Establish internal governance structures and measures for AI

Practical action

Assign an AI governance owner and add AI risks to the enterprise risk register.

Who does it apply to?

Voluntary for any organisation deploying AI.

Actors

Provider / developerDeployer / user organisation

Sectors

Cross-sector / all sectors

Use cases

AI in finance, credit and insuranceGenerative AI and foundation models

Which controls meet this duty?

Satisfies: the control, operated properly, does the work the duty asks for. Supports: it contributes but the duty needs more. Each control page lists every other duty it serves, so work done once can be counted once.

• satisfiesPolicyExecutive sponsor for AI · annual
  AI governance policy and accountability structure

  Serves 16 recorded duties · evidence: AI policy, Board or executive approval of the AI policy, AI governance forum minutes

  Roles, board oversight and internal controls for AI.

• supportsProcessAI system owner · once per ai system
  AI risk assessment and lifecycle risk register

  Serves 12 recorded duties · evidence: AI system risk assessment, Per-system AI risk register, Residual-risk acceptance

  Adding AI risks to enterprise risk management.

• supportsTraining programmeLearning and development lead · annual
  AI literacy and role-based training programme

  Serves 4 recorded duties · evidence: AI training completion records, Role-to-curriculum training matrix, AI training curriculum and materials

  Staff training component.

Templates that cover this duty

Generated from the records. Free · no account · links emailed to your work address. This duty is cited in each file with its source reference and a link back here.

• AI System Inventory

  Register · XLSX and DOCX · v6

• AI Acceptable Use Policy

  Policy · DOCX · v1

• AI Governance Policy and RACI

  Policy · DOCX and XLSX · v5

• ISO/IEC 42001 Gap Assessment and Statement of Applicability

  Assessment · XLSX · v3

All 9 templates that cover it →

What evidence would a reviewer expect?

Framework mappings

Original editorial crosswalks. They cite clause numbers only and reproduce no standard text; confidence reflects how direct the mapping is.

See every Singapore duty mapped this way →

Frequently asked questions

Cite this record

AIPolicyTracker (2026). “Establish internal governance structures and measures for AI (Singapore Model AI Governance Framework)” [AIPT-OBL-0054, verified 26 September 2026 by Bhaskar Bhatt]. https://aipolicytracker.org/id/AIPT-OBL-0054 (accessed 27 October 2026). Data licensed CC BY 4.0.

Permanent id AIPT-OBL-0054: it never changes or gets reused, and its address keeps working if this page moves.

Cite the official text alongside it: Model AI Governance Framework (Second Edition), Personal Data Protection Commission Singapore and IMDA, https://www.pdpc.gov.sg/help-and-resources/2020/01/model-ai-governance-framework.

@misc{aipolicytracker2026_establishinternalgoverna,
  author       = {{AIPolicyTracker}},
  title        = {{Establish internal governance structures and measures for AI (Singapore Model AI Governance Framework)}},
  year         = {2026},
  howpublished = {\url{https://aipolicytracker.org/obligations/singapore-mgf-internal-governance}},
  url          = {https://aipolicytracker.org/obligations/singapore-mgf-internal-governance},
  urldate      = {2026-10-27},
  note         = {Data licensed CC BY 4.0. Accessed 27 October 2026}
}

Change history

Similar obligations in other instruments

• Use high-risk AI as instructed, monitor it and inform affected people — EU AI Act, European Union
• Providers must meet the full set of provider duties for high-risk AI — EU AI Act, European Union
• Providers must supply conformity evidence and log access to authorities on request — EU AI Act, European Union
• Non-EU providers must appoint an EU authorised representative for high-risk AI — EU AI Act, European Union
• Deployers, distributors and importers must assume provider duties when they rebrand or substantially modify high-risk AI — EU AI Act, European Union
• Law-enforcement deployers must obtain authorisation for post-remote biometric identification and report annually — EU AI Act, European Union
• Providers of GPAI models must notify the Commission within two weeks of meeting the systemic-risk threshold — EU AI Act, European Union
• Non-EU providers of GPAI models must appoint an EU authorised representative — EU AI Act, European Union