Compendium of AI Use Cases: Practical Illustrations of the Model AI Governance Framework
Singapore ยท Guideline ยท Personal Data Protection Commission
Our summary
This compendium provides practical examples of how organizations across different sectors have implemented responsible AI governance practices aligned with Singapore's Model AI Governance Framework. It demonstrates approaches to building trust through accountable AI deployment, covering internal governance structures, operations management, and stakeholder communication. The resource illustrates real-world cases showing how businesses can distinguish themselves by adopting governance practices that prioritize explainability, transparency, fairness and human-centered AI solutions.
Written by the Index in our own words. It is not legal advice; the official text is the authority.
Inside this policy
Every section of this policy in order. Our notes summarise each one in plain language and do not quote the official text, which is the authority.
Drafted by the Index An automated summary of the official text, not yet reviewed by a person.Reviewed Checked by a person against the official text.
54 sections
Jump to a chapter
Responsible AI made easy for organisations
Organisations deploying AI should follow three core principles: AI systems must produce decisions that are clear, open and fair; solutions must prioritize human welfare and interests; and internal governance structures must determine appropriate levels of human control.
Ai-augmented decision-making
Organisations should establish explicit roles and duties, create procedures to track and control potential issues, provide education to workers, and determine suitable degrees of human oversight to reduce potential damage to people.
Operations management stakeholder interaction and communication
Organisations should reduce model and data distortions, apply proportionate safeguards based on risk levels, communicate their AI policies clearly to end users, enable user feedback where feasible, and provide understandable information.
Level of human involvement
A framework exists to guide organisations in choosing the appropriate degree of human involvement in their AI systems, adjusting this choice based on how likely and severe the negative effects on people could be.
HIGH
Three models of human involvement exist: systems operating independently make decisions without people (such as product suggestion tools); systems under human watch allow people to intervene when unusual cases arise (such as navigation services); and systems where people decide after reviewing AI recommendations (such as clinical support tools).
Human involvement: how much is just right?
An online retailer is considering fully automated AI-based product recommendations for customers using their search patterns and prior purchases.
Highly recommended!
For the retailer scenario, possible harms like unsuitable product suggestions are not severe because customers retain the power to reject recommendations, supporting a fully independent AI approach for this use case.
Robust oversight in AI model development
Callsign implemented a multi-tiered governance structure where departments oversee their own controls, created a three-phase workflow connecting multiple teams to ensure consistency in data and model creation, and positioned leadership oversight above all approval processes.
Concept consult approve
Callsign's workflow begins when a product owner proposes a feature and gathers input from security and architecture experts, then a Design Authority comprising senior leadership approves models; separately, a Data Change Governance Committee handles data accountability by validating data inclusion, assessing data types, and monitoring the complete information lifecycle including access and storage safeguards.
Human intervention according to clientsโ needs
Callsign applies human oversight selectively based on client context: banks may allow less human review for high-value transactions to avoid disruption, may reduce oversight to enhance customer experience, or may lower involvement levels to manage support costs.
Accountability through data governance practices
Callsign demonstrates accountability by minimizing data collection through research into efficient methods, then protecting personal information through tokenisation, hashing, persistent device tagging, and masking of location coordinates. The company applies data governance frameworks referencing ISO standards to classify data sensitivity and manage breach risks, and maintains data inventories, dictionaries and change processes to document and explain its data lineage to stakeholders. Callsign documents its AI model development and key contributing factors to explain outcomes including model descriptions, evaluation parameters and error metrics, providing both technical and non-technical explanations to clients to build trust and understanding.
An open and transparent approach
A company communicates openly with clients and end-users about what data it collects, why, and how it will be used, including details on how clients can configure policies for automated decision-making. The company provides contact channels for users to give feedback on data handling practices.
Conclusion
Adopting governance best practices in AI development builds client confidence in the services. Such practices also enable diverse stakeholder engagement and foster accountable and open discussions during model development.
Establishing a robust governance structure and framework
A bank set up internal governance structures including a Responsible Data Use framework and committee comprising senior leaders from various units to oversee AI deployment. The framework uses a three-stage process to evaluate and manage risks associated with data, ensuring compliance with legal requirements and conformance to model governance policies.
PURE
The second stage of a bank's risk management framework applies principles covering purposeful, unsurprising, respectful and explainable data use. A separate committee reviews rules, models, and changes to surveillance systems, approving deployment of the AI model.
Striking the right balance
A bank uses a human-over-the-loop approach to balance AI efficiency with human oversight by using statistical confidence levels to determine when staff must review alerts. Staff intervention is required when confidence in false positive identification is low, while high-confidence false positives and high-risk alerts trigger different review intensities.
