Singapore Weighs Tougher Rules for AI Agents: Lessons for Indonesia

AI agents are software systems that do not just answer questions but plan a task, call other systems and carry it out: updating a record, raising a ticket, moving money between accounts. They are arriving in banks, utilities and government services faster than the rules for them. Singapore was the first country to publish a national governance framework for such agents, in January 2026. This week it signalled that, for the highest-risk uses, guidance may give way to requirements.

What Singapore said this week

Answering a question in Parliament on 6 October, Josephine Teo, Singapore's Minister for Digital Development and Information, set out the measures the government is considering for high-risk agentic AI applications in essential services: more rigorous testing, independently verifiable evidence that safeguards work, tighter controls on deployment, and stronger regulatory oversight. According to Tech Wire Asia's report of 7 October, no date was given for when any of these might become mandatory, and the national framework remains voluntary for now.

What the framework already asks for

The Model AI Governance Framework for Agentic AI was unveiled by the Infocomm Media Development Authority, IMDA, at the World Economic Forum on 22 January 2026. A client alert from the law firm K&L Gates describes its four pillars: risk assessment, covering what systems an agent is linked to, how sensitive its data is, how much autonomy it has and what cascading effects a mistake could have; human accountability, with oversight kept central and responsibilities clearly allocated; technical controls, including sandboxing, safety testing, monitoring and protection against misuse; and end-user responsibility, including training, transparency and the ability to intervene or switch an agent off.

In May 2026 IMDA updated the framework with real-world case studies and new practices, drawing on feedback from more than 50 organisations according to Mayer Brown, and more than 60 according to Tech Wire Asia, among them AWS, DBS, Google and Salesforce. The update emphasised least-privilege access, logging and rollback mechanisms on the technical side, and clear accountability structures, incident escalation paths and meaningful human oversight on the organisational side.

Singapore has been testing as well as writing. An AI Agents Sandbox ran for about four months from August 2025 with Google, the Cyber Security Agency, GovTech and IMDA, trying computer-use agents in quality assurance, safety testing and social assistance. In the financial sector, the Monetary Authority of Singapore published its Safeguards for Agentic Finance at Runtime in July 2026, proposing controls for agents acting in financial services, after extending its AI risk-management handbook to generative and agentic AI in March.

Why this matters in Indonesia

Singapore's guidance has no legal force in Indonesia. It matters for three practical reasons. First, Indonesia's own AI ethics regulation, still awaiting the President's signature, is reported to follow a risk-based model with prohibited, high-risk and lower-risk uses; the controls Singapore describes are a ready answer to what high-risk oversight is likely to mean. Second, many enterprises in Indonesia buy agent platforms from the same global vendors that helped shape Singapore's framework, so its vocabulary will arrive in product documentation and contracts regardless. Third, banks, insurers and groups with Singapore operations will be asked by their regional head offices to show the same controls in Jakarta as in Singapore.

There is also a simpler reason. Agents fail differently from chatbots. A chatbot that is wrong produces a wrong sentence. An agent that is wrong can produce a wrong action, repeated at speed across many records, with every later step built on it. The controls in Singapore's framework exist because of that difference, and the difference is the same everywhere.

What an enterprise can do now

• List every agent in use, including those embedded in vendor software, and for each write down what it is allowed to read, change and trigger.
• Classify by consequence. An agent that drafts internal summaries is low risk; one that changes customer accounts, approves transactions or touches essential services is high risk and needs the strictest controls.
• Give agents the least privilege that works: scoped credentials, no standing access to systems a task does not need, and separate identities for each agent so its actions can be told apart from a person's.
• Put human approval checkpoints before irreversible actions, and make sure the person approving can see what the agent is about to do, not just a summary.
• Log every action an agent takes, with the inputs it saw and the model version it used, and keep a way to roll back what it changed.
• Test before and after deployment, including adversarial tests of how the agent behaves when a tool fails or returns something unexpected.
• Keep a switch. Someone must be able to pause or deactivate an agent quickly, and that person must know they can.

What to watch next

• Whether Singapore turns any of the measures described on 6 October into requirements, and for which essential services.
• The final text of Indonesia's AI ethics regulation and how it defines high-risk uses.
• Guidance from Indonesian sector regulators on AI in banking and insurance, where agents acting on customer accounts will be the first test.
• Vendor documentation: how agent platforms describe their privileges, logging and rollback features, which will show how seriously the framework is being taken.