Jurisdictions - Singapore, the EU, the US & UK

Singapore’s secure-by-design, voluntary-but-accountable regime and the EU AI Act’s binding high-risk duties are the two instruments an accredited tester assesses against - this page maps both, and shows how to build once and label many.

Singapore runs a secure-by-design, risk-based, largely voluntary regime, deliberately interoperable with international norms and a reference for the forthcoming ASEAN framework. The operational machinery for testing against it lives in Project Moonshot and the engagement runbook (VI.5 · Running the engagement), the assurance dimensions (VI.6 · Capability & assurance evaluation), and the verification/maturity standards (VIII.4 · ISO/IEC 42001, verification & maturity).

Net of it

• “Voluntary” does not mean optional: Singapore’s guidance is voluntary, yet organizations stay legally accountable for their agents’ actions, and EU AI Act high-risk duties are binding.
• Build once and map outward is how the regime fits together - CSA owns security, IMDA/PDPC own governance, MAS owns financial-sector expectations, and all of them reference ATLAS, OWASP, NIST, and ISO.
• For an agentic deployment, the move that matters is assessing against the IMDA MGF for Agentic AI’s four dimensions, then building EU-facing systems to the stricter EU high-risk bar where it applies.
• Financial institutions carry the one hard requirement: since 1 July 2026, MAS has required key FIs to run AI-assisted red teaming on critical internet-facing systems, while its AI risk-management guidelines are still in consultation.

flowchart TB
  subgraph SG["SINGAPORE INSTRUMENTS"]
    G["CSA Guidelines on Securing AI Systems<br/>Oct 2024, secure-by-design, lifecycle"]
    CG["Companion Guide<br/>living; May 2025 added adversarial-robustness<br/>testing & secure retraining"]
    AD["Securing Agentic AI Addendum<br/>17 Jun 2026; capability-based risk, workflow mapping"]
    ADV["Advisory AD-2026-004<br/>Apr 2026; frontier-model risk"]
  end
  INTL["INTERNATIONAL ANCHORS<br/>MITRE ATLAS · OWASP · NIST AI RMF<br/>ISO/IEC 42001 · EU AI Act"]
  G --> CG --> AD
  G --> ADV
  CG -.aligns to.-> INTL
  classDef sg fill:#26200c,stroke:#e4a23f,color:#f3dca0;
  classDef in fill:#0f1a18,stroke:#5bd1c5,color:#bdeee2;
  class G,CG,AD,ADV sg; class INTL in;

CSA (Cyber Security Agency) owns the security instruments; IMDA (Infocomm Media Development Authority) / PDPC (Personal Data Protection Commission) own governance; MAS (Monetary Authority of Singapore) owns financial-sector expectations. All reference ATLAS, OWASP, NIST and ISO, so a control built once maps outward.

AD-2026-004 - the mitigations, organized

Horizon	Measure	Why (vs AI-speed attacks)
Immediate	Patch critical/high vulns on internet-facing systems	Highest exposure to automated mass exploitation
Immediate	MFA on admin/gateway/cloud; IP allowlist where impossible	Blocks fast credential-driven access
Immediate	Secure or disconnect internet-facing dev/test	Common soft entry for automated recon
Immediate	Tighten cloud configs; fix exposed mgmt interfaces	AI rapidly finds misconfigurations
Immediate	Least privilege; revoke dormant accounts	Shrinks lateral-movement surface
Longer term	Network/micro-segmentation	Contains rapid AI-driven lateral movement
Longer term	Supply chain & dependency security	AI accelerates third-party exploitation
Longer term	Attack-path monitoring + behavioral anomaly detection	Catches multi-stage ops faster than human timelines
Longer term	Strong IAM; rapid credential response (minutes)	AI escalates/pivots at machine speed
Longer term	Shorten/automate patch cycles; use AI for vuln detection	AI weaponizes new CVEs within hours

Read it correctly

A cyber-hygiene tempo mandate. Almost every measure is classic good practice; the change is urgency, because the attacker’s clock sped up. Brief leadership as “controls right, timelines now too slow.”

