ESCP Business School · ESA Business School · Executive MBA · Singapore
Governing AI at Scale.
Regulatory design, commercial deployment, and the Singapore-ASEAN model.
Terence KokExecutive Director, AI Governance & Assurance Practice, Orion Five Engineering
A 60-minute lecture · November 2026
About your speaker
Terence Kok
Executive Director, AI Governance & Assurance Practice, Orion Five Engineering · Former Chief AI and Innovation Officer, Meinhardt Group
Twenty-five years leading digital and AI transformation across Asia and the Middle East. Today I help leadership teams put AI into production with controls they can show a board, an auditor and a regulator.
AWS · RiyadhData centre site selection
Google · ThailandData centre project
19 smart citiesNEOM, Oman, Manila, Delhi
BuiltA governed AI platform serving more than 6,000 engineers, with zero security incidents
AwardsCDO Vision Award 2026 · Singapore's Most Influential Data & AI Leaders 2026 · Google Trailblazer 2024
Images: Riyadh skyline, B.alotaby, CC BY-SA 4.0; Google data centre, Council Bluffs, Iowa, Chad Davis, CC BY 2.0 (no free photo of the Thailand site exists); project images from terencekok.com/projects.
Who is in the room
About seventy executives, three doors to AI rules.
A regulator in Europe. A customer in ASEAN. A government in the Gulf.
Governing AI at Scale
Today, in sixty minutes
One question: how do you scale AI without losing control?
8'
Framing
Governance as the binding constraint.
15'
Singapore reference model
IMDA, MAS Veritas, the EU in brief.
10'
The ASEAN extension
One guide, ten systems.
12'
Deployment implications
Design, oversight, audit, cost.
13'
Close
Ten takeaways and questions.
You leave able to explain, place, evidence and brief.
Governing AI at Scale
→To see where AI is going, start where it came from
AI’s journey · 01 of 04
Machine learning
predicts.
1950Alan Turing asks “Can machines think?”
1956A Dartmouth workshop names the field artificial intelligence
1997IBM’s Deep Blue beats world chess champion Garry Kasparov
Machine learningpredicts
Neural networkssees and hears
Generative AIwrites and answers
Agentic AIacts
Turing, Mind (October 1950); IEEE Milestone, Dartmouth Summer Research Project (1956); IBM, Deep Blue (11 May 1997). Image: illustration, AI-generated.Video: Envato Elements.
→Prediction works on numbers. Pictures were out of reach.
AI’s journey · 02 of 04
Neural networks
sees and hears.
2012AlexNet cuts the image recognition error to 15.3%, against 26.2% for the next best
2016AlphaGo beats Go champion Lee Sedol 4 to 1 in Seoul
Machine learningpredicts
Neural networkssees and hears
Generative AIwrites and answers
Agentic AIacts
Krizhevsky, Sutskever and Hinton, NeurIPS (2012); DeepMind, AlphaGo, Seoul (9 to 15 March 2016). Image: illustration, AI-generated.Video: Envato Elements.
→Seeing and hearing is understanding. Next came creating.
AI’s journey · 03 of 04
Generative AI
writes and answers.
2017Google researchers publish the Transformer, the design behind every chatbot
2022ChatGPT launches on 30 November
2026900 million people use ChatGPT every week
A question in plain words · a written answer
Summarise this 40-page specification for my site meeting.
Vaswani et al., “Attention Is All You Need”, arXiv (12 June 2017); OpenAI (30 Nov 2022); OpenAI via TechCrunch (27 Feb 2026). Image: illustration, AI-generated.Video: Envato Elements.
→But an answer still leaves the work to you
AI’s journey · 04 of 04
Agentic AI
acts.
2024AI operates a computer like a person: it reads the screen, clicks and types
2024An open standard connects AI agents to business systems
2026Enterprise platforms sell agents as digital co-workers
A goal in · steps done · a person approves
1Reads the customer’s email
2Checks stock and lead time
3Drafts the quote
✓A person approves the price
5Sends it and updates the system
Machine learningpredicts
Neural networkssees and hears
Generative AIwrites and answers
Agentic AIacts
Anthropic, computer use (22 Oct 2024) and Model Context Protocol (25 Nov 2024); OpenAI Frontier (5 Feb 2026). Image: illustration, AI-generated.Video: Envato Elements.
→Seventy years to get here. The last four moved fastest.
What is accelerating adoption
AI is spreading faster than the PC or the internet.
Time to reach 100 million users
ChatGPT2 months
TikTok9 months
Instagram2.5 years
Analyst estimate
Cost of a GPT-3.5-level answer
$20Nov 2022
$0.07Oct 2024
Per million tokens: 280 times cheaper
Organisations using AI
55%2023
78%2024
88%2025
People using generative AI
53%
within three years: faster than the PC or the internet
Cheaper, easier and already in your customers' pockets. That is why the pace has changed.
UBS using Similarweb and Sensor Tower data, via Reuters (1 Feb 2023; analyst estimate); Stanford AI Index 2025 (inference cost, Nov 2022 to Oct 2024; organisations 2024) and 2026 (organisations 2023 and 2025; population adoption).
Governing AI at Scale
The inflection point
This is the inflection point of AI.
The paths split from here. Which one we take depends on what we build around AI now.
Illustrative scenarios drawn for this lecture. Not data and not a forecast.
Governing AI at Scale
1
8 minutes
Framing.
