject to their home governments' disclosure laws. Organisations with sovereignty requirements should assess ownership and control, not only location.
## Applying AI compliance in Singapore
Applying AI compliance in Singapore means applying the [properties of runtime AI compliance](/references/concepts/runtime-ai-compliance.md) to Singapore regulatory inputs: MAS's guidelines and notices, the PDPA, the Cybersecurity Act and government ICT requirements.
* **Preventive enforcement at the action boundary.** The Solcis Policy Engine evaluates the intended action against the applicable controls before it executes wherever possible, returning `Allow`, `Deny` or `Escalate` with a severity rating.
* **Control-to-clause traceability.** In Solcis Compliance Studio, each adopted control is tied back to the exact clause it satisfies. That might be a human-oversight control under MAS's AI Risk Management Guidelines, a least-privilege control under the Cybersecurity Code of Practice, or a PDPA notification obligation.
* **Runtime enforcement, inline.** Where the Solcis Policy Engine enforces inline, the control fires at the moment the AI system tries to act, and the decision is reached before the action proceeds.
* **Tamper-evident and independently verifiable evidence.** Each decision is recorded cryptographically at the moment it is made, in the Solcis Compliance Studio evidence ledger. An auditor or MAS can verify that the record is complete and unaltered using standard tooling, without trusting the organisation or Solcis. Verification establishes what the record says and that it has not changed, not that the underlying decision was correct.
To see these in action, consider a Singapore bank that deploys an AI agent to handle customer requests for cross-border fund transfers. Having rated the use case as high materiality under its AI risk management framework, the bank requires a payments officer to approve any transfer to a new overseas payee or above a set amount, consistent with MAS's expectation of human oversight and IMDA's human-approval checkpoints.
When the agent attempts to send a transfer to a new overseas payee, the Solcis Policy Engine escalates rather than letting the action complete, and a payments officer reviews the request and approves or rejects it. Solcis Compliance Studio then records a tamper-evident record of the escalation and the officer's decision – auditable evidence that the control was enforced and how the decision was reached. Because the agent uses customer personal data, the same workflow is one the bank's PDPA notifications and accountability policies must cover. A public agency would trace an equivalent control to the human-approval checkpoints in IMDA's agentic AI framework and its own IM8 requirements.
That record is trustworthy because it is cryptographically verifiable, not because of where it is hosted. Where the evidence physically sits is a separate question, covered next.
## Where can AI compliance be deployed onshore?
The providers below offer onshore infrastructure that can keep Solcis Policy Engine enforcement, and its evidence in Solcis Compliance Studio, under Singapore jurisdiction. Singapore has no single hosting-certification scheme equivalent to Australia's HCF. Cloud services are certified against the [Multi-Tier Cloud Security standard (MTCS SS 584)](https://www.imda.gov.sg/regulations-and-licensing-listing/ict-standards-and-quality-of-service/it-standards-and-frameworks/compliance-and-certification), administered by IMDA, with Level 3 the highest tier; MTCS applies to cloud services, not co-location facilities. Government workloads use GCC. Certification status should be checked against IMDA's list of MTCS-certified services and each provider's current certificates.
| Cloud providers / data-centre operators | Certification and ownership | Relevance |
| ---------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------- |
| [**ST Telemedia Global Data Centres**](https://www.sttelemediagdc.com/) (STT GDC) | Singapore-founded data-centre operator and a recipient of the August 2026 capacity allocation. A consortium of KKR (75%) and Singtel (25%) [completed its acquisition](https://technode.global/2026/09/03/kkr-singtel-consortium-completes-takeover-of-singapores-stt-gdc-at-10-9b/) in September 2026. | Physical hosting at scale for enterprise and AI workloads, now under mixed foreign and Singaporean ownership. |
| **Singtel Nxera** | Singtel's data-centre business; KKR holds a minority stake in the regional business. [DC Tuas](https://www.datacenterdynamics.com/en/news/singtels-nxera-opens-singapore-data-center/) (58 MW) opened in early 2026. Singtel also markets RE:AI as a sovereign AI cloud. | AI-ready capacity from a Singapore-listed operator. |
| [**Keppel Data Centres**](https://www.keppel.com/) / Keppel DC REIT | Owned by Singapore-listed Keppel and Keppel DC REIT; a recipient of the August 2026 capacity allocation. | Singapore-owned physical hosting. |
