Singapore’s Model AI Governance Framework for Agentic AI

Singapore published a dedicated governance framework for agentic AI on 20 May 2026, and updated it two weeks later, on 5 June 2026 — making it, as of this writing, one of the most current government-issued documents on agentic AI anywhere. The Model AI Governance Framework (MGF) for Agentic AI, Version 1.5, is co-published by Singapore’s Infocomm Media Development Authority (IMDA) and the AI Verify Foundation, the same regulator-foundation pairing behind Singapore’s earlier AI governance work. It is voluntary guidance, not law — there is no penalty clause, no registration requirement, and no enforcement mechanism anywhere in the document. IMDA describes it as a “living document” that version 1.5 already updates based on feedback from more than 60 companies since version 1.0, and it explicitly invites organisations to keep submitting case studies for future revisions.

The framework is structured around four principles, and this guide walks through what each one actually asks organisations to do, based on a direct read of the primary PDF.

Where it sits: a companion to the GenAI framework, not a replacement

IMDA and the AI Verify Foundation already have a well-established governance document for generative AI: the Model AI Governance Framework for Generative AI (subtitled “Fostering a Trusted Ecosystem”), published 30 May 2024. The Agentic AI framework is best read as that document’s companion rather than its successor — same regulator pair, same voluntary posture, but built for a different paradigm. Generative AI produces outputs a human then acts on; agentic AI, per the framework’s own framing, is software that can “take actions, adapt to new information, and interact with other agents and systems to complete tasks on behalf of humans.” That distinction is why the Agentic AI framework needed its own document rather than an addendum: risks like unauthorised actions, cascading multi-agent failures, and agent-to-agent collusion don’t have a clean analogue in a framework written for text and image generation. The Agentic AI framework says explicitly that it builds on IMDA’s earlier model governance work generally, while addressing what’s new about agents specifically.

Principle 1: Assess and bound the risks upfront

The framework asks organisations to understand an agent’s risk before deploying it, using two sets of factors: what determines the severity of a risk if it materialises, and what determines its likelihood.

Severity factors include the domain and use case (a financial-transaction agent tolerates far less error than one summarising internal meetings), whether the agent can access sensitive data, whether it can reach external systems, the scope of its actions (read-only versus write access, a handful of fixed tools versus open-ended computer use), and the reversibility of what it does — rescheduling a meeting is trivially reversible, sending an external email is not. Likelihood factors include the agent’s level of autonomy, task complexity, exposure to untrusted external systems, whether it’s built and operated by a third party the organisation has limited visibility into, and overall system complexity, especially in multi-agent setups where components interact in ways that are hard to predict in advance.

Having assessed that risk, the framework asks organisations to bound it by design: apply least-privilege access to tools and data, define standard operating procedures that constrain an agent’s workflow rather than leaving every step to its judgment, and build in mechanisms to take an agent offline if it malfunctions. It also has a specific, practical instruction on how to build those limits: prefer deterministic, system-level controls (an access-control layer that physically prevents a tool from being called) over prompt-layer instructions (asking the agent nicely not to call it), because prompt-layer safeguards are inconsistently followed and can be bypassed.

Principle 2: Make humans meaningfully accountable

Once an organisation decides to deploy an agent, the framework shifts to accountability. It maps a simplified agentic AI value chain — model developers, platform providers, system providers or app developers, deployers, and end users — and asks organisations to allocate responsibility clearly across it, both internally (across leadership, product teams, cybersecurity, and users) and with external vendors, through contract terms covering security, performance, and data protection.

The framework’s more specific contribution is on keeping human oversight meaningful rather than nominal. It calls out automation bias directly: as agents perform reliably over time, humans supervising them tend to over-trust their output and effectively rubber-stamp approvals. Its recommended countermeasures are concrete and measurable — track the human override rate (how often a person actually rejects or edits an agent’s proposed action; a rate near zero is itself a warning sign of rubber-stamping) and track review response times (unusually fast approvals can signal fatigue rather than diligence). It also asks organisations to define specific checkpoints that require human sign-off before execution: high-stakes or irreversible actions, atypical or outlier behaviour, and any threshold a user sets for their own risk tolerance.

Principle 3: Implement technical controls and processes

This principle runs across the full agent lifecycle. During development, it asks for controls tailored to agentic components specifically — planning, tool use, and inter-agent protocols — on top of baseline LLM and software controls, again favouring structural, rule-based enforcement over prompt-layer instruction where risk is high enough to justify it. Before deployment, it asks organisations to test dimensions that don’t have a direct precedent in ordinary software QA: overall task-execution accuracy, policy adherence, and tool-use correctness, evaluated across varied scenarios rather than a fixed test suite. After deployment, it asks for continuous, real-time monitoring, because agents interacting dynamically with live systems can develop failure modes that pre-deployment testing won’t catch. It also asks for formal change-management and version-control processes across the lifecycle, on the reasoning that in an interconnected multi-agent system, a small change to one agent can cascade into failures elsewhere.

