Talk to Us

Regulating Frontier AI: A View from a Singapore Small Business

By

Seng Siew Lim

|

Introduction In the second week of September 2026, the head of Anthropic, Dario Amodei, called for frontier AI development to slow down. Sam Altman and Elon Musk, whose companies compete with his, agreed (SiliconANGLE). President Trump did not. Speaking in Ireland on 13 September, he said he wanted the United States to keep its lead…

Introduction

In the second week of September 2026, the head of Anthropic, Dario Amodei, called for frontier AI development to slow down. Sam Altman and Elon Musk, whose companies compete with his, agreed (SiliconANGLE). President Trump did not. Speaking in Ireland on 13 September, he said he wanted the United States to keep its lead over China “because whoever wins AI wins”. He allowed that guardrails were possible, but offered no proposals (Al Jazeera; AP via WHIO). The disagreement is real. Washington regards restraint as a strategic cost. Mr Amodei regards its absence as a safety cost.

Singapore’s Minister for Digital Development and Information, Josephine Teo, answered on LinkedIn with a different emphasis. “No country can tackle AI safety alone”, she said, and safety should be built through international standards and shared testing, not by any one government or company acting first (AsiaOne).

OTP Law Corporation is a small law firm. Our clients are small and mid-sized businesses in Singapore. Neither we nor they have any reach in Washington or Brussels, and none of us will be consulted when the rules for frontier models are written. We use AI in drafting, research and document review. Our clients use it in bookkeeping, customer service, logistics and code. The rules that govern these tools are made elsewhere, and we bear the consequences when they are too loose, too heavy or too slow. This article sets out the position we think Singapore should take, and tests it against the alternatives.

What the Minister said

Her first post pointed to civil aviation, where safe air travel depends on “hundreds, if not thousands of standards and regulations”, and said: “In time to come, we will need similar set-ups for AI.” Some media reported this as a call for “aviation-style” safeguards. Two follow-up posts corrected that reading.

The analogy, she wrote, “was never meant to suggest that the risks posed by AI are the same as the risks involved in flying people on airplanes.” An aircraft does not decide where to go, and its pilot remains in command. An AI agent can pursue a goal without a human directing each step, and designers have already seen agents behave in ways they did not anticipate. Her conclusion was that “the lesson from aviation is not that AI should inherit aviation’s rulebook wholesale”. What aviation offers is “not a particular set of regulations, but a way of thinking and bias for action.”

She listed the layers that make up that way of thinking: testing before deployment, clear operating limits, redundancy in critical systems, continuous monitoring, incident reporting, independent investigation, liability assessment where necessary, and learning from near misses as well as accidents. Responsibility is shared among manufacturers, airlines, pilots, controllers, maintenance organisations and regulators. Common standards are set and enforced through international organisations such as ICAO. For AI she called for the equivalent of defence in depth, for “international standard setting bodies”, and for “urgent research and development” on the open problems: designing safeguards when the full range of situations cannot be foreseen, testing systems whose behaviour keeps changing, and keeping controls effective when capable systems can find ways around them.

The Minister’s approach is therefore multilateral and multi-country. Singapore’s part in it is visible elsewhere. IMDA convened researchers from 13 countries to produce the 2026 Singapore Consensus on Global AI Safety Research Priorities (Frontier Enterprise). For a small state that hosts no leading frontier developer, this is a rational strategy. A rule Singapore writes alone binds almost no one who matters. A standard agreed among many states can bind them all.

The cost of the multilateral route is time

The aviation comparison is instructive on this point, and not in a comforting way. Powered flight dates from 1903. The Chicago Convention was signed in 1944, and ICAO came into being in 1947. Even then, ICAO’s standards operate only through national implementation, and a state may notify the organisation of differences between its own rules and the standard. Harmonisation of that kind took decades among states that broadly shared an interest in safe flying.

