ASEAN Guide on AI Governance and Ethics
Singapore · Guideline · ASEAN
Our summary
A practical framework for organisations across Southeast Asia to govern artificial intelligence systems ethically and responsibly. It provides comprehensive guidance on governance structures, risk assessment, human oversight levels, and operational practices throughout the AI lifecycle. The framework includes principles covering transparency, fairness, security, human involvement, privacy and accountability, along with recommendations for national and regional implementation.
Written by the Index in our own words. It is not legal advice; the official text is the authority.
Inside this policy
Every section of this policy in order. Our notes summarise each one in plain language and do not quote the official text, which is the authority.
Drafted by the Index An automated summary of the official text, not yet reviewed by a person.Reviewed Checked by a person against the official text.
5 sections
Jump to a chapter
1 Internal governance structures and measures
Organisations deploying AI systems must establish oversight mechanisms through new or adapted governance structures to track how systems are built, managed, and used, including multi-disciplinary bodies like Ethics Committees with risk mitigation escalation procedures, policies, and standards for ethical development and accountability. Deployers need development plans addressing organisational readiness, technical skills, infrastructure, and awareness-raising, with clear roles and responsibilities for oversight, assessment, quality assurance, and documentation, and personnel must receive guidance and training on legal, ethical, technical, and harm-detection considerations. Smaller companies without sufficient resources may adopt a risk-based approach focusing on specific governance risks rather than full multi-disciplinary bodies, with implementation varying based on organisational size and capabilities.
2 Determining the level of human involvement in AI-augmented decision-making
AI systems present distinct risks including discrimination, security weaknesses, malfunction, and unexpected behaviour, particularly when used for significant decisions with substantial human impact; deployers must establish intended commercial objectives during design, ensure compatibility with governance principles, and assess risks considering factors such as life and livelihood impact, market integrity, privacy violations, and harm reversibility. Deployers should identify and continually review risks and required human involvement levels using organisational values as a guide and maintaining documented risk impact assessments; three categories apply: human-in-the-loop where humans make final decisions with AI providing recommendations; human-over-the-loop where humans supervise and can intervene; and human-out-of-the-loop where AI controls execution independently without human override option. High-risk systems require strong human control; deployers should assess impact on vulnerable populations and guard against automation bias, apply robust risk management across the AI system lifecycle, and use mitigating measures including adversarial robustness testing and rate-limiting.
3 Operations management
4 Stakeholder interaction and communication
5 Stakeholder Interaction and Communication
Organizations must implement good communication practices by identifying affected stakeholders, informing them of AI use, explaining AI's role in decision-making in accessible formats, providing opt-out options with information on consequences, and establishing feedback channels. Responsible AI deployment requires governance structures throughout the AI lifecycle including risk assessment, defined roles and accountability, transparency in model parameters and usage, adherence to data protection laws, consent before data collection, data encryption and anonymization, bias minimization, monitoring for performance degradation, and stakeholder engagement during design and implementation. Government teams and product developers must obtain central approval before public deployment of AI systems like large language models, apply risk-based mitigating measures depending on task type and audience, test public-facing products for robustness against adversarial attacks through testing and red teaming, include visual cues reminding users to verify output, and incorporate user feedback and stakeholder input to enhance human-centered outcomes.
Controls
What this policy requires, forbids, grants or penalises, one control at a time and in our own words. Each control links to the official text, which is the authority. This is not legal advice.
Drafted by the Index Drafted automatically from the official text, not yet reviewed by a person.Reviewed Checked by a person against the official text.
Themes covered 11 of 35
Choose a theme to see only its controls. About the themes
Risk and scope 2 of 4
- Risk classification, not covered
- Prohibited practices, not covered
Data and privacy 2 of 4
- Cross-border data transfer, not covered
- Copyright and training data, not covered
Transparency and records 2 of 4
- Labelling of synthetic content, not covered
- Technical documentation, not covered
Technical safeguards 3 of 4
- Testing and evaluation, not covered
Assurance and lifecycle 0 of 4
- Conformity assessment and certification, not covered
- Registration and notification, not covered
- Incident and breach reporting, not covered
- Post-market monitoring and corrective action, not covered
Rights and protected groups 0 of 4
- Automated decision-making rights, not covered
- Children and vulnerable groups, not covered
- Biometric identification and surveillance, not covered
- Whistleblowing, complaints and redress, not covered
Roles and organisation 2 of 6
- Supply chain and provider-deployer duties, not covered
- General purpose and foundation models, not covered
- Public sector use and procurement, not covered
- Innovation support and sandboxes, not covered
Enforcement and sectors 0 of 5
- Enforcement, penalties and regulators, not covered
- Sector rules: health, not covered
- Sector rules: finance and insurance, not covered
- Sector rules: employment, not covered
- Sector rules: education, not covered
The full list of controls could not be loaded, so only the first 25 are shown.
