Singapore is advancing its AI ambitions, but organisations are struggling to keep risk in check. Many organisations still struggle to track AI tools, understand how third-party platforms use their data and monitor risks as systems evolve. Without proper oversight, they risk data exposure, security breaches and loss of control.
Key Takeaways
- 49% of Singaporean organisations introduced formal AI review and approval processes after an AI-related incident in the past 12 months.
- 57% say data quality, access, privacy or security concerns have most delayed their AI initiatives.
- 29% expect AI-related data loss, corruption or misclassification in the next 12 months, while 33% believe they are underestimating these risks.
OneTrust’s 2026 AI Governance Survey and Report highlights this shift, finding that nearly half (49%) of Singaporean organisations introduced formal AI review and approval processes following an AI-related incident in the past 12 months, while 46% strengthened their monitoring or governance controls.
A recent incident exposed the risks of inadequate AI oversight, after a Singapore retailer reportedly exposed more than 95,000 customers’ email addresses when an employee used AI-generated code for a marketing campaign. The case highlights the importance of thorough testing, clear AI-use policies and appropriate oversight to reduce the risk of data breaches and reputational damage.
As AI becomes embedded in everyday business operations, the challenge is not simply responding when something goes wrong, but establishing the governance structures and safeguards needed to prevent incidents in the first place.
The cost of getting governance wrong
AI incidents can expose organisations to financial losses, operational disruption and reputational damage, with data-related risks a particular concern. OneTrust research found that 57% of organisations say concerns around data quality, access, privacy or security have most delayed their AI initiatives.
While 29% of organisations expect to experience AI-related data loss, corruption or misclassification in the next 12 months, 33% believe they are underestimating these risks.
This highlights the need for greater visibility into where AI is being used, what data it can access and how its outputs influence decisions. Without this oversight, organisations risk exposing sensitive data and critical operations to threats they may not fully understand or anticipate.
Why reactive governance is no longer enough
Introducing additional approvals and monitoring after an incident is a natural response, but it leaves organisations reacting to problems rather than preventing them. Governance should not simply be an approval step that slows innovation. It should enable responsible AI adoption by making risks visible, clarifying accountability and embedding controls throughout the AI lifecycle.
The answer is not fewer controls, but more effective ones. Clear approval pathways, defined ownership and ongoing monitoring can help organisations manage risks consistently without creating unnecessary barriers to adoption.
Building confidence before something goes wrong
For Singapore organisations, proactive governance starts with understanding how AI is being used across the organisation, including unapproved tools and access to sensitive data.
Controls should reflect the level of risk, with stronger oversight for applications involving customer data, financial information or critical business decisions. Clear accountability across IT, security, legal, compliance and business teams helps identify and address risks early.
As AI adoption grows, ongoing monitoring is essential to ensure controls keep pace with new tools, changing data and evolving employee usage.
Making governance a foundation for AI adoption
Organisations that understand their AI risks, establish clear accountability and embed governance into everyday operations will be better positioned to scale AI responsibly.
Governance cannot eliminate every risk, but organisations should not have to wait for an incident to expose weaknesses. By identifying and addressing risks early, Singaporean organisations can protect sensitive data, maintain customer trust and unlock AI’s potential for sustainable growth.