AI Governance

AI governance connects an institution's decisions about acceptable use with the controls, people and evidence that make those decisions effective. It covers what a system may do, who approves its use, how its performance is assessed and what happens when it fails. An agent that can change records or initiate an external action makes that connection especially consequential.

WCAI's governing thesis is that accountability should follow the authority an institution delegates. Business owners, deployment teams, suppliers and human reviewers have different responsibilities. A policy becomes useful when it identifies those responsibilities and the operating arrangement supports them. A human checkpoint needs enough information, time and authority to affect the outcome.

The policy context and the operating task

Singapore's Model AI Governance Framework for Agentic AI, launched on 22 January 2026, recommends bounding agents' powers, meaningful human accountability, lifecycle controls and user education. It addresses both internally developed and purchased agents. Its publication establishes practical guidance; it does not create a universal statutory rule deciding who is liable for every AI action.

For financial institutions, MAS's March 2026 MindForge toolkit announcement connects oversight, risk management, lifecycle controls and enabling capabilities. The 5 August 2026 parliamentary reply describes SAFR as a potential approach to action authorisation, human oversight and decision records. At that date, MAS said its proposed AI risk-management guidelines would be finalised soon. These sources have distinct statuses; neither the toolkit nor the reply establishes a new certification scheme.

Existing legal duties also matter. The PDPC's March 2024 AI guidelines explain how Singapore's personal-data obligations apply to relevant AI systems. Elsewhere, the NIST AI Risk Management Framework offers a voluntary approach to incorporating trustworthiness into design, use and evaluation. An institution needs to distinguish law, supervisory expectations, proposals and voluntary guidance, then assess the requirements for its entities and uses. A shared regional architecture does not settle every country's acceptance decision.

Questions shaping our research agenda

The following questions define proposed inquiry. They are not findings from completed WCAI interviews or a claim that one governance arrangement has already been empirically validated.

How should institutions allocate accountability across an agent's action?

Responsibility for choosing a business purpose differs from responsibility for configuring access, supplying a service or approving a transaction. Research should examine where those responsibilities meet and where an institution can inspect the evidence. The useful output is an allocation that connects each role to authority, resources and escalation, while leaving legal liability to the applicable law and facts. Our accountability essay develops that argument.

What makes human oversight effective at operating volume?

A person can approve an action without understanding it or having time to examine the evidence. We want to investigate the information, review capacity and intervention powers different workflows require. Proposed evaluation should consider missed errors, unnecessary escalations, review time and whether the executed action matches the approval. The question is when oversight changes the outcome and what scope is justified when reviewers cannot reliably perform their assigned role.

What evidence warrants greater delegated authority?

An evaluation should support a particular release decision. Aggregate accuracy can conceal serious errors, excessive abstention or poor performance in important groups. Our research agenda asks how institutions can connect held-back tests, operating observations and failure exercises to decisions about wider use. The release evidence guide supplies a working method; its thresholds require the process owner's judgement and do not certify safety.

How do supplier changes affect an institution's accepted risk?

Models, integrations and hosted services can change after an institution completes its evaluation. Research should examine which changes require renewed acceptance, what evidence suppliers make available and what happens when notice or rollback is unavailable. Procurement terms and technical design belong in the same discussion. A portable dataset is only one part of moving a workflow to another provider; controls, evaluation and continuity must move with it.

Can an institution reconstruct and recover from consequential actions?

Decision records should explain the mandate, approval, execution and resulting business state. More logging does not automatically answer those questions, and retention creates privacy and access obligations. We want to examine the minimum useful evidence for investigation and recovery, including uncertain execution, duplicate effects and actions requiring a counterparty's cooperation to reverse. The release and operating pack provides records for an institution to test its own arrangement.

What should boards oversee, and what should they delegate?

Boards need to understand material exposure and choose the conditions under which management can expand AI use. They also need an intelligible view of cost, dependency and operating capacity. Our 2027 board agenda links ten questions to evidence and decisions. Further inquiry should test whether that reporting helps boards identify unresolved trade-offs while preserving management's ability to make routine operating decisions.

Put the questions to work

Start with one consequential workflow. Identify the action authority it receives, the owner who accepts its use, the evidence supporting that decision and the route to suspension and recovery. Use the linked resources to expose unanswered questions before increasing volume or powers. WCAI's contribution is to make those institutional decisions inspectable and practical, with the scope and limits of the evidence kept visible.