Ensuring good data accountability practices at every stage
A bank developed accountability practices for its AI model by understanding data lineage from directly-linked banking and surveillance systems, maintaining mapping documents to trace transformed data, and using full datasets divided separately for training, testing, and validation to reduce bias risks. The bank excluded training data from testing and conducted parallel operations before full deployment.
Reaping the benefits
After extensive development and testing, a bank achieved explainability by understanding model function and decision triggers, ensured responsibility through monthly monitoring and six-monthly reviews with automated flagging of threshold deviations, and established accountability using performance dashboards updated monthly for stakeholders and regulators while limiting public disclosure of sensitive surveillance details.
Conclusion
A financial services firm recognises that successful AI deployment requires proper leadership, governance frameworks, and data and infrastructure support to maximise benefits and minimise risks. Another major bank applies measures across all stages of AI development and deployment for loan assessments, combining committees and staff training with careful control over human involvement to protect customers while adhering to regulatory standards.
Checks and balances in AI development
HSBC established a Global Model Oversight Committee chaired by the Chief Risk Officer to supervise AI model development stages, with representatives from the Chief Data Office, regional and functional sub-committees, and a Model Risk Management team responsible for governance standards and independent model validation. The bank developed an MRM framework based on regulatory guidance to assign distinct responsibilities: the Model Owner ensures compliance with standards on ethics, data protection and bias; the Model Developer oversees the full model development process; and the Model Sponsor approves deployment as the senior executive.
Complying with rigorous standards
A bank requires developers to document that their AI models meet explicit standards and uses standardised data collection in consultation with business and risk teams. An independent review team validates models through data management checks for consistency and ownership, statistical tests for unbiased samples, and performance validation to detect bias, with ongoing monitoring during deployment. Model documentation must facilitate comprehensive third-party assessments of design, performance and implementation.
Managing risks for loan applications
A bank uses a human-in-the-loop approach where an artificial neural network scorecard generates risk scores for loan applications, but bank staff make final approval decisions by considering the score alongside other factors such as debt ratios, credit history and triggers to detect non-linear relationships.
Keeping customers in the loop
A bank reviews and improves its AI-generated decisions when customers provide feedback or appeal, using relevant input to update the model and enhance service quality. The bank plans to notify customers when AI is used in handling their information and applications to demonstrate transparency and openness.
Conclusion
A pharmaceutical company's IT hub uses AI for manufacturing, health and global services operations, including employee attrition risk assessments. The company implements governance practices emphasising knowledge sharing, clear roles, training and transparency to ensure ethical AI use, with particular sensitivity given to the nature of personnel decisions.
Creating awareness of responsible AI through employee training
A pharmaceutical company conducts cross-functional knowledge sharing sessions and training for HR partners and leaders on interpreting AI model outputs, and creates a specialised role to oversee ethical considerations and implement explainable AI techniques in sensitive projects, helping balance organisational benefits against ethical concerns and improving internal AI ethics maturity.
Managing sensitivity delicately
A pharmaceutical company adopts a human-in-the-loop approach for employee attrition predictions, allowing the AI model to flag high-risk employees but preventing it from making decisions, since inaccurate predictions could lead to unfair treatment.
Taking the right steps for fair assessment
A pharmaceutical company builds trust in its employee attrition AI model by using quality training datasets and assembling a cross-functional team of data scientists, HR staff and business representatives to explain the model's results to management, establishing confidence in the technology's ability to address complex problems.
Data quality for model development
Project teams should understand the characteristics and provenance of each data feature, and designate a data specialist to document how data underwent transformation. Teams should determine appropriate training data volume by considering company changes that might affect relevance, and maintain separate datasets for training versus validation and testing. Demographic features should be excluded to reduce bias in model predictions.
Explainability
Model predictions should be interpretable at both aggregate and individual levels. System-level explanations help leadership understand overall factors driving outcomes, while individual-level explanations clarify why specific predictions differ from similar cases. Visual representations and comparisons between automated and human predictions can generate constructive discussions and build organizational confidence in AI systems.
Keeping employees at the centre
Organizations should develop user-friendly system interfaces in collaboration with UX specialists, using design research methods to ensure stakeholder concerns inform solution development. Access to sensitive model outputs should be restricted to appropriate leadership personnel to protect confidentiality while enabling informed decision-making.
Conclusion
This section describes Ngee Ann Polytechnic's AI-powered platform for automating its early admissions exercise across three schools, combining predictive analytics and chatbot functionality to improve efficiency and fairness in student selection while maintaining responsible governance.