AI governance starts from a worse position. A state with the most influence over frontier development disagree about whether restraint is desirable at all, as this month’s exchange shows. The European Union, which chose detailed statutory rules, spent much of 2026 delaying and simplifying its high-risk obligations after objections from industry and member states (Consilium). A consensus among many countries on standards for models that are retrained every few months will be slow to reach and slow to revise.

Meanwhile the tools are in use. Singapore’s SMEs are adopting them now, on vendors’ terms, with no agreed safety floor and no settled allocation of liability. A strategy that depends wholly on international agreement leaves a gap of years. The propositions below are meant to fill that gap without abandoning the multilateral objective.

Aviation certification as a regulatory template

A separate proposal does use aviation as a regulatory template. Amodei’s policy essay, Policy on the AI Exponential, calls for mandatory third-party safety testing modelled on aviation certification (Amodei). As a template, certification has a practical weakness. It rests on type certificates, airworthiness directives and licensed personnel, and each of these assumes a stable product. An aircraft design changes slowly, and a certified design remains the same design for decades. A frontier model is retrained, fine-tuned and superseded within months. A certification process built for AI that is based on the vigorous testing of airframes would be out of date by the time it certified anything, and a small economy would spend years building the institutions to administer it.

Other regulatory models

Several other regulatory models exist. They differ in who is regulated, what triggers the obligation, and how quickly the rules can change.

Designation by threshold. Singapore already uses this. Under the Cybersecurity Act 2018, obligations attach only to owners of designated critical information infrastructure. A comparable device is the treatment of systemically important institutions in financial regulation, where heavier requirements apply only above a size or interconnectedness threshold. California’s SB 53, enacted in 2025, applies a similar approach to AI: transparency and incident-reporting duties fall on developers of very large frontier models, not on the businesses that use them.

Principles-based supervision with a sandbox. The Monetary Authority of Singapore regulates fintech through outcome-focused guidelines, supported by a sandbox in which new products operate under relaxed rules and close supervision. The United Kingdom has taken a similar route for AI, asking existing sector regulators to apply shared principles instead of creating a new statute. Guidance can be revised in weeks.

Product-safety and liability rules. This model allocates responsibility when a product fails instead of certifying the technology in advance. It suits deployed applications, and it protects SMEs who buy tools they cannot audit.

Pre-market approval on the pharmaceutical or nuclear pattern. Staged trials or licensing precede release. It is the slowest and most expensive option, defensible only where failure would be catastrophic and irreversible.

The risk model Singapore already has

Singapore does not need to invent a tool for sorting risks. The Model AI Governance Framework (2nd edition, 2020) assesses a deployment by the probability and severity of the harm it could cause, and matches the level of human involvement to that assessment: a human in the loop, over the loop, or out of it. IMDA’s updated framework for agentic AI applies the same reasoning to autonomous agents. It asks how severe an agent’s possible action is, whether it can be reversed, and whether a human is realistically positioned to intervene before harm occurs (IMDA).

One feature of this model shapes the first proposition below. It rates a deployment, not a model. A small model used to score loan applications can be high-risk. A very large model used to format invoices is not.

Five propositions

1. Aviation should inform the safety culture. Its certification machinery should not be the template. The Minister has said the lesson is not that AI should inherit aviation’s rulebook wholesale, and we agree. Regulators should carry over the parts of aviation practice that travel well: incident reporting, independent investigation of serious failures, and learning from near misses. We should pursue international standards as proposed, and adopt the two-tier domestic measures below while those standards take shape.

2. Binding rules should apply in two tiers.

Tier one: frontier developers. Binding obligations should apply to developers of models above a capability threshold: publishing a safety framework, testing before release, and reporting serious incidents to a regulator. Singapore hosts few or no such developers. So for Singapore , the rule must operate on those who make such models available in Singapore. Singapore should also recognise compliance with equivalent regimes elsewhere. A developer that satisfies California’s requirements or the EU’s would be deemed to satisfy ours in the areas where they overlap. Mutual recognition keeps the cost low for everyone and fits the multilateral route the Minister favours.

