Singapore and Hong Kong sharpen AI governance expectations

Singapore and Hong Kong entered 2026 without standalone AI laws, relying instead on existing privacy, cybersecurity and financial-sector regimes, voluntary frameworks and regulator guidance. The shared direction is toward practical controls for agentic AI, assurance, testing, cyber resilience, data governance, transparency and human accountability.

Singapore is expanding an assurance infrastructure built around AI Verify, launched in 2022 by the Infocomm Media Development Authority and Personal Data Protection Commission. IMDA introduced a Model AI Governance Framework for Agentic AI in January 2026 and updated it in May 2026 with case studies and best practices drawn from more than 50 organisations. A planned AI Tester Accreditation Programme, due by Q3 2026, will accredit third-party testers and red-team providers.

Hong Kong remains governed through the PDPO, PCPD guidance, the Digital Policy Office and sectoral rules. The PCPD launched compliance checks on 60 organisations in January 2026; results published in May 2026 found that 95% used AI in day-to-day operations. Regulators also warned on agentic AI privacy risks and AI-enabled cyberattacks, with the HKMA and SFC calling for stronger cyber risk management, incident response, recovery testing and third-party resilience.