Facilitating the early admissions exercise
An automated system reduced application review time from 470 hours to 2 hours, while maintaining engagement through conversational interaction about student aptitudes. The system generated interview questions based on chat responses, saving approximately 135 hours in manual shortlisting work.
Overseeing the responsible deployment of AI
Organizations should establish governance structures including senior management approval of AI deployments, a central office with dataset custodian responsibilities to coordinate with technology providers and stakeholders, and procedural review of non-selected cases to ensure fair outcomes.
Ensuring fair assessment for all applicants
A human-over-the-loop approach allows automated systems to initially screen applications while preserving human judgment for rejected cases. Institutional staff should conduct secondary review of unselected applicants using both textual content and conversational data to identify candidates meeting established criteria.
Developing eva for responsible deployment
This case describes how a polytechnic developed an AI system for admissions decisions using text-based application materials from three years of student data, with separate datasets for training, testing and validation. The organisation minimized selection bias by using representative student data and unintended bias by excluding irrelevant personal data like names and email addresses. The polytechnic tested multiple Natural Language Processing algorithms before selecting BERT, which understands word semantics rather than just matching keywords, and achieved 76% accuracy while planning ongoing updates with new data.
Being transparent about the use of eva with applicants
An educational institution promoted trust in its AI-assisted admissions system by informing candidates in advance that AI would evaluate their written submissions, providing explanatory materials and a demonstration video, and gathering user feedback on the experience.
Conclusion
This section describes how a healthcare organisation implemented AI governance structures, included staff and health coaches in decision-making, emphasised data quality and risk management throughout model development, and maintained transparency with both health coaches and participants about its AI use.
Involving all to manage risks
A healthcare provider established governance committees to oversee risk management and AI practices, required technical and non-technical teams to collaborate during model development, tied employee incentives to health outcomes, and conducted mandatory training on ethics and data protection across the organisation.
A personal approach for better understanding
A digital healthcare programme used a human-in-the-loop approach where health coaches review and personalise AI-generated message recommendations before delivering them to participants, allowing coaches to apply their knowledge about individual participants.
Data assurance at every stage
This case describes how a digital healthcare company conducted risk impact assessments before developing any AI model, used roadmaps and code review templates to address ethical and governance issues at each development stage, and obtained participant consent before collecting data from reliable sources. The company implemented rigorous testing including automated code testing, separation between development and production environments, annual independent penetration testing with immediate remediation of vulnerabilities, and post-mortem analyses to identify root causes.
Putting users at the centre of design
After deploying its AI system, a healthcare provider explained the model's functioning to health coaches through qualitative reviews to build confidence in its use, and published transparent materials for participants describing how their data was collected, used, and how they could correct inaccuracies.
Conclusion
This section describes how UCARE.AI, a healthcare startup, deployed a Cost Predictor AI system across four hospital locations in November 2018 with 82% accuracy to generate hospital bill estimates, replacing traditional statistical methods. A hospital subsequently launched a Price Guarantee Programme for six procedures where financial counsellors reviewed estimated bills with patients before admission, and UCARE.AI aligned its governance practices with the Model AI Governance Framework by assigning clear roles, implementing data accountability practices, and providing transparency.
Assigning clear roles for AI oversight
UCARE.AI established oversight procedures with designated data science leads developing models concurrently, presenting results to internal leadership, conducting client check-ins, obtaining medical advisor assessment, and having a quality assurance review before deployment.
Minimising risks with robust validation frameworks and feedback
UCARE.AI performed feasibility studies to identify potential risks, created validation frameworks with client input incorporating patient feedback, and conducted user acceptance testing with hospital staff to refine the Cost Predictor model.
Ensuring safeguards are in place
This case describes how UCARE.AI implemented data protection measures including obtaining consent before data collection, encrypting sensitive data and minimizing its use during model development, and anonymizing client data at source. The company tracked data lineage through consistent logging and secure centralized storage, created customized models using client datasets rather than third-party data, minimized bias risk through objective machine predictions, and continuously monitored and iterated the algorithm post-deployment to improve accuracy with new data inputs.
Transparent in the use of AI and data
UCARE.AI disclosed model parameters and algorithm explanations to clients, declared AI use in bill predictions to data managers and patients, documented all data access, and established feedback channels for stakeholders to raise concerns.
Conclusion
UCARE.AI prioritised client education on governance frameworks to assure patients of data safety, building trusted relationships. Visa, a global payments company, emphasizes responsible AI in its products given payment sensitivities and uses machine learning tools like Travel Predict with governance practices.
