Artificial Intelligence Policy Tracker

AI compliance obligations

Practical requirements extracted from policy instruments, with the source article, the actors they bind, evidence examples and original framework mappings. Legal requirements are marked; everything else is voluntary guidance.

Results

6 of 117 obligations match · Download these as CSV

Legal requirement Privacy and personal-data protection Singapore

Identify consent or an applicable PDPA exception before using personal data in AI

PDPC AI advisory guidelines · Advisory guidelines, sections on consent, business improvement and research exceptions

Personal data used to train or operate AI systems requires consent unless an exception applies, such as the business improvement exception for improving products and services or the research exception for developing models, each subject to conditions.

Source-linked (a factual check against the official source, not a legal review)
Legal requirement Transparency and disclosure Singapore

Notify individuals about the use of personal data in AI recommendations and decisions

PDPC AI advisory guidelines · Advisory guidelines, section on notification obligation

Organisations should inform individuals that AI systems use their personal data, the purposes, the relevant features and how they influence decisions, proportionate to the impact on the individual.

Source-linked (a factual check against the official source, not a legal review)
Voluntary guidance Governance and accountability Singapore

Establish internal governance structures and measures for AI

Singapore Model AI Governance Framework · Second edition, Part on internal governance structures and measures

Organisations should adapt existing governance to AI: clear roles and responsibilities, board and senior management oversight, risk-management and internal controls, and staff training.

Source-linked (a factual check against the official source, not a legal review)
Voluntary guidance Transparency and disclosure Singapore

Report incidents and mark AI-generated content (generative AI framework)

Singapore Model AI Governance Framework · Generative AI framework, dimensions on incident reporting and content provenance

The generative-AI framework recommends incident-reporting channels and processes for AI harms, and content provenance measures such as digital watermarking and cryptographic provenance so that users can identify AI-generated content.

Source-linked (a factual check against the official source, not a legal review)

Frequently asked questions

What is an obligation on this site?

A single practical requirement pulled out of an instrument and stated on its own: keep a risk management system, log incidents, document training data, provide human oversight, and so on. Each one cites the article or section it comes from so you can check it against the source.

Does a voluntary obligation have legal force?

No, and every obligation is labelled either a legal requirement or voluntary guidance. Voluntary items still matter in practice, because procurement questionnaires and auditors ask about them, but only the binding ones carry legal consequence.

How do I find the obligations that apply to my organisation?

Filter by jurisdiction, category, actor, sector or use case. The applicability check asks a short set of questions and returns the duties that may reach you. It is an educational screen, not a legal determination, and it says so.

Why do some instruments have no obligations listed?

Because nobody has broken them out yet. Most instruments are recorded at summary level first; obligations are added jurisdiction by jurisdiction. The coverage and open-gaps pages publish exactly what is missing rather than hiding it.