Singapore issues binding code for generative AI provenance and safety reporting

Singapore’s Infocomm Media Development Authority and the Personal Data Protection Commission on Wednesday released a binding Code of Practice for Generative AI that requires large platforms and model providers serving users in Singapore to implement content provenance signals and publish safety reports. The code links compliance to existing service licensing and government procurement, which gives regulators clear leverage over foreign and local firms that base regional operations in the city-state.

The move matters because Singapore is the operational hub for many Asia Pacific platforms and cloud providers. Providers that fail to comply risk losing access to public sector contracts and, for designated online services, falling out of compliance with content and safety obligations under the Broadcasting Act.

What Singapore will require

The code sets two headline obligations for services that deploy large scale generative models to the public. First, providers must attach machine readable provenance signals such as C2PA style metadata or equivalent watermarks to AI generated media where technically feasible. Second, firms must publish periodic safety evaluations that detail key risks, known jailbreak vectors, and mitigations for models they serve, including versions fine tuned for local languages.

For higher risk deployments in sectors such as finance, healthcare, and education, the code introduces incident reporting to IMDA for material model failures or abuse that cause significant harm. It also requires providers to disclose at a high level the sources of training data categories and the geographic location of training and inference infrastructure when serving regulated sectors.

Regional knock on effects

The code will apply to global firms with Singapore operations, including Meta, Google, Microsoft, OpenAI, ByteDance, Alibaba Cloud, and Baidu, along with regional platforms such as Grab and Sea Group as they add generative features. Cloud providers offering model APIs through Singapore data centers will need to ensure provenance and reporting for content delivered to local end users, even if the model weights are maintained outside the country.

IMDA and PDPC say compliance will be enforced through existing levers. That includes designation of major online services under online safety rules, public sector procurement frameworks, and data protection audits for enterprises that process personal data with generative AI.

For global technology firms, the code signals a shift in Southeast Asia from voluntary AI principles to enforceable requirements that can influence product roadmaps. Singapore’s approach is narrower than the European Union’s AI Act, but the tie to licensing and procurement creates immediate commercial incentives that will shape how models are deployed across the region.