A streamlined governance process
Visa established comprehensive governance structures reviewing data use alignment with ethical principles, personal data protection and risks, and model risk management processes to audit AI solutions and assess risk significance.
Engaging employees to build a responsible AI culture
Visa conducts training for relevant staff on compliance and legal requirements, provides data scientists with curriculum covering data protection and responsible AI, and requires employees to undergo assessments for specialised knowledge retention.
Stepping in when necessary
Describes how Visa uses a human-over-the-loop approach for its Travel Predict model, which forecasts travel propensity for cardholders. Visa tracks accuracy metrics during development while the issuing bank performs final filtering, allowing human intervention when needed while maintaining operational feasibility at scale. Visa also documents technical standards, data inputs, model explanations, and fairness assessments to explain the solution's development to internal stakeholders and shares key performance indicators with issuing banks.
Proactive engagement
Explains Visa's practice of building trusted relationships with issuing banks by disclosing the general methodology of Travel Predict and providing documentation to help banks' technical teams understand and communicate how the AI model works to their stakeholders.
Conclusion
Summarises that Visa's robust AI governance structure demonstrates commitment to openness and transparency, raising standards for deploying AI solutions and promoting public confidence and trust in the company's approach to responsible data sharing.
#sgdigital
Brought to you by
Controls
What this policy requires, forbids, grants or penalises, one control at a time and in our own words. Each control links to the official text, which is the authority. This is not legal advice.
Drafted by the Index Drafted automatically from the official text, not yet reviewed by a person.Reviewed Checked by a person against the official text.
Themes covered 22 of 35
Choose a theme to see only its controls. About the themes
Risk and scope 3 of 4
- Prohibited practices, not covered
Data and privacy 3 of 4
- Cross-border data transfer, not covered
Transparency and records 3 of 4
- Labelling of synthetic content, not covered
Technical safeguards 4 of 4
Assurance and lifecycle 2 of 4
- Registration and notification, not covered
- Incident and breach reporting, not covered
Rights and protected groups 2 of 4
- Children and vulnerable groups, not covered
- Biometric identification and surveillance, not covered
Roles and organisation 3 of 6
- General purpose and foundation models, not covered
- Public sector use and procurement, not covered
- Innovation support and sandboxes, not covered
Enforcement and sectors 2 of 5
- Enforcement, penalties and regulators, not covered
- Sector rules: health, not covered
- Sector rules: education, not covered
The full list of controls could not be loaded, so only the first 40 are shown.
Responsible AI made easy for organisations 3 controls
- ObligationApplies to: DeployerDrafted by the Index
Organisations deploying AI should ensure their systems produce decisions that are explainable, transparent and fair.
- ObligationApplies to: DeployerDrafted by the Index
Organisations deploying AI should prioritize human welfare and interests in their solutions.
- ObligationApplies to: DeployerDrafted by the Index
Organisations deploying AI should establish internal governance structures and measures that determine appropriate levels of human control.
Ai-augmented decision-making 5 controls
- ObligationApplies to: DeployerDrafted by the Index
Organisations should define and assign clear roles and responsibilities regarding their AI systems.
- ObligationApplies to: DeployerDrafted by the Index
Organisations should establish standard operating procedures to monitor and manage risks from their AI systems.
- ObligationApplies to: DeployerDrafted by the Index
Organisations should provide training to staff on AI systems and their responsible use.
- ObligationApplies to: DeployerDrafted by the Index
Organisations should determine and implement an appropriate degree of human involvement in their AI systems.
- ObligationApplies to: DeployerDrafted by the Index
Organisations should take measures to minimize the risk of harm to individuals from their AI systems.
Operations management stakeholder interaction and communication 5 controls
- ObligationApplies to: DeployerDrafted by the Index
Organisations should reduce bias in the data and models used in their AI systems.
- ObligationApplies to: DeployerDrafted by the Index
Organisations should apply safeguards proportionate to the risk level of their AI systems, such as explainability, robustness and regular tuning.
- ObligationApplies to: DeployerDrafted by the Index
Organisations should communicate their AI policies clearly to end users.
- Applies to: DeployerDrafted by the Index
Organisations should enable users to provide feedback on their AI systems where feasible.
- ObligationApplies to: DeployerDrafted by the Index
Organisations should communicate information about their AI systems in a way that is easy for users to understand.
Level of human involvement 1 control
- ObligationApplies to: DeployerDrafted by the Index
Organisations should use a design framework to determine the appropriate degree of human involvement in their AI systems based on the likelihood and severity of potential adverse effects on individuals.