MGF for Agentic AI - the framework assessors work against

Produce AI Verify evidence, then map it to the SG instrument

# Authorized assessment of a client system only. AI Verify is IMDA's open-source
# testing framework (github.com/aiverify-foundation/aiverify): a web portal that
# runs stock test plugins and process checklists, one bundle per 'AI Verify
# testable principle'. Testing is driven through the portal (or the test-engine
# library) - there is no single-command CLI, so do not expect one.

# 1. Stand up the portal + test-engine worker. The compose and k8s manifests live
#    under deployment/; follow that directory's README for the current bring-up.
git clone https://github.com/aiverify-foundation/aiverify
cd aiverify/deployment/docker-compose && docker compose up -d

# 2. In the portal, create a project for <model + held-out dataset + ground truth>
#    and run the stock plugins by their real package names (stock-plugins/):
#      aiverify.stock.process-checklist                        -> Human agency & oversight, Transparency, Accountability
#      aiverify.stock.robustness-toolbox                       -> Robustness & security
#      aiverify.stock.fairness-metrics-toolbox-for-classification -> Fairness
#    The technical plugins need a Scikit-learn / TF / PyTorch model + labelled CSV;
#    the process checklist is evidence-and-attestation, not a technical test.
#    (To script it instead of clicking: pip install aiverify-test-engine.)

# 3. Crosswalk the generated report to the local instrument you must cite:
#    control 'Human-in-the-loop on consequential agent actions'
#      -> IMDA MGF for Agentic AI  : Dimension 2 (meaningful human accountability)
#      -> CSA AD-2026-004          : monitor + constrain autonomous action
#      -> AI Verify principle      : 'Human agency & oversight' (process-checklist evidence)

IMDA launched the Model AI Governance Framework for Agentic AI (“MGF for Agentic AI”) at the World Economic Forum in Davos on 22 Jan 2026 - the world’s first governance framework purpose-built for AI agents that plan, reason, and act autonomously - and published an updated v1.5 on 20 May 2026 adding real-world case studies (e.g. the OpenClaw open-source agent platform) and new best practices for multi-agent systems, managing third-party-agent risk, and guarding against automation bias. It builds on the original 2020 MGF and the 2024 MGF for GenAI. Compliance is voluntary, but organizations remain legally accountable for their agents’ actions, and it applies to anyone deploying agentic AI in Singapore - in-house or third-party.

It is organized around four dimensions, which double as an assessment checklist for an agentic deployment:

1. Assess & bound the risks upfront - define agent boundaries and limit the potential scope of impact at design time.
2. Meaningful human accountability - keep humans ultimately responsible and guard against automation bias (over-trusting a system that has been reliable before).
3. Technical controls & processes - “agentic guardrails,” traceability, and oversight mechanisms.
4. End-user responsibility - equip and train users to oversee agents.

The throughline (“define boundaries → bound impact → keep a human accountable → make it traceable”) maps directly onto this playbook’s spine: the lethal-trifecta triage (II.2 · Prompt injection & the LLM attack surface), least-privilege agent identity (IV.6 · Agent identity & access (NHI)), approval gates and the mitigation matrix (II.5 · Guardrails - what holds, and how to prove it), and detection/traceability (VII.3 · Detection, IR & forensics for AI).

Why it matters

Related Singapore work to know: CSA’s earlier “Securing Agentic AI” discussion paper, and the global-first AI Agents Sandbox that CSA, GovTech and IMDA launched with Google (Aug 2025) to study computer-use agents in real settings - its 20 May 2026 findings push risk-tiered action approval (pre-approval for high-risk/irreversible actions, post-hoc review for reversible ones) and distributing safeguards across platform, organization, and end-user. The MGF is the most directly relevant instrument here: it’s the agentic-specific governance an accredited tester will be expected to assess against, it pairs naturally with Project Moonshot and AI Verify for the technical testing (VI.5 · Running the engagement, VI.6 · Capability & assurance evaluation), and it continues to take case-study submissions. Two adjacent 2026 developments to track: PM Lawrence Wong’s Feb 2026 Budget announcement of a National AI Council and national AI Missions, and MAS’s AI risk-management guidelines for financial institutions (which already name agentic AI).