Tier two: high-risk deployments. Binding obligations should apply to uses of AI whose potential harm is severe, hard to reverse, and not realistically subject to human intervention. These are assessed under the existing Singapore risk criteria and enforced by the sector regulators that already supervise the field: MAS for financial services, the Ministry of Health for healthcare, and so on. The obligations should be specific and scaled: human oversight, record-keeping, and a duty to report incidents. A firm using AI for scheduling or drafting falls outside this tier and remains subject to guidance and its contracts.

The two tiers address different things. Tier one governs what is built, and tier two governs where it is used. A rule confined to frontier models would miss the loan-scoring example above. A rule confined to high-risk uses would leave the frontier developer with no direct duty at all.

3. Over-regulation raises the cost of adopting AI, and SMEs feel that cost first. Compliance costs are expected to be high. A large firm absorbs them across a legal department, and a small firm carries them as a share of revenue. Vendors also pass costs on through pricing. Cautious insurers, banks and corporate customers turn each new requirement into a checklist for their suppliers. A business that cannot afford the paperwork does not adopt the tool, and competes at a disadvantage against those that did. We do not advocate that no rules are the alternative: unclear liability and weak bargaining power with vendors cost SMEs too. The answer is proportionality, and a requirement that every proposed rule under either tier be accompanied by an assessment of its effect on small businesses before it is finalised.

4. Research into different routes to more capable AI should be encouraged, not narrowed by regulation. No one knows which path leads to the next major advance, or to artificial general intelligence if it can be reached. Current frontier systems are large neural networks trained on very large volumes of data, and their reasoning cannot be fully inspected. Developing technologies like neuro-symbolic AI, which combines neural learning with explicit logical rules, and related research may produce systems that are easier to verify and explain, and as a result need less data and computing power. At the moment, this is still a hypothesis and it has not been proved at frontier scale. Regulation written around today’s dominant architecture could entrench it by accident, through either the compliance cost or the exemptions it creates. The tier-one threshold should therefore be defined by capability and not by compute or architecture. In short, it should be technology agnostic. Funding, procurement preferences and access to testing should be open to researchers working on any credible alternative.

5. Applied research on real-world deployment should be funded. Benchmarks measure what models can do in tests. They say little about what happens when a model is embedded in a payroll system or a customs filing workflow. The Minister has called research and development on safeguards urgent, and the open questions she lists are empirical. Singapore is well placed to run structured trials with SMEs in logistics, professional services, retail and manufacturing, and to publish what fails. That evidence would improve the risk criteria used in tier two. It would also reach businesses that cannot commission it themselves.

What SMEs can do now

Security researchers recently linked OpenAI’s testing agents to an attack on the RubyGems software repository, in which more than 2,000 malicious packages were uploaded within 48 hours (Forkast). The same report cites surveys finding that only 18% of organisations keep a complete inventory of the AI agents running in their systems. If a well-resourced laboratory cannot account for its agents, a small firm running third-party tools has good reason to be concerned.

Fortunately, the initial steps a SME can take are inexpensive. Keep a list of the AI tools in use and the person responsible for each. Read vendor terms for liability, audit rights and data handling before signing, and negotiate where possible. Flag AI-related clauses in EU and US customer contracts for legal review. Respond when IMDA and the trade associations open consultations. A rule that works for a hundred-person company and not for a five-person one is easiest to fix before it is issued.

Singapore’s frameworks already contain the right questions about risk. What remains is to decide who they bind, at what threshold, and how quickly they can be revised. The multilateral standards the Minister favours will take years to arrive. The domestic rules can be in place sooner, and small businesses can help shape them through the consultations the regulators run.

Sources

Accessed on 20th Sept 2026)

By

Seng Siew Lim
Director, OTP Law Corporation