Controls
Governance for the first pilot
Rules staff can follow, a map of what leaves your systems, and a human who owns the decision. We help you design those pieces before a tenth tool arrives.
Oversight is a design choice
Design
Why governance is a design task
A policy written after staff already paste customer text into a public chatbot is a record of regret. Governance is easier when it is part of choosing the use, the tool, and the owner. That means deciding what the model is allowed to draft, who reviews the draft, where the files live, and how long logs are kept. None of those choices is a slogan. Each one is a sentence you can put in an acceptable-use page.
Singapore’s Infocomm Media Development Authority publishes a Model AI Governance Framework for Generative AI that anyone can read. It is a guide, not a statute. We use it as a shared vocabulary for transparency, data, incident handling, and testing. The same agency’s AI Verify toolkit offers ways to probe how a system behaves. We help you pick tests that match the first use, without treating a toolkit score as a certificate. Established in Singapore in 2026, the practice treats these public materials as a floor for conversation, not as a substitute for your own counsel.
Personal data
Personal data and PDPA
The Personal Data Protection Act (PDPA) asks you to know what you hold, why you hold it, and who you disclose it to. A generative tool is a new path for disclosure unless you have designed it otherwise.
Start with a blunt inventory. Which fields in the process are personal data. Which of those fields would be sent to a vendor. Whether the vendor is processing on your behalf or using the material for its own training. Whether the region of storage matches what you have told customers and staff. Whether you can delete a person’s data from the tool if you must.
De-identification helps when it is real. Removing a name from a file while leaving a unique identity in the body of the text is not de-identification. Consent may be required for some disclosures; it is not a blanket excuse for a sloppy flow. Retention should match the process. Logs that keep prompts for a year may be useful for audit and painful for minimisation. Those trade-offs belong in writing, then with qualified counsel. Information on this page is general guidance and does not constitute legal advice.
Staff rules
Acceptable use for staff
People need a page they can read in two minutes. What may go into a public chatbot: a question about grammar, a public product description, a dummy example. What must not: customer identifiers, unpublished financials, health information, passwords, or anything you would not put on a postcard. How to ask for a better tool if the public one is the only thing they have. Who to tell if something sensitive has already been pasted.
Explaining the rule matters as much as writing it. Staff paste into public tools because those tools are fast and already open. If the approved alternative is slower and locked behind a ticket, the policy will lose. We help you pair the rule with a practical path, including when the honest answer is that some tasks should stay manual for now.
People in the loop
Human oversight
Human-in-the-loop means a person reviews or owns the outcome where a wrong draft would cost more than the time the tool saves. A model can draft a reply, summarise a pack, or suggest a next step. A model should not quietly send the reply, file the summary as fact, or execute the step unless you have designed that path and can live with the error.
Logging is how you see what happened after the week of launch. Who accepted a draft, which version of the source files was used, and whether the user overrode the suggestion. Without those records, you cannot investigate an incident and you cannot improve the process. Oversight that exists only in a slide is not oversight.
Suppliers
Vendor due diligence
Eight questions we ask before a trial moves from curiosity to a system that holds your files. Your security team may add more. This list is the floor we use in advisory work.
- Where is data stored, and in which region. A marketing sentence about “global infrastructure” is not an answer. You need a location you can write down.
- Is customer content used to train the vendor’s models. Opt-out switches change. Get the current term in writing for your tenancy.
- Which subprocessors sit in the path. A chatbot may call a second model host. You should know who they are.
- Can you keep work in a defined region end to end. Storage, processing, and support access are three different facts.
- How deletion works, including backups and logs. “We delete on request” needs a time limit and a statement about residual copies.
- What logs you can export. If you cannot see prompts and outcomes, you cannot investigate misuse.
- What the service level actually covers. Uptime for a drafting tool may matter less than support when a data path fails.
- How you leave. Export of your content, length of the notice period, and what remains on the vendor side after exit.
Sectors
Sector overlays
Some sectors add duties on top of the PDPA. In financial services, the Monetary Authority of Singapore has set out Fairness, Ethics, Accountability and Transparency (FEAT) principles for the use of artificial intelligence and data analytics. Those principles are a conversation you should have with your compliance colleagues; they are not a checklist we tick on your behalf. In healthcare, clinical oversight remains with the professionals who are accountable for care. An assistant that drafts a note does not become a clinician. We flag these overlays so the right specialists are in the room. We do not issue sector approvals.
Paper trail
Records you should keep
Keep the acceptable-use policy with a version date. Keep a picture of data flows for each live use. Keep the vendor terms that were in force when you started, plus later amendments. Keep a log of who may administer the tool. Keep incident notes when something sensitive was pasted or when a draft went out unreviewed. Keep the measures you chose for the pilot, and the result against those measures. These records are how you answer a director, a regulator, or your future self in twelve months.
This page is general guidance and does not constitute legal advice. For binding interpretation, work with qualified counsel.