AI GUIDE FOR BOARDS IN SINGAPORE
Section IV: Ethics and Trust
4. Contractual standards: Minimum contractual requirements relating to data usage, intellectual property ownership, audit rights, incident noti cation, service levels, and termination provisions should be speci ed, to ensure appropriate legal and operational protections. 5. Monitoring and reporting requirements: e policy should establish expectations for ongoing oversight of AI providers, including periodic reviews, performance monitoring, compliance assessments, and reporting of signi cant risks or issues to management and the board. 6. Incident escalation procedures: Processes for identifying, reporting, investigating, and escalating AI-related incidents should be stated clearly, including thresholds for management intervention and board noti cation. 7. Roles and accountability: Responsibilities for vendor selection, risk assessment, approval, monitoring and incident management should be assigned. Accountability for AI outcomes should remain with designated business and functional leaders, even when AI capabilities are provided by third parties.
policy and process controls, contractual safeguards, technical controls and ongoing monitoring. • Policy and process controls: ese controls establish requirements for AI procurement, risk assessment, approval thresholds and vendor inventories. • Contractual safeguards: Contracts should de ne rights and obligations regarding data use, intellectual property, audit access, incident reporting and termination. • Technical controls: ese controls help manage operational risks through monitoring, access management, ltering and data protection mechanisms. • Ongoing monitoring: AI vendors may update models, change training practices, or introduce new capabilities over time. Boards should therefore ensure that management periodically reassesses critical AI providers and reports material changes to their risk pro les.
8.3.4 Emerging risk areas
Boards should treat third-party AI risk as a governance issue, rather than a technology risk. ese developments represent Emerging AI Risks , and may introduce additional operational, governance and concentration risks over time. Boards should also pay attention to evolving AI deployment models, including generative AI services, agentic AI systems and AI supply chain dependencies.
Boards remain accountable for outcomes delivered through third-party AI systems.
8.3.3 Vendor governance
Eective governance may require multiple layers of protection throughout the vendor lifecycle. ese protections typically include
79
Made with FlippingBook Digital Proposal Creator