AI GUIDE FOR BOARDS IN SINGAPORE
Section III: Governance and Oversight
7.6 Governing the AI Lifecycle
7.6.1 Managing third-party dependencies
AI governance should extend across the entire system lifecycle, from concept and development through deployment, monitoring and retirement. Boards should ensure that governance controls exist at each stage: 1. Ideation: Shi the focus from whether a system can be built to whether it should be built. Management must explicitly articulate the business problem, expected strategic value, data requirements, and potential modes of harm or systemic dependency. 2. Design and build: Document all development assumptions in plain language, mandate independent technical challenge, and implement risk-proportionate testing to counter development optimism. 3. Deployment: Before signing o on deployment, management must clarify what has been veri ed, what failure modes are anticipated, and the precise conditions that trigger a system rollback. 4. Continuous monitoring: AI systems are dynamic; inputs shi , user behaviours mutate, and models dri . Monitoring must look beyond statistical accuracy to track override frequencies, customer complaints, and emerging fairness anomalies. 5. Retirement: Decommissioning a system requires managing residual liabilities, ensuring data retention compliance, and ensuring that sta do not continue relying on deprecated algorithmic logic.
Boards should recognise that procuring third-party AI tools does not outsource accountability. • Contractual protections. • Outage contingencies. • Update noti cation obligations. • Operational resilience dependencies. • Management should conduct due diligence, covering: • Data handling practices. • Model governance.
7.6.2 Responding to incidents
Traditional disaster recovery approaches may not adequately address AI-speci c failure modes. Boards should ensure management develops AI-speci c recovery and incident response playbooks, including: • AI kill-switches: Mechanisms to isolate or disable AI systems safely without disrupting broader enterprise operations. • Fallback operating modes: Prede ned manual or deterministic alternatives when AI systems are unavailable or unreliable. • Model integrity and breach response: Procedures for isolating compromised models, restoring trusted versions and remediating corrupted datasets.
Boards should consider: • Why is the organisation using the system. • Who approved it.
• What is its ongoing value. • How do we stop it safely if circumstances change.
69
Made with FlippingBook Digital Proposal Creator