Gov’t reviews regulations as agentic AI systems gain autonomy

Existing safeguards remain applicable, Senior Minister Tan Kiat How said.

Singapore is reviewing how existing regulatory frameworks should be adapted or strengthened as agentic artificial intelligence (AI) systems gain greater autonomy, whilst also monitoring international developments. 

Agentic AI systems present additional risks because they can execute actions, interact with external systems, and adapt their behaviour with reduced human oversight, Senior Minister of State for Digital Development and Information Tan Kiat How said.

However, he noted that many of these risks are extensions of existing challenges involving data protection, cybersecurity, and the resilience of essential digital services.

“Therefore, existing guidelines and regulations, including risk management processes and all sites, also apply to agentic AI systems,” Tan said in parliament.

Responding to questions on whether Singapore would introduce mandatory safeguards before frontier AI systems are deployed, he added that the government would continue monitoring and reviewing the need for additional requirements.

Sectoral regulators would need to work with operators of critical information infrastructure and essential services to determine appropriate safeguards.

These could include voluntary safeguards for certain agentic AI applications or specific controls for deployments involving essential services such as financial institutions and utilities.

Tan also urged private-sector organisations, including those outside critical infrastructure and essential services, to exercise care when deploying AI agents in their operations.

On cybersecurity, he warned that threats were no longer limited to advanced AI models developed by major technology companies.

“There are a number of open-weight AI models out there online that are freely downloadable, and bad actors can use those capabilities to create cyber threats against organisations or for criminal enterprise,” Tan said.

He added that organisations should strengthen basic cybersecurity measures, address system vulnerabilities, and continuously monitor unusual activity. "We cannot just wait for other people to tell us that they are hacking us.”