HIGH 1 control
- Applies to: DeployerDrafted by the Index
Organisations should consider three models of human involvement in AI systems: independent operation without human involvement, human oversight allowing intervention in unexpected cases, and human decision-making with AI recommendations.
Highly recommended! 1 control
- Applies to: DeployerDrafted by the Index
Organisations should assess harms from an AI system, determine whether those harms are serious, and select a human involvement model appropriate to the severity of potential harm.
Robust oversight in AI model development 3 controls
- ObligationApplies to: DeployerDrafted by the Index
An organization should implement a multi-level governance structure where each department head develops and oversees controls and policies within their area of responsibility.
- ObligationApplies to: DeployerDrafted by the Index
A Chief Security Officer and Data Protection Officer should jointly manage the multi-level governance framework for AI model oversight.
- ObligationApplies to: DeployerDrafted by the Index
An organization should establish a three-stage workflow connecting engineering, product, sales and research teams to maintain consistency in data management and AI model development.
Concept consult approve 3 controls
- ObligationApplies to: DeployerDrafted by the Index
A Design Authority comprising senior leaders from the Chief Technology Office, Chief Security Office, Chief Information Office and other teams should review and approve all developed AI models.
- ObligationApplies to: DeployerDrafted by the Index
An organization should establish a Data Change Governance Committee to review data point inclusion to ensure AI solutions align with clients' business purposes.
- ObligationApplies to: DeployerDrafted by the Index
An organization should assess the types of data collected and conduct reviews to verify the validity and relevance of such data.
Human intervention according to clientsโ needs 2 controls
- ObligationApplies to: DeployerDrafted by the Index
A deployer should work with clients to determine the appropriate level of human involvement for a specific AI application and context.
- Applies to: DeployerDrafted by the Index
A deployer may reduce human intervention in an AI model based on the client's risk appetite, user experience preferences or operational cost considerations.
Accountability through data governance practices 7 controls
- ObligationApplies to: DeployerDrafted by the Index
A deployer should avoid over-collection of data and develop intelligent methods for gathering results from minimal data amounts.
- ObligationApplies to: DeployerDrafted by the Index
A deployer should tokenise personally identifiable information and hash username data to protect against attacks.
- ObligationApplies to: DeployerDrafted by the Index
A deployer should use persistent device tagging to identify devices while maintaining obfuscation of users in AI models.
- ProhibitionApplies to: DeployerDrafted by the Index
A deployer should avoid collecting behavioural data such as keys or pin codes entered on mobile phones or websites.
- ObligationApplies to: DeployerDrafted by the Index
A deployer should mask longitude and latitude data in location data modelling through a data protection by design approach.
- ObligationApplies to: DeployerDrafted by the Index
A deployer should develop data governance frameworks aligned with international standards to classify data sensitivity and create risk-based approaches to prevent data misuse.
- ObligationApplies to: DeployerDrafted by the Index
A deployer should maintain data inventories, data dictionaries, data change processes and control mechanisms to document data lineage and provide point-in-time explanations to stakeholders.
An open and transparent approach 3 controls
- ObligationApplies to: DeployerDrafted by the Index
An organization should notify clients and end-users about what categories of data it collects, the reasons for collection and how the data will be used.
- ObligationApplies to: DeployerDrafted by the Index
An organization should explain how clients may use its systems to manage authentication, authorization and transaction risks, including how policies can be configured for automated decisions.
- Applies to: DeployerDrafted by the Index
An organization should provide a contact channel for clients to submit feedback on its data processing policies.
Establishing a robust governance structure and framework 4 controls
- ObligationApplies to: DeployerDrafted by the Index
An organization should establish a Responsible Data Use framework and appoint a committee to oversee and govern it.
- ObligationApplies to: DeployerDrafted by the Index
A Responsible Data Use Committee should include senior leaders from different organizational units to provide appropriate checks and balances and diverse perspectives.
- ObligationApplies to: DeployerDrafted by the Index
An organization should implement a three-stage process to assess and manage the risks of all data used by its AI models.
- ObligationApplies to: DeployerDrafted by the Index
In the first stage of risk evaluation, an AI model should satisfy legal requirements, compliance standards, security measures and data quality standards.
PURE 3 controls
- ObligationApplies to: DeployerDrafted by the Index
The second stage of a deployer's governance framework should enforce responsible data use principles covering purposeful, unsurprising, respectful and explainable handling.
- ObligationApplies to: DeployerDrafted by the Index
A deployer should ensure that AI models conform to technical requirements set out in its model governance policy.
Change history
No changes recorded since we began monitoring this policy.