Principle 4: Enable end-user responsibility

The framework splits end users into two groups with different information needs. Users who interact with agents externally — customers of a customer-service agent, for example — need transparency: clear disclosure that they’re dealing with an agent, what it’s authorised to do, how their data is used, and who to contact if something goes wrong. Users who integrate agents into their own work, like employees using a coding assistant, need that plus training: on the agent’s failure modes, on how to give it effective instructions, and on maintaining a feedback loop when they catch it doing something wrong.

The framework raises one risk here that doesn’t appear in most agentic AI governance documents: tradecraft loss. Entry-level tasks are often how new staff learn a job. If agents absorb those tasks, organisations can lose the ability to perform critical processes manually when an agent malfunctions or is unavailable — a business-continuity risk, not just a skills one. The framework asks organisations to identify which core capabilities each role actually depends on and preserve enough manual work and training exposure to keep them intact.

The NIKOLAI angle: a real conceptual match, and a gap worth naming

NIKOLAI is CASRAI’s own frontier-AI-safety dictionary — an independent, unendorsed reference project, not an official record of any regulator’s or lab’s terminology, and certainly not an official record of Singapore’s framework. Every crosswalk row in NIKOLAI is a shadow mapping, CASRAI’s own interpretive reading of how a document’s language lines up with NIKOLAI’s elements, unless an organisation files its own Mapping Declaration that clears editorial review.

Principle 1 of Singapore’s framework — “assess and bound the risks upfront” — is conceptually the same question that Track N1’s coverage scope threshold element tracks: the if-then test that decides whether a governance framework applies to a given developer, model, or deployment at all. We checked that element page directly before writing this. It currently carries shadow-mapped or declared rows for eleven other organisations and instruments — Anthropic’s Advanced AI Framework, OpenAI’s Frontier Governance Framework, Google DeepMind’s Frontier Safety Framework, xAI’s Frontier AI Framework, Meta’s Advanced AI Scaling Framework, Microsoft’s Frontier Governance Framework, the EU AI Act’s Article 51, California’s SB 53, US Executive Order 14409, the (unenacted) FRONTIER Act in Congress, and a public essay by Demis Hassabis. Singapore does not currently appear on it. There is no existing NIKOLAI crosswalk row for the Model AI Governance Framework for Agentic AI, and nothing in this guide should be read as claiming there is one.

It’s worth naming as a genuine candidate for a future row, though, because Singapore’s approach to scoping is actually different from most of what’s already mapped on that element — and the difference is substantive, not just presentational. SB 53 and Article 51 both gate coverage with a single quantitative trigger: a compute figure (FLOPs) or a comparable numeric threshold that puts a developer inside or outside the regulation’s scope. Singapore’s framework has no such gate. It applies to any organisation deploying agentic AI, full stop, and then asks that organisation to run its own risk assessment dimension by dimension — severity of impact, reversibility, autonomy, task complexity, data sensitivity, system complexity — rather than clearing or failing a single numeric bar. That is a genuinely different design for the same underlying problem NIKOLAI’s coverage scope threshold element is trying to capture: a graduated, multi-factor risk calibration instead of a binary covered/not-covered test. Whether that divergence should be represented as a variant value on the existing element, a qualifying note on a future Singapore row, or something NIKOLAI doesn’t yet have a clean way to express is exactly the kind of question a future Mapping Declaration from IMDA or the AI Verify Foundation — or a CASRAI shadow mapping in the meantime — would need to resolve. As of this writing, it hasn’t been attempted.

Sources

• IMDA and AI Verify Foundation, “Model AI Governance Framework for Agentic AI,” Version 1.5, published 20 May 2026, updated 5 June 2026 — primary source for the framework’s four principles, risk factors, and all quoted or paraphrased language in this guide.
• AI Verify Foundation resources listing, cross-referencing the same PDF and confirming the co-publication, checked September 2026.
• IMDA and AI Verify Foundation, “Model AI Governance Framework for Generative AI: Fostering a Trusted Ecosystem,” published 30 May 2024 — companion-framework background.
• NIKOLAI, Coverage scope threshold element (Track N1), checked directly against its current crosswalk rows before publication of this guide.

Why This Matters for Research Administration

Singapore’s framework is unusual in this cluster for being genuinely usable by a university research-computing or IT-governance office today, since it applies to any organization deploying agentic AI with no compute or revenue gate — and agentic tools are exactly what RA offices are now piloting: grant-compliance checkers, IRB pre-review triage agents, literature-synthesis agents. Principle 2’s countermeasures against automation bias — tracking the human override rate and review response times for agent-proposed actions — are directly applicable metrics a research-computing governance committee could adopt. Principle 4’s “tradecraft loss” concept maps onto a real concern: entry-level grants-management and IRB-coordinator work is exactly the pattern-recognition labor agentic tools are being pitched to automate.