Singapore spells out how personal data can be used in GenAI

Agentic AI raises the stakes

The announcements come amid the growing adoption of agentic AI systems, which industry leaders and regulators said would test existing AI governance practices.

Speaking on a panel moderated by J. Trevor Hughes, president and CEO of the International Association of Privacy Professionals, Lee Wan Sie, IMDA’s cluster director for AI governance and safety, pointed to the authority’s model AI governance framework for agentic AI, which was released in January this year and significantly expanded in May with practical examples from early deployments.

She noted that recent tests conducted with partners in South Korea found that “if you give agents a particular objective, they’ll do all they can to achieve that objective – and in that process, accidentally release sensitive data”.

Language is another weak spot. Teo revealed that an AI safety red teaming challenge held in January, involving more than 80 experts from ASEAN member states as well as China, India, Japan and South Korea, found that “casual local phrasing could slip through the safeguards that a formal-sounding request could not”.

“This vulnerability and many others that were identified were not only technical; they were also linguistic and cultural,” she said.

Markham Cho Erickson, Google’s vice-president of government affairs and public policy, estimated that agentic AI could add between $3tn and $5tn to the global economy, but acknowledged that new use cases introduce tension into privacy, safety and security rules. “One shorthand way I like to think about it is, if something is improper or unlawful to do without agentic AI, it should be improper or unlawful to do with agentic AI,” he said.

The challenge for industry, he added, is deciding when to keep agentic interactions seamless and when to intentionally introduce friction into the process where it’s important for user safety and security at critical moments. “That’s the secret sauce,” he said.

For Nimish Panchmatia, chief data and transformation officer at DBS Bank, the technology itself is the least of his worries. AI is the easy part, he said – the hard work is in getting data, processes and controls right, and too many organisations chase what the technology can do without working out what it takes to operationalise it.

DBS is applying AI in its own governance tooling, which Panchmatia regards as the only way oversight can keep pace, particularly as chatbot interactions shift from text to voice and interventions against toxic or hallucinated outputs must happen in real time. He also called for organisations to rethink siloed oversight functions, noting that cyber security, privacy and data management have become too intertwined to be governed separately.

Simon Chesterman, vice-provost at the National University of Singapore (NUS) and AI governance and policy lead at NUS AI Institute, argued that the bigger disruption to AI governance will come from the use of live data streams – as opposed to static training datasets – by AI systems.

“We don’t need governance of datasets anymore – we need governance of data flows,” he said, warning that consent-based models are straining as AI systems begin inferring information that goes far beyond the data points users agreed to share. Users, he suggested, may need “something more like a prenup” for their relationships with increasingly human-like AI systems.

Guidance on digital twins and federated learning

Separately, the IMDA launched the Digital Twin for Enterprises Playbook, touted as Singapore’s first practical field guide to help non-ICT enterprises adopt the technology.

Among its case studies is facilities management firm Exceltec, whose digital twin consolidates data from internet of things sensors, building systems and maintenance logs across its managed sites into a single platform – eliminating manual pump inspections to save about 45 minutes of technician time daily, and opening up new revenue as the company looks to commercialise the solution to partners.

The PDPC also released a guide on federated learning, which enables collaboration without sharing original data, and updated its guide on synthetic data generation, alongside a refreshed data protection guide for ICT systems that now covers AI implementation practices.

Rounding out the announcements, the PDPC signed a memorandum of cooperation with Japan’s Personal Information Protection Commission to promote cross-border privacy rules and develop model contractual clauses, in a bid to lower compliance costs for businesses transferring data between the two countries.

With Singapore set to assume the ASEAN chairmanship next year, Teo said the city-state would work with regional partners to bring their governance approaches closer together and reduce friction for businesses. “None of us can build a trusted data ecosystem by looking only within our borders,” she said.