AI Guide For Boards in Singapore

AI GUIDE FOR BOARDS IN SINGAPORE

Section IV: Ethics and Trust

AI-Specific Due Diligence

GOVERNANCE AND ACCOUNTABILITY

DATA GOVERNANCE AND PRIVACY

• AI governance structures and oversight mechanisms • Defined accountability and escalation processes • Alignment with recognised frameworks and standards

• Data ownership and usage rights • Data retention and deletion policies • Restrictions on model training using organisational data • Cross-border transfer arrangements • Third-party access and subcontracting arrangements

MODEL RISK AND PERFORMANCE • Bias testing and fairness assessments • Model robustness and reliability • Human oversight mechanisms • Monitoring for model drift and performance degradation

SECURITY AND RESILIENCE

• Protection against prompt injection and adversarial attacks • Data leakage prevention • Cybersecurity controls and monitoring • Business continuity and fallback arrangements OPERATIONAL AND FINANCIAL STABILITY • Vendor’s technical capabilities • Operational maturity • Financial sustainability • Dependence on other model providers

REGULATORY AND ETHICAL COMPLIANCE • Compliance with applicable regulations • Transparency of AI use • Responsible AI safeguards • Intellectual property considerations

8.3.2 Establishing a third-party policy

2. Risk classication criteria: e policy should establish a framework for categorising AI providers and use cases based on factors such as business criticality, data sensitivity, regulatory impact, and potential harm. is enables governance controls to be proportionate to the level of risk. 3. Due diligence requirements: e policy should specify the assessments required before engaging an AI provider, including reviews of governance, data management, security controls, model performance, regulatory compliance, and operational resilience.

A third-party AI policy should document the governance, controls and oversight of third- party vendors. An eective third-party AI policy should dene the following elements: 1. Scope and denitions: Clear denitions of what constitutes an AI system, the types of third-party AI services covered, and the circumstances under which the policy applies will help ensure consistent interpretation and application across the organisation.

78

Made with FlippingBook Digital Proposal Creator