| [**Equinix**](https://www.equinix.com/data-centers/asia-pacific-colocation/singapore-colocation/singapore-data-center) | Multiple Singapore campuses certified to ISO 27001 and SS 564, with SOC 1/2 and PCI DSS attestations. US-listed. | Interconnection-dense co-location with direct cloud on-ramps, under foreign ownership. |
| [**Digital Realty**](https://www.digitalrealty.com/) | Singapore campuses; a recipient of the August 2026 capacity allocation. US-listed. | Co-location capacity under foreign ownership. |
| [**AirTrunk**](https://airtrunk.com/) SGP1 | Hyperscale campus at Loyang. Owned since 2024 by a [Blackstone-led consortium](https://www.blackstone.com/news/press/blackstone-announces-agreement-to-acquire-airtrunk-in-a-a24b-transaction/) including CPP Investments. | High-capacity physical infrastructure for large AI workloads onshore, under foreign ownership. |
| **Hyperscaler Singapore regions** (AWS, Azure, Google Cloud, Oracle) *Onshore hosting, offshore ownership* | AWS (ap-southeast-1), Microsoft Azure (Southeast Asia), Google Cloud (asia-southeast1) and Oracle Cloud Infrastructure hold [MTCS Level 3](https://www.imda.gov.sg/regulations-and-licensing-listing/ict-standards-and-quality-of-service/it-standards-and-frameworks/compliance-and-certification) certification. AWS, Azure and Google Cloud underpin [GCC](https://developer.tech.gov.sg/products/categories/infrastructure-and-hosting/gcc/overview); Oracle does not. | Data is hosted locally, but parent companies remain subject to foreign disclosure laws. |
*Onshore hosting options in Singapore. MTCS certification applies to cloud services; co-location operators hold facility-level certifications instead.*
## Frequently asked questions
Is there an AI law in Singapore?
No, and none has been announced. Singapore governs AI through sector regulators such as MAS, existing laws such as the PDPA and the Cybersecurity Act, and voluntary frameworks such as IMDA's Model AI Governance Frameworks and CSA's guidelines on securing AI systems. Targeted laws address specific harms, such as deepfakes of election candidates.
Do MAS's AI Risk Management Guidelines apply to agentic AI?
Yes. The guidelines apply to all forms of AI technology, and MAS expressly asks financial institutions to review their controls as they make greater use of agentic AI systems that operate autonomously and access tools. MAS intends to consult in 2027 on further agentic AI guidance. The guidelines take effect on 7 October 2027, with lifecycle-control expectations from 7 October 2028.
What is SAFR, and is it a requirement?
Safeguards for Agentic Finance at Runtime is an MAS paper, developed with industry, describing runtime safeguards for AI agents in finance: agent identity, a controls repository, a deterministic decision engine and a tamper-evident audit log. It states that it is not regulatory guidance or a supervisory expectation. It is a useful reference for how runtime control of agents can be designed and evidenced.
How does the PDPA apply to AI systems?
The PDPA applies whenever an AI system collects, uses or discloses personal data. PDPC's advisory guidelines explain when consent is needed, when the Business Improvement or Research exceptions apply, and what notifications and written policies are expected. Transparency should be proportionate to the system's risk and autonomy. The PDPA does not ban automated decisions or require human review.
Is the Cybersecurity Act relevant if we're not a CII owner ourselves?
It depends. The Act regulates CII owners, not their suppliers directly. But CII owners remain responsible for CII hosted by providers, and the 2026 Code of Practice extends mandatory controls to systems interconnected with CII, which usually flows through to suppliers in contract terms. If you have no relationship with a CII owner, the CII obligations do not apply to you.
Can AI compliance run onshore in Singapore?
Yes. Singapore-based data-centre operators, Singtel's RE:AI offering and the hyperscalers' MTCS-certified Singapore regions all support onshore deployments. Physical hosting alone does not control an AI system's behaviour; that needs a runtime enforcement layer, such as the Solcis Policy Engine, that evaluates each action, with each decision recorded in Solcis Compliance Studio.
What's the difference between MTCS certification and GCC?
MTCS SS 584 is an IMDA-administered certification scheme for cloud services, with three levels; Level 3 has the most stringent requirements. GCC is the Singapore Government's managed platform on commercial cloud, built on AWS, Azure and Google Cloud, for government systems up to Confidential. A provider can hold MTCS Level 3 without being part of GCC, as Oracle does.
***
This page is general information about how Solcis supports work against Singapore instruments. It is not legal or regulatory advice. Confirm your obligations with a qualified professional and the primary source. Last reviewed: 20 October 2026.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://docs.solcis.ai/references/ai-regulatory-landscape/asia-and-the-pacific/ai-compliance-in-singapore.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.