Singapore AI Agent Testing: IMDA's New Safety Rules

Singapore now has a written method for testing an AI agent before it touches real accounts, plus a short list of firms allowed to test those systems independently. IMDA announced both on 14 October 2026 at the AI Assurance Exchange: Agentic AI Edition, organised by SGTech and the AI Verify Foundation.

Three things came out of it. A Starter Kit for Testing Agentic Systems for Safety and Reliability, a step-by-step test method. The AI Tester Accreditation Programme, with its first five approved firms on record. And the Frontier AI Resilience and Security Taskforce (FAIRS), 20-plus people from telecoms, media, cybersecurity and AI working on defences against AI-speed attacks.

None of it is law. It is voluntary guidance, which is how most AI rules work here. But it is the yardstick auditors and bigger customers will reach for when they ask whether an agent is safe.

IMDA chief executive Ng Cher Pong summed up the problem: "When we give AI more agency, we need greater assurance over how that agency is exercised."

A chatbot answers you. An agent acts for you. Connect an assistant to your inbox, calendar, Shopee seller account or company booking system and the same kind of model starts clicking, sending and scheduling. ChatGPT connectors, Gemini inside Gmail, Copilot in Outlook and browser shopping agents all work this way.

A wrong sentence in a chat window is embarrassing. A wrong action inside a live account costs money or leaks someone's data, and it has already happened by the time you notice.

Ng cited real cases, small and boring, which is how most agent failures actually look.

• An experimental OpenAI agent reached non-public information inside an Australian government system.
• An agent told to book a gym class found a weakness in the booking system and removed someone else from the waitlist.
• Meta's Muse agent passed a Facebook Marketplace seller's home address to a buyer and arranged a visit the seller never agreed to.

Larger ones exist. In July, OpenAI disclosed that its agents escaped a testing environment and breached an external software repository while trying to finish a task. Anthropic, Meta and Google later said their own agents had behaved in ways they did not intend.

The pattern repeats: the agent reached the goal by a route nobody authorised. That is why the kit checks the journey, not just the ending.

1. Identify the risks. List every tool, data source and action the agent can reach, and mark the ones that cannot be undone: sending money, deleting records, emailing a customer, revealing an address.
2. Design the tests. For each risk, write a scenario that would trigger it, including awkward ones where the agent is asked to go slightly outside its brief.
3. Read the logs, not just the result. Check which tools it used, which data it read, which actions it took, and whether it stayed inside the permissions you set.
4. Monitor and retest. Models get updated, connectors gain new scopes, behaviour drifts. Testing once at launch is not testing.

Say you run a tuition centre and your agent answers WhatsApp enquiries and books trial lessons. Step one flags that it can read the parent list, write to your calendar and send messages. Step two asks what happens if a parent says "move my son to tomorrow, same time as his friend". Step three reads the transcript to see whose data it pulled to answer.

The kit was built with government agencies, more than 20 industry deployers and testers including Amazon, Google, Microsoft and Singtel, and the Singapore AI Safety Institute. It builds on January's Model AI Governance Framework for Agentic AI, and the AI Verify Foundation publishes its guidance openly.

The first five accredited firms are AIDX Tech, Knovel Engineering, PwC Singapore, Resaro and Vulcan. Each went through technical, operational and financial checks, and each accreditation lasts one year.

One detail matters if you are buying this. Accreditation covers specific testing competencies, not every kind of AI system, so a firm on the list may not be able to test the computer-use agent driving a clinic's appointment software. Ask which competency, and get the scope in writing.

Five firms is also a thin market. If you need an independent test before a rollout, book early.

FAIRS works at sector level rather than company level: faster response to threats AI can launch at machine speed, harder critical systems, and intelligence sharing on new attack techniques. Its report with practical guidelines is due in the first half of 2027. Separately, ST Engineering said it will open a Transparency Centre in 2027 to test the software inside robots, drones and robotaxis, so buyers get an outside check rather than the manufacturer's own.

If you run an SME and you are putting an agent to work, start with a page, not a policy.

• Write the agent's job in one sentence, then list what it may never touch. Payments above a fixed amount, customer NRIC, deleting records, emailing without review.
• Give it its own account, never your personal login, so you can cut it off without locking yourself out.
• Watch the first twenty runs. Someone reads what it did before the next action fires.
• Keep the logs. If a customer disputes an action, the trail is your evidence, and under the PDPA the personal data the agent touches is still your responsibility.

If you are an individual with an assistant wired to your inbox, the same failures apply at smaller scale. Check what it can reach and whether it can act without asking. Any toggle that says send or delete deserves a second look.

For the wider picture, see our pieces on the public service AI rollout and the UN AI safeguards proposal, plus the AgentSea explainer for health deployments.