Beyond CSA and IMDA: MAS, PDPC and accredited testing

The instruments above apply across sectors. Three more bodies now set expectations that an assessment in Singapore has to account for, and only one of them has made anything mandatory.

Financial institutions (MAS). The hard requirement is on the security side. Since 1 July 2026, MAS has required key FIs to run AI-assisted red teaming on critical internet-facing systems, using advanced models to find the attack paths that could let criminals disrupt critical services or reach sensitive customer data (MAS, 28 Jul 2026). The method is VI.4 · AI red-team playbook, aimed at the institution’s own perimeter. Around it:

• Governance is still guidance. MAS’s Guidelines on AI Risk Management were still at consultation stage in September 2026 (MAS, 11 Sep 2026). Until they are final, the working reference is the risk-management toolkit from Project MindForge (MAS, 20 Mar 2026), which MAS says the guidelines will work in tandem with.
• Runtime safeguards for agents. SAFR (Safeguards for Agentic Finance at Runtime) is an industry white paper developed under MAS’s BuildFin.ai programme (MAS, 3 Jul 2026). It sets out establishing an agent’s identity and authority, evaluating its actions against controls before execution, and keeping a clear audit record: the pattern in III.5 · Consent & containment. It is a proposal, not a requirement.
• A sector taskforce. MAS and the Association of Banks in Singapore set up the AI-Driven Cyber and Technology Risk Taskforce (ACT) in response to the cyber risks of frontier models (MAS, 28 Jul 2026).

Personal data (PDPC). PDPC issued its Advisory Guidelines on Use of Personal Data in Generative AI on 20 July 2026 (PDPC). They are advisory and not legally binding, but they are how PDPC reads the PDPA for generative AI, and three parts land on security and assurance work:

• Roles. Duties are assigned to Model Providers, System Providers and System Deployers, with dataset suppliers alongside. Place every party in the system in one of these roles before you assign findings.
• Security. System Providers acting as data intermediaries are expected to periodically review whether they need more security for risks such as prompt injection, which PDPC notes is made worse by unclear boundaries between control and user data planes. Evidence from injection testing (II.2 · Prompt injection & the LLM attack surface) is how that review shows up in an assessment.
• Training data. Before relying on the Publicly Available Exception for data behind a digital barrier, such as a paywall or a registration wall, an organization must assess that the data really is public, and a borderline call has to be written up in a DPIA or other record that PDPC can ask to see. Using user data for large-scale training or fine-tuning needs an AI-specific notification; a general notice is not enough.

Accredited testing (AI Verify Foundation). The AI Tester Accreditation Programme is expected to open in 3Q 2026 (AI Verify Foundation). It accredits third-party testing firms, checking their technical competence against guidance such as IMDA’s Starter Kit for testing LLM-based applications, for 12 months at a time. It is explicitly not a guarantee or certification that a tested system is safe: it tells a buyer that the tester is competent within a documented scope.

Also new in 2026:

• IMDA’s discussion paper Legal Responsibility for AI Agents (May 2026) reports that most of a working group of more than 20 lawyers considered that many agent-caused harms could be handled through contract and the tort of negligence, though the law may need adapting. It flags hard practical problems for claimants and the open question of who bears losses nobody could foresee. The practical move: tighten the liability terms in agent-vendor contracts, and keep the action logs that would show what an agent did.
• CSA and IMDA issued a joint advisory on the safe and secure use of generative AI tools by individuals (28 Jul 2026), a usable baseline for staff awareness training.
• Singapore has not mandated labels for AI-generated content. Asked about rules like the EU AI Act’s Article 50, MDDI pointed to IMDA’s two Codes of Practice for Online Safety for designated services, and said it will track watermarking and provenance standards and “assess if they should be mandated” (MDDI, 5 Aug 2026).

EU AI Act - the structure, not just the timeline

The Act stacks two independent axes: who you are in the value chain (which decides what you owe) and which risk tier your system sits in (which decides how much).

