Model Artificial Intelligence Governance Framework

Objectives

This voluntary Model Framework guides organisations deploying AI at scale to do so responsibly by tailoring measures to address identified risks based on factors including the type and sophistication of AI systems, the degree of autonomous versus augmented decision-making, and the severity and likelihood of impact on individuals, aiming to build stakeholder trust through responsible practices and alignment with accountability standards such as Singapore's PDPA and OECD Privacy Principles. The Framework rests on two main principles: organisations using AI in decision-making must strive to ensure their processes are explainable, transparent and fair to the extent possible, and AI solutions must be human-centric by prioritising the protection of human interests, well-being and safety during design, development and deployment. Organisations deploying AI at scale should detail their ethical principles and incorporate them into their existing corporate values and governance structures.

Assumptions

The framework applies mainly to machine learning models, does not address cyber-attack risks, and does not replace compliance with existing laws including sector-specific regulations in finance, healthcare and legal sectors. Adopting it will support organisations in demonstrating accountability-based practices but cannot substitute for compliance with sector-specific requirements.

Definitions

This section defines key terms including AI as technologies simulating human traits to produce outputs or decisions, AI Solution Providers as entities developing AI systems, Organisations as entities deploying such systems, and Individuals as persons who use or may be affected by AI products and services.

Internal Governance Structures and Measures

Organisations should develop internal governance structures that provide appropriate supervision and control over AI introduction and use, which can adapt existing frameworks or establish new ones such as AI risk management within enterprise risk management or ethics review boards, with essential support from top management and the board. Key responsibilities include applying risk control measures to assess and manage AI deployment risks including potential adverse impacts on vulnerable individuals, determining appropriate human involvement levels, managing model training and selection, establishing monitoring and reporting systems to track deployed AI performance, ensuring knowledge transfer during personnel changes, reviewing governance structures during organisational or staffing changes, assessing training datasets for inaccuracy and bias, and providing staff with role-appropriate training. Organisations should periodically review their internal governance structures and measures to maintain relevance and effectiveness, and can establish governance through multi-stakeholder decision-making bodies such as research boards and architecture steering groups with clearly defined roles, comprehensive employee ethics codes and training, or appointing a council with representatives from data, privacy, security and business teams to review high-risk AI implementations, with risk management processes to assess and identify risks in AI projects where high-risk projects are referred for review and low-risk projects proceed directly to development.

Determining the Level of Human Involvement in AI-augmented Decision-making

Organisations should clarify commercial objectives for using AI, weigh them against decision-making risks guided by corporate values and societal norms, continually identify and review risks with documented impact assessments and mitigation plans. The framework identifies three human oversight approaches - human-in-the-loop (AI provides recommendations with human full control), human-out-of-the-loop (AI has full control without human override), and human-over-the-loop (humans monitor and can take control at unexpected events) - with a probability-severity matrix helping determine appropriate involvement levels, though nature of harm, reversibility, and operational feasibility should also be considered. For safety-critical systems, humans must be able to assume control with AI providing sufficient information for meaningful decisions or safe shutdown; organisations should further evaluate domain knowledge requirements and compliance costs, typically requiring human-in-the-loop for high non-compliance scenarios and allowing human-out-of-the-loop for high-volume low-harm transactions, with continuous model performance monitoring in both cases.

Operations Management

Organisations must establish data accountability practices covering data lineage tracking, quality assessment across eight dimensions, and bias mitigation through heterogeneous and complete datasets with separate training, testing and validation datasets tested for systematic bias across demographic groups; they must periodically review and update these datasets while recognising selection bias (from unrepresentative training data) and measurement bias (from skewed collection devices), and may incorporate new production data while considering reinforcement bias. Organisations must proactively de-bias models using objective data, testing against diverse demographic datasets and ensuring the four-fifths rule where protected group selection rates reach at least eighty percent of the majority group rate, then test for adverse impact post-deployment and adjust if bias is detected. Using a risk-based approach to prioritise transparency measures, organisations must implement explainability (describing algorithm function and prediction use), repeatability (result consistency in live environments), and regular tuning as core practices, while reserving reproducibility (independent teams achieving same results), traceability (documenting decisions, datasets and processes), and auditability (readiness for internal or external assessment) for specific scenarios; explainability may be omitted where disclosure could enable bad actors to avoid detection or expose confidential information, and supplementary tools like surrogate models or counterfactual explanations may assist.

Stakeholder Interaction and Communication

Organisations should share information about their use of AI in products and services, including what AI is, how it affects consumers, and risk management steps, with tailored communication and explanations of how AI works and its consequences for different stakeholder groups. Organisations should address consumer information needs throughout the customer journey from awareness through decision review, considering factors like risk, reversibility, alternatives, costs, system complexity and technical feasibility when deciding whether to provide opt-out options, and offering recourse channels such as decision review if opt-out is not provided. Organisations should establish feedback and decision review channels, test user interfaces before deployment, communicate in easy-to-understand language, may implement acceptable user policies to prevent malicious manipulation, should obtain detailed information from AI solution providers about data sources, model training, human involvement and bias mitigation measures, design AI systems through user research and human-centric principles, and disclose when an AI system is in operation and its development status.

Acknowledgements

This section acknowledges organizations and individuals who provided feedback during development of the framework. The publication is intended to encourage responsible artificial intelligence development and adoption, and is not a legal authority or substitute for professional advice; the PDPC and its staff disclaim liability for any errors or reliance on the contents.