1 5 controls
- ObligationApplies to: DeployerDrafted by the Index
Deployers should establish internal governance structures to oversee the design, development and deployment of AI systems, either as new arrangements or by adapting existing risk management frameworks.
- ObligationApplies to: DeployerDrafted by the Index
Deployers should consider creating a multidisciplinary ethics committee or board with advisors from fields such as ethics, law, philosophy, technology, privacy and science to oversee AI governance efforts and provide guidance on responsible development and deployment.
- ObligationApplies to: DeployerDrafted by the Index
Deployers should ensure their governance bodies include diverse representation of stakeholders and perspectives to reflect the range of voices in society.
- ObligationApplies to: DeployerDrafted by the Index
Deployers should design their governance structure with an appropriate degree of centralization or decentralization to match their organizational structure and culture, balancing flexibility with consistency.
- ObligationApplies to: DeployerDrafted by the Index
Deployers should implement escalation procedures within their governance structure so that higher-risk AI systems and use cases receive review and decision-making from senior authority.
2 4 controls
- ObligationApplies to: DeployerDrafted by the Index
Deployers should conduct risk assessments of AI systems to identify potential effects, affected populations and likelihood of harm throughout the system lifecycle.
- ObligationApplies to: DeployerDrafted by the Index
Deployers should establish the intended commercial objectives of an AI system and assess compatibility with organizational principles and potential risks during the design phase.
- ObligationApplies to: DeployerDrafted by the Index
Deployers should weigh commercial objectives against identified risks and consider local societal norms and expectations when operating in different regions.
- ObligationApplies to: DeployerDrafted by the Index
Deployers should record system and user behavior for auditing purposes to support periodic risk assessments.
3 4 controls
- ObligationApplies to: AnyoneDrafted by the Index
Developers and deployers should ensure business purpose, governance alignment and key stakeholder identification throughout the AI system lifecycle.
- ObligationApplies to: AnyoneDrafted by the Index
Deployers and developers should design and develop AI systems following principles of human-centricity, fairness, transparency, safety, robustness, accountability and privacy.
- ObligationApplies to: DeployerDrafted by the Index
Deployers should conduct risk-based assessments of AI systems before data collection and modelling to identify potential safety risks and misuse scenarios.
- ObligationApplies to: DeployerDrafted by the Index
Deployers should document risk mitigation measures and safeguards to create a record of responsible design and deployment decisions.
4 6 controls
- ObligationApplies to: DeployerDrafted by the Index
Deployers should disclose when AI is used in products or services, including the type, purpose and effects on decision-making.
- Applies to: DeployerDrafted by the Index
Deployers may include disclaimers that user inputs to AI systems will be used to improve or train the system, but should balance this against risks of bad actors skewing the learning process.
- ObligationApplies to: DeployerDrafted by the Index
Deployers should communicate with employees about AI-related role changes and job transitions to help them understand the technology and its impact on workflows.
- ObligationApplies to: DeployerDrafted by the Index
Deployers should provide training and education to employees to build awareness of how to work with AI systems and understand their benefits.
- ObligationApplies to: DeployerDrafted by the Index
Deployers should redesign jobs so that AI augments existing employee skills rather than rendering positions redundant.
- ObligationApplies to: DeployerDrafted by the Index
Deployers should develop standardized communication policies that specify what information to provide to different stakeholder groups and how to convey it.
5 6 controls
- ObligationApplies to: ProviderDrafted by the Index
Developers and deployers should identify the internal and external stakeholders who will be affected by their AI systems and tailor communication messages for each group.
- ObligationApplies to: ProviderDrafted by the Index
Developers and deployers should inform relevant stakeholders that AI is used in their products or services, explaining in plain language the role and extent of AI's involvement in decision-making processes through formats such as infographics, tables or videos.
- ObligationApplies to: ProviderDrafted by the Index
Developers and deployers should publish a privacy policy on their website disclosing AI governance practices, including data handling, decision-making processes, third-party engagement, data flows and applicable standards.
- ObligationApplies to: ProviderDrafted by the Index
Developers and deployers should inform users how AI-enabled features are designed to function during normal operation.
- ObligationApplies to: ProviderDrafted by the Index
Developers and deployers should offer users the ability to decline participation in the AI system and explain the consequences of exercising such an option.
- ObligationApplies to: ProviderDrafted by the Index
Developers and deployers should establish communication channels such as hotlines or email contacts, accessible through their website, where users can submit feedback, inquiries or updated personal data.
Change history
No changes recorded since we began monitoring this policy.