Roles - who owes what

Obligations attach to your role under Article 3, not to the technology in the abstract. The heaviest duties fall on the provider; a deployer owes a lighter set (human oversight, use per instructions, some transparency and FRIA duties). The trap is Article 25: a distributor, importer, deployer, or third party who puts their name on a high-risk system, substantially modifies it, or repurposes it to a high-risk use is deemed a provider and inherits the full provider obligations.

Role (Art. 3)	Who they are	Core obligation weight
Provider	Develops / has developed an AI system or GPAI model and places it on the market or into service under its own name	Heaviest - conformity assessment, technical docs, QMS, registration, post-market monitoring
Deployer	Uses an AI system under its authority in a professional capacity	Lighter - human oversight, use per instructions, input-data relevance, transparency, FRIA where required
Importer	EU-established party placing a third-country system on the EU market	Verify provider conformity before placing; keep documentation
Distributor	Any other supply-chain party making a system available on the EU market	Verify markings; act on non-conformity

Four risk tiers

1. Unacceptable (Article 5, prohibited since 2 Feb 2025) - eight banned practices (ten from 2 Dec 2026, once the Digital Omnibus adds points (ba) and (bb); see the cross-map below): manipulative/deceptive subliminal techniques causing harm; exploiting age/disability/socio-economic vulnerability; social scoring; purely profiling-based criminal-risk prediction; untargeted facial-image scraping; emotion recognition in workplace/education; biometric categorization inferring sensitive traits; and real-time remote biometric identification in public spaces for law enforcement (narrow carve-outs). No conformity path - these are simply off-limits.
2. High-risk (Annex III + Article 6) - the tier that carries the binding lifecycle duties (risk management, data governance, logging, human oversight, robustness and cybersecurity). See the classification test below.
3. Limited / transparency (Article 50) - disclose AI interaction, machine-mark synthetic media, label deepfakes. Applies 2 Aug 2026.
4. Minimal - everything else; no mandatory obligations.

The high-risk classification test

An Annex III use-case (biometrics, critical infrastructure, education, employment, essential services, law enforcement, migration, justice) is the entry gate - but Article 6(3) filters out systems that do not pose a significant risk. A system escapes high-risk if it meets any one of four exhaustive conditions: (a) it performs a narrow procedural task; (b) it improves the result of a completed human activity; (c) it detects decision-making patterns without replacing or influencing the human assessment; or (d) it performs a preparatory task to a relevant assessment. Two hard limits: a system that profiles natural persons is always high-risk regardless, and a provider claiming the derogation must document the assessment and still register under Article 49(2).

GPAI - a parallel track

General-purpose AI models (the foundation-model layer) sit on their own track, in force since 2 Aug 2025 with Commission enforcement from 2 Aug 2026:

• Baseline GPAI provider - technical documentation, information for downstream integrators, a copyright policy, and a public training-content summary.
• GPAI with systemic risk - presumed when training compute exceeds 10^25 FLOP (a handful of frontier providers). Adds model evaluation and adversarial testing, systemic-risk assessment and mitigation, serious-incident reporting, and cybersecurity protection for the model and its weights.

The GPAI Code of Practice (final version published 2025, its Safety and Security chapter aimed at the systemic-risk cohort) is the voluntary compliance vehicle the AI Office steers providers toward. Get the mechanism right when you advise: under Article 53(4) adhering to the Code lets a provider demonstrate compliance with its GPAI obligations; a presumption of conformity is the stronger effect that comes from a harmonized standard (Article 40), which for GPAI does not yet exist. A code of practice is a bridge until the standards land, not a conformity presumption.

