AI Governance Needs Operating Rules

Responsible AI is often described through principles: transparency, fairness, accountability, safety, security, and human oversight.

The principles matter. Organizations still need to turn them into operating rules.

Singapore's AI governance work has been useful because it connects broad principles with organizational roles, testing, self-assessment, and practical guidance. The work has continued to evolve from traditional AI to generative AI and, in 2026, agentic AI systems that can plan and act across several steps.

The durable lesson is not that one framework answers every question. It is that governance must remain connected to how a system is designed, deployed, monitored, and stopped.

Accountability needs a name

Saying "humans remain accountable" is not enough.

An organization should be able to identify:

• the owner of the business use;
• the owner of the data and source access;
• the people responsible for testing;
• the person who approves deployment;
• the person who reviews incidents and exceptions;
• the authority to pause or retire the system.

If responsibility is spread across a committee without decision rights, the accountability may exist on paper and disappear in practice.

Transparency should help someone act

Transparency is not a technical document that no affected person can use.

The appropriate explanation depends on the audience. A project user may need to know which sources the system used, what it can and cannot decide, and where to challenge an output. A reviewer may need version, test, and incident records. A client may need to understand how the system affects the service.

The test is whether the explanation supports a real decision.

Testing must match the use

AI Verify and related assurance efforts emphasize testing across governance principles and system risks.

An organization still has to choose evaluations that match its actual use.

A general language benchmark will not show whether a project assistant preserves approved dates, respects document permissions, separates proposed changes from accepted ones, or cites the correct revision.

Those conditions require task-specific tests, realistic failure cases, and review by people who understand the work.

Human oversight needs an intervention path

Placing a person somewhere in the workflow does not guarantee meaningful oversight.

The reviewer needs enough information, time, authority, and skill to challenge the output. The system needs a clear response when the person disagrees.

For an AI-supported project workflow, ask:

• Can the reviewer see the source?
• Can they change or reject the result?
• Is disagreement recorded?
• Can repeated failures change the method?
• Can the system be paused without losing the project record?

Oversight becomes real when intervention is possible.

Governance should continue after launch

AI systems, source data, user behavior, and project conditions change.

A responsible workflow defines what will be monitored, which failures require escalation, how incidents are reported, and when the system will be reviewed again.

This is especially important for systems that take several steps or use tools on a user's behalf. More autonomy should come with clearer limits, logging, and stop conditions.

Start with one use case

An organization does not need to solve AI governance in the abstract.

Choose one real use case and map:

1. the intended decision or task;
2. the affected people;
3. the source data and permissions;
4. the claims the system may make;
5. the tests required before use;
6. the reviewer and intervention path;
7. the incident and stop rules;
8. the next review point.

That map turns responsible AI from a slogan into work people can perform.

Further reading

• Singapore IMDA AI governance and AI Verify
• Singapore's Model AI Governance Framework for Agentic AI

Editorial disclosure: This adaptation and its representative image were developed with AI-assisted editorial and visual production, then reviewed and approved by Marcus Turner.