Singapore is advancing its AI ambitions, but organisations are struggling to keep risk in check. Many organisations still struggle to track AI tools, understand how third-party platforms use their data and monitor risks as systems evolve. Without proper oversight, they risk data exposure, security breaches and loss of control.
OneTrust’s 2026 AI Governance Survey and Report highlights this shift, finding that nearly half (49%) of Singaporean organisations introduced formal AI review and approval processes following an AI-related incident in the past 12 months, while 46% strengthened their monitoring or governance controls.
Here’s why Singapore’s workers have adopted AI, but most of its SMEs have not yet
A recent incident exposed the risks of inadequate AI oversight, after a Singapore retailer reportedly exposed more than 95,000 customers’ email addresses when an employee used AI-generated code for a marketing campaign. The case highlights the importance of thorough testing, clear AI-use policies and appropriate oversight to reduce the risk of data breaches and reputational damage.
As AI becomes embedded in everyday business operations, the challenge is not simply responding when something goes wrong, but establishing the governance structures and safeguards needed to prevent incidents in the first place.
The cost of getting governance wrong
AI incidents can expose organisations to financial losses, operational disruption and reputational damage, with data-related risks a particular concern. OneTrust research found that 57% of organisations say concerns around data quality, access, privacy or security have most delayed their AI initiatives.
While 29% of organisations expect to experience AI-related data loss, corruption or misclassification in the next 12 months, 33% believe they are underestimating these risks.
This highlights the need for greater visibility into where AI is being used, what data it can access and how its outputs influence decisions. Without this oversight, organisations risk exposing sensitive data and critical operations to threats they may not fully understand or anticipate.
Why reactive governance is no longer enough
Introducing additional approvals and monitoring after an incident is a natural response, but it leaves organisations reacting to problems rather than preventing them. Governance should not simply be an approval step that slows innovation. It should enable responsible AI adoption by making risks visible, clarifying accountability and embedding controls throughout the AI lifecycle.
The answer is not fewer controls, but more effective ones. Clear approval pathways, defined ownership and ongoing monitoring can help organisations manage risks consistently without creating unnecessary barriers to adoption.
Building confidence before something goes wrong
For Singapore organisations, proactive governance starts with understanding how AI is being used across the organisation, including unapproved tools and access to sensitive data.
Controls should reflect the level of risk, with stronger oversight for applications involving customer data, financial information or critical business decisions. Clear accountability across IT, security, legal, compliance and business teams helps identify and address risks early.
As AI adoption grows, ongoing monitoring is essential to ensure controls keep pace with new tools, changing data and evolving employee usage.
Making governance a foundation for AI adoption
Organisations that understand their AI risks, establish clear accountability and embed governance into everyday operations will be better positioned to scale AI responsibly.
Governance cannot eliminate every risk, but organisations should not have to wait for an incident to expose weaknesses. By identifying and addressing risks early, Singaporean organisations can protect sensitive data, maintain customer trust and unlock AI’s potential for sustainable growth.
The article titled “This AI threat is catching organisations off guard as adoption accelerates” was authored by Arran Mulvaney, Regional Director, South East Asia & India at OneTrust
About the author
Arran Mulvaney is Regional Director for ASEAN and India at OneTrust, based in Singapore. He leads regional go-to-market strategy across Southeast Asia and India, working with enterprises in highly regulated sectors to operationalise data privacy, AI governance, consent, and third-party risk programs.
Arran partners with senior business, legal, risk, and technology leaders to help organisations move from regulatory awareness to practical execution. His work focuses on building trust as a business enabler, helping companies manage regulatory complexity, adopt emerging technologies responsibly, and create scalable governance programs across fast-growing Asian markets.
He is a frequent speaker on privacy, AI governance, and trust, with a particular focus on how organisations can turn compliance obligations into stronger customer relationships, better risk management, and more resilient digital growth.