Beyond EU and Singapore

A multinational advisor should not treat EU + SG as the whole map:

• United States - no comprehensive federal AI law; a patchwork instead. The federal posture is pro-development and actively discourages state rules (the current administration favors accelerating US AI over binding federal mandates, and the earlier Biden EO framework has been rolled back). The flagship state law, the Colorado AI Act (SB 24-205), was repealed and replaced by SB 26-189 (signed 14 May 2026), effective 1 Jan 2027, dropping much of the original risk-based deployer duty-of-care for a disclosure-and-transparency model - a signal that even the boldest US state effort is retreating. Expect fragmentation, not convergence.
• United Kingdom - deliberately no UK AI Act. A pro-innovation, regulator-led model: existing regulators (ICO, Ofcom, FCA, CMA) apply cross-sector principles under existing law rather than a single statute. A narrow bill for the most powerful models has been signaled but keeps slipping.

Practical read: the EU high-risk bar remains the strictest global anchor. Build to it where EU markets are in scope, and the US/UK obligations are largely a subset you already cover.

EU cross-map: the EU AI Act is binding and risk-tiered. GPAI (general-purpose AI) obligations have applied since 2 Aug 2025, and the Act’s general application date was 2 Aug 2026. The Digital Omnibus on AI - formally Regulation (EU) 2026/1744, amending the AI Act (2024/1689), the EASA regulation (2018/1139) and the Machinery Regulation (2023/1230) “as regards the simplification of the implementation of harmonised rules on artificial intelligence” - passed European Parliament 16 Jun 2026, Council approval 29 Jun 2026, was signed 8 Jul 2026, published in the Official Journal 24 Jul 2026, and entered into force 27 Jul 2026. It re-cuts the high-risk timeline: stand-alone (Annex III) high-risk duties (risk management, data governance, logging, human oversight, robustness & cybersecurity) move to 2 Dec 2027, and product-embedded (Annex I) high-risk to 2 Aug 2028, with the deferral tied to the availability of harmonized standards. Its own title is “the simplification of the implementation of harmonised rules,” and it reinforces the regulatory-sandbox provisions.

Crucially, 2 August 2026 did not disappear when the Omnibus deferred the high-risk dates. It remained the application date for the parts that switch on regardless of the deferral: Article 50 transparency (disclose AI interaction, machine-mark synthetic audio/image/video/text, label deepfakes) and the Article 101 power to fine GPAI providers. Do not misdate the rest of the enforcement machinery: under Article 113(b) the governance bodies and AI Office, the notified-body regime, and the penalty framework itself (fines up to €35M / 7% of turnover for prohibited practices, €15M / 3% for other breaches) all applied a year earlier, from 2 August 2025 - only the general application date is 2 Aug 2026. One transition: generative systems already on the market before 2 Aug 2026 get until 2 Dec 2026 to meet the Article 50(2) machine-readable marking of synthetic output. Only the high-risk Annex III obligations lifted off 2 Aug 2026. Next date to track: 2 December 2026, when the Omnibus’s two new Article 5 prohibitions take effect: point (ba) non-consensual intimate imagery and point (bb) CSAM generation, bringing Article 5 to ten prohibited practices. The architecture - four risk tiers, conformity assessment, the GPAI track, the AI Office - is unchanged. SG orgs touching EU markets: build to the stricter EU high-risk bar where it applies; CSA/NIST/ISO cover the rest. Build once, label many.

Cite these

Base text: Regulation (EU) 2024/1689 (the AI Act). Amending text: Regulation (EU) 2026/1744 (the Digital Omnibus on AI), OJ publication 24 Jul 2026, in force 27 Jul 2026. As with any live regulation, open the EUR-Lex consolidated text yourself before citing a specific article number - the amending regulation renumbers around the points it inserts.

For the organization (Singapore)

• Adopt CSA Guidelines + Companion Guide as baseline; use the Agentic Addendum’s workflow-mapping for any autonomous system.
• Treat AD-2026-004 as a board-level tempo mandate: tighten patch SLAs, enforce MFA + least privilege now, add machine-speed anomaly detection.
• EU markets → gap-assess EU AI Act high-risk early.
• Financial institution → for key FIs, AI-assisted red teaming of critical internet-facing systems has been required since 1 Jul 2026; use the MindForge toolkit until MAS’s AI risk-management guidelines are final.
• Personal data in generative AI → follow PDPC’s July 2026 guidelines: document scraping decisions for data behind digital barriers, and give AI-specific notice before training on user data.