⚡ Quick Summary
Published by the Info-communications Media Development Authority (IMDA) and Personal Data Protection Commission (PDPC), this report presents the second edition of a living, voluntary Model AI Governance Framework. It is a general, ready-to-use tool for organisations deploying AI solutions at scale, rather than those merely using updated commercial off-the-shelf software with AI features. Its stated purpose is to translate existing ethical principles into practical measures for responsible deployment, while building stakeholder confidence and supporting accountability-based data management and protection practices.
The framework is algorithm-, technology-, sector-, scale- and business-model-agnostic. It is built around two guiding principles: AI decision-making should be explainable, transparent and fair, and AI solutions should be human-centric. Its practical mechanism is four-part: internal governance structures and measures; determining the appropriate degree of human involvement in AI-augmented decision-making; operations management; and stakeholder interaction and communication. Organisations are expected to tailor measures to the nature and complexity of their AI, its role in decision-making, and the severity and probability of impacts. The PDPC also identifies the complementary Implementation and Self-Assessment Guide for Organisations (ISAGO) and a separate Compendium of Use Cases.
🧩 What’s Covered
The document moves from scope and principles to organisational controls, model lifecycle practices and communication.
- Scope and objectives: Defines AI, AI solution providers, organisations and individuals; frames the resource as a flexible baseline for responsible AI deployment at scale; and links adoption to stakeholder confidence and accountability-based data-management practices, including the PDPA and OECD Privacy Principles.
- Guiding principles and governance: Sets out explainability, transparency, fairness and human-centricity, then recommends clear roles, staff training, board and senior-management participation, risk controls, monitoring, reporting, documentation and periodic governance review.
- Human involvement: Describes human-in-the-loop, human-over-the-loop and human-out-of-the-loop approaches. A probability-severity-of-harm matrix supports decisions on oversight, alongside factors such as reversibility, recourse, operational feasibility and societal expectations.
- Data for model development: Covers data lineage and provenance, quality dimensions, selection and measurement bias, heterogeneous and complete datasets, separate training, testing and validation data, and periodic dataset review to manage currency and reinforcement bias.
- Algorithm and model controls: Explains a risk-based selection of controls: explainability, repeatability, robustness, regular tuning, traceability, reproducibility and auditability. It recommends records of training and selection decisions, audit trails, scenario-based and adversarial testing, and process logs where appropriate.
- Stakeholder communication: Recommends general disclosure of AI use, policies for explanations, audience- and context-sensitive information, consumer controls, opt-out considerations, feedback and decision-review channels, readable communications, interface testing and acceptable user policies.
- Illustrations and annexes: Uses examples from CUJO AI, Mastercard, Suade Labs, Grab, pymetrics, Symphony AyasdiAI, Facebook and MSD. Annex A compiles ethical principles for reference; Annex B limits algorithm audits to circumstances such as regulator-requested forensic investigation.
💡 Why it matters?
The framework gives governance, product, data and assurance teams a common structure for connecting high-level AI principles to operational decisions. In particular, it supports decisions about who is accountable, when a person should retain control over an AI-assisted decision, what model and data records to maintain, and what affected individuals should be told. Its risk-based approach recognises that not every feature needs every control, while directing more scrutiny toward functions with greater stakeholder impact. It also connects AI governance practices to data-management accountability and notes that adoption does not replace compliance with applicable laws, regulations or sector-specific guidance.
❓ What’s Missing
The document expressly does not create a new set of universal AI ethics principles, instead compiling existing principles in Annex A for reference. It does not provide a framework for data sharing, nor does it address legal liability, intellectual property, or wider societal impacts such as employment, competition, unequal access to AI products and services, or misuse of AI technologies. It also excludes catastrophic failure caused by cyber-attacks on organisations heavily dependent on AI. The framework is mainly applicable to machine-learning models rather than pure decision-tree-driven AI, and it does not prescribe a single technical method, control set or harm calculation. Measures require organisational tailoring and remain subject to applicable sector-specific rules.
👥 Best For
It is best suited to organisations planning or operating AI solutions at scale, especially governance leads assigning responsibilities, risk teams assessing impact and oversight, data and model teams establishing lifecycle records and testing, and product or customer teams designing disclosures, feedback routes and decision-review processes. It is also relevant to procurers seeking governance information from AI solution providers.
📄 Source Details
Model Artificial Intelligence Governance Framework Second Edition is a 70-page English publication released on 21 January 2020. It is published by the Info-communications Media Development Authority (IMDA) and Personal Data Protection Commission (PDPC). The publication does not list individual authors, although S Iswaran signs the foreword. It describes itself as the second edition and a living, voluntary framework.
