Yes, in principle. IMDA's Model AI Governance Framework is voluntary guidance for any organisation deploying AI, and its core ideas apply directly to agents: internal governance, a deliberate choice about how far people are involved in decisions, sound operations management, and clear communication with the people affected. It guides; it does not bind.
Who does the framework apply to?
The framework is published by IMDA, Singapore's infocomm regulator, for organisations that deploy AI at scale. It is not a law and carries no penalties. Firms adopt it because it gives a common structure for AI governance, because customers and partners ask for it, and because sector supervisors expect governance of this kind. For financial institutions, MAS's FEAT principles (fairness, ethics, accountability, transparency) and its Technology Risk Management Guidelines set the sector expectations, and the Personal Data Protection Act 2012 applies to any personal data the agent handles.
The framework's guidance falls into four areas, in substance:
- Internal governance: clear roles, responsibilities and risk controls for AI.
- Human involvement in AI-augmented decisions: choose how much a person is involved, based on the probability and severity of harm.
- Operations management: data quality, model selection, testing, monitoring and review.
- Stakeholder interaction and communication: telling people about AI use, explaining decisions and offering routes to feedback or review.
A fuller reading is in IMDA Model AI Governance Framework and AI agents. IMDA also publishes further guidance from time to time, so check its current material for anything agent-specific.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
What does the human involvement principle mean for an agent that acts?
This is where the framework fits agents best. It describes a range: a person in the loop, who makes the final decision; a person over the loop, who monitors and can intervene; and a person out of the loop, where the system acts alone. The right level depends on how likely harm is and how bad it would be.
For agents, that choice has to be made per action, not per system. The same agent may safely answer balance questions with a person out of the loop, while transferring funds needs a person in the loop. One setting for the whole agent is either too loose for its riskiest action or too tight for its routine ones.
What may the agent do, and what stays with a person?
| Action | Harm if wrong | Human involvement | Who acts |
|---|---|---|---|
| Answer product questions from approved sources | Low, easily corrected | Out of the loop, with sampling | Agent |
| Update a customer's contact preferences | Low to medium | Over the loop | Agent, monitored |
| Waive a fee within policy | Medium | Over the loop, with limits | Agent within limits |
| Decline an application | High | In the loop | Person decides |
| Move money between accounts | High, hard to undo | In the loop | Person approves |
An illustrative example
Take a Singapore insurer deploying an agent to handle policy servicing for its retail customers. Its governance committee applies the framework's human involvement test to each of the agent's eight capabilities rather than to the agent as a whole. Address changes and document requests run without review. Premium refunds below a set amount run with daily sampling. Policy cancellations and anything involving a claim are held for a servicing officer.
The insurer publishes a short notice explaining that an AI agent handles some servicing and how to reach a person. Its operations team tracks the agent's accuracy on sampled cases, and the governance committee reviews the involvement levels each quarter.
Which controls show alignment with the framework?
- Named owners for each agent and a committee that approves its use.
- A human involvement decision per capability, recorded with the harm reasoning.
- Testing on realistic cases before use and after changes, with monitoring in use.
- Customer-facing notices and a clear route to a person.
- Review cycles that revisit involvement levels as evidence builds.
Organisations using several frameworks often map them together; what the NIST AI Risk Management Framework is covers the US equivalent. Banks will also find model risk rules already cover AI agents, whatever the voluntary framework says. The full map is in AI agent regulation, mapped to controls.
Questions people ask
Is the framework mandatory for financial institutions?
No. It is voluntary. MAS sets the sector's expectations through its own guidance, such as FEAT and the Technology Risk Management Guidelines, which supervised firms are expected to follow.
Can following the framework show regulators we govern agents well?
It helps. A documented framework-aligned approach shows deliberate governance, but supervisors will look at evidence: testing results, monitoring and how decisions are reviewed.
Does the framework cover agents that coordinate other agents?
Its principles apply. In practice, an orchestrating agent needs its own human involvement decision, because its errors can multiply across every agent it directs.