Singapore’s New AI Board Guide: What Directors Should Do Now

The Singapore Institute of Directors (SID) has published a 116-page AI Guide for Boards in Singapore with the Infocomm Media Development Authority (IMDA), Microsoft and OpenAI. Launched on 31 July 2026, the guide is designed to help directors oversee AI strategy, value creation, governance, resilience and risk.

Its key shift is one of responsibility: AI should be treated as a board-level business and governance issue, not merely as a technical implementation project. Directors are expected to understand where AI can create value, challenge management’s assumptions and ensure that deployment remains accountable and resilient.

The board’s first question should be: what outcome will AI improve?

The guide urges boards to assess AI investments by their expected contribution to the organisation. A credible business case might target revenue, productivity, service quality, decision quality, risk reduction or operational resilience. The important point is to define the outcome before approving the investment and then measure whether it was actually achieved.

That means separating meaningful performance indicators from activity metrics. The number of pilots launched, software licences purchased or employees trained may show effort, but none proves that an AI programme is delivering value. Boards should ask management to report realised results, costs, limitations and risks alongside adoption figures.

This approach also helps prevent two common failures: approving disconnected experiments without a path to scale, or blocking useful deployment because no one has defined what success looks like. The guide’s focus on strategy, use-case selection and returns is intended to connect AI spending with the organisation’s broader priorities.

Bring employee experimentation inside the governance perimeter

Employees may already be using AI tools informally or developing their own workflows. The recommended response is not to ignore that activity, but to turn useful experimentation into managed organisational capability.

Boards should expect management to understand which tools and use cases are in use, who owns them, what data they handle and what controls apply. Documenting AI-built tools, establishing governance over their use and ensuring that safety requirements are met are among the guide’s stated considerations.

In practice, that requires institutional rules covering approved tools, sensitive information, accountability, monitoring and escalation. It also means recognising and developing the workforce’s existing AI capabilities rather than treating adoption as something imposed solely from the top. A strategy with no skills plan, ownership model or operating discipline is unlikely to move reliably from experimentation to execution.

Make the whole board AI-literate enough to challenge management

The guide frames AI literacy as a board competency. Directors do not all need to become machine-learning engineers, but the board as a whole should understand how AI may affect industries, operating models, competition, decision-making and risk.

Several directors should be able to question management’s assumptions, value claims and risk assessments. The board should also have access to at least one person—whether a director, adviser or committee member—with enough technical depth to challenge choices about systems, data, testing and controls.

This is more demanding than assigning AI to a technology committee and receiving periodic updates. It makes AI part of the board’s strategic and fiduciary oversight, while preserving the need for specialist advice where technical questions exceed the board’s expertise.

Set decision rights before systems are deployed

AI governance becomes actionable when an organisation defines who can approve, operate, monitor and stop an AI system. Boards should require risk-based decision boundaries that distinguish between:

• decisions management can make within approved limits;
• decisions that require board or committee escalation; and
• decisions that AI must not make autonomously.

The stricter the consequences, the stronger the controls should be. For high-impact employment uses—including recruitment, promotion, termination and performance assessment—boards should set hard red lines around meaningful human review and accountable decision-makers. AI output should not become an unchecked automated determination about a person’s livelihood.

This principle is consistent with the broader governance expectation that AI should support, rather than silently replace, human judgment. It also gives management a practical test: the owner, approval threshold, human-oversight point and stop process should be clear before a system goes live.

Require testing for fairness, data quality and contestability

A responsible approval process cannot stop at whether a model performs well on average. Boards should ask how the organisation tests data quality, documents limitations, reviews potential bias and monitors performance after deployment.

Where an AI system affects people materially, those affected should have a meaningful way to understand the decision, challenge an outcome and request human reconsideration. Explanations do not need to expose proprietary technical details, but they should be sufficient for accountable review and appeal.

This is part of a wider control environment. Singapore’s corporate-governance materials describe the need for transparent and accountable AI decision-making, as well as attention to regulatory and ethical standards. The board’s role is to ensure that these expectations become documented processes rather than general principles with no owner or evidence.

Treat AI as part of cyber and operational resilience

AI creates a two-sided security problem. Organisations must prepare for AI-enabled phishing, social engineering, fraud, automated attacks and faster vulnerability discovery. They must also protect AI systems themselves against data leakage, prompt injection, model manipulation and weaknesses introduced by vendors or third parties.

Boards should therefore ensure that AI risks appear in cyber-resilience reporting, assurance work and incident-response plans—not in a separate technology silo. The relevant questions include who can disable a system, how incidents are reported, how affected data and decisions are investigated, and how the organisation recovers if an AI service becomes unavailable or compromised.

This emphasis extends existing board expectations around cyber resilience and risk management. SID’s cyber guidance likewise treats resilience as something to embed into corporate strategy, rather than a purely technical task.

Apply higher standards to critical and high-consequence systems

The consequences of an AI failure vary significantly by use case. A low-risk internal productivity tool does not require the same oversight as a system supporting essential services, critical infrastructure or other high-consequence operations.

For those environments, boards should expect tighter requirements for resilience, security, testing, monitoring, escalation and recovery. The reason is straightforward: a failure or compromise could affect more than the organisation’s immediate finances or reputation. It may also disrupt important services or create wider operational consequences.

The guide’s risk-based approach avoids treating every AI application identically. It instead asks boards to match authority and controls to the possible impact of failure.

A practical board dashboard for material AI use cases

The guide’s recommendations can be turned into a concise board-level register or dashboard. For every material use case, management should be able to identify:

1. The owner responsible for the system and its outcomes.
2. The intended business result, including how success will be measured.
3. The decision rights and escalation thresholds.
4. The data sources and handling rules involved.
5. The risk tier and rationale for assigning it.
6. The controls, including security, fairness and data-quality checks.
7. The human-oversight point and the person accountable for the final decision.
8. Testing and monitoring results, including known limitations.
9. Incidents, complaints or appeals and how they were resolved.
10. The next review date or trigger for reassessment.

That structure connects value creation and risk management in the same record. It also gives directors evidence they can interrogate instead of relying on broad claims that the organisation is “using AI responsibly.”

The takeaway for company directors

SID’s guide does not present AI adoption and AI governance as opposing choices. It asks boards to pursue useful applications with the same discipline they would apply to other material strategic investments: define the value, assign accountability, understand the risks, test the controls and review the results.

For directors, the immediate action is to put AI on the regular board agenda, review the organisation’s material use cases and identify gaps in literacy, ownership, decision rights, human oversight, testing and resilience. The strongest AI strategy is not the one with the most activity. It is the one the board can explain, measure and govern.