Governance is the binding constraint on deploying AI at scale.
Four stories
The cost of AI nobody governed.
Feb 2024 · Canada
The chatbot that invented a refund rule
Airline held liable
Feb 2024 · Hong Kong
The video call where everyone was fake
About US$25 million
2015-2022 · Netherlands
The algorithm that flagged families
2,090 children placed out of home
2015-2019 · Australia
Robodebt
A$1.75 billion written off
Systems acted at scale. Nobody owned the outcome.
Sources: CBC News, 15 Feb 2024; CNN, 16 May 2024; Statistics Netherlands via the Youth Institute, 2022; Royal Commission into the Robodebt Scheme, 2023.
On the record · two public findings
Two governments, two algorithms, two inquiries.
amnesty.org · Dutch childcare benefit scandal
Netherlands: risk scoring used nationality. The cabinet resigned in 2021.
lsj.com.au · Royal commission into robodebt
Australia: automated debts, a Royal Commission, A$1.75bn written off.
Amnesty International, 25 Oct 2021; Law Society Journal, Aug 2023. Screenshots taken 3 Nov 2026 for teaching use.
And now the models act
AI agents have already gone rogue, in public.
Jul 2025 · Replit
Deleted a live database during a code freeze, then said it could not be restored.
Dec 2025 · Google Antigravity
Asked to clear a cache, it wiped a user's entire D: drive.
Feb 2026 · Amazon Kiro
Reportedly deleted and recreated an environment: 13 hours down. Amazon blames user error.
Feb 2026 · OpenClaw
Told to confirm first, it bulk-deleted a Meta alignment director's inbox.
Jul 2026 · OpenAI
Agents under test escaped their sandbox and hacked Hugging Face for the answers.
Sep 2026 · Australia
An agent opened non-public Medicare files. Government told 84 days later.
Fortune, 23 Jul 2025 and 21 Jul 2026; The Register, 1 Dec 2025 and 20 Feb 2026; Windows Central, 24 Feb 2026; SBS News, 24 Sep 2026.
Governing AI at Scale
The scale gap
Adoption is racing ahead of control.
88%
use AI in at least one function
1 in 3
has begun to scale it
63%
of breached firms had no AI governance policy
40%+
of agentic projects cancelled by 2027 (Gartner)
Governance is not the brake. It is the constraint that decides what scales.
McKinsey, State of AI 2025 (1,993 respondents); IBM Cost of a Data Breach 2025 (600 organisations, Ponemon). Gartner, 25 Jun 2025.
On the record · the evidence behind the numbers
Read the source, not the headline.
ibm.com · 2025 Cost of a Data Breach Report
IBM: shadow AI added US$670,000 to a breach.
hai.stanford.edu · AI Index 2026
Stanford AI Index 2026: adoption up, safeguards lagging.
IBM X-Force, 2025; Stanford HAI, Apr 2026. Screenshots taken 3 Nov 2026.
2
15 minutes
The Singapore reference model.
A design the region watches: guidance, testing and sector rules, set beside the EU AI Act.
MAS for finance; AI risk guidelines issued 7 Oct 2026.
4
Law on specific harms
Personal data, cyber, scams, election deepfakes.
5
Standards and certification
ISO/IEC 42001, independently verified.
IMDA and AI Verify Foundation; MAS, 7 Oct 2026; Protection from Scams Act 2025. Case study with 55 sources: terencekok.com/research/case-studies/singapore-ai-governance-framework/.
On the record · Singapore
The framework, and the regulator behind it.
imda.gov.sg · Model AI Governance Framework for Agentic AI
IMDA, Jan 2026: the agentic AI framework, launched at Davos.
pdpc.gov.sg/ai · Singapore’s approach to AI governance
PDPC: the regulator’s own map of AI governance tools.
IMDA press release, 22 Jan 2026; PDPC. Screenshots taken 3 Nov 2026.
Singapore
Eight years of steady layering, not one big bang.
Nov 2018
FEAT principles
Jan 2019
First Model Framework
Jan 2021
Tech risk guidelines
May 2024
Generative AI framework
Dec 2024
Shared responsibility
Jan 2026
Agentic AI framework
Oct 2026
MAS AI risk guidelines
Updated in months, not years. The price: the market must verify claims.
MAS, IMDA, MDDI, CSA releases as cited in the case study; MAS Guidelines on AI Risk Management, 7 Oct 2026.
Singapore · agentic AI framework, January 2026
When AI acts, four things must be true.
01
Bound the risk up front
Limit autonomy, tools and data.
02
Keep humans accountable
Named owners, approval checkpoints.
03
Control the lifecycle
Test, monitor, be able to stop it.
04
Tell the end user
People know it is an agent.
CSA, June 2026: an agent registry, verifiable credentials, human checks before high-impact actions.
MAS, July 2026: identity and authority, a check before each action, an audit record.
MDDI, 22 Jan 2026; IMDA Model AI Governance Framework for Agentic AI v1.5, May 2026; CSA, 17 Jun 2026; MAS, 3 Jul 2026.
Singapore · testing, not just principles
AI Verify: prove it, do not just promise it.
aiverifyfoundation.sg
AI Verify Foundation: open-source testing, global members.
A toolkitRun tests on your own model and data.
A foundationIndustry and global members keep it current.
A marketCustomers ask for the test report.
From "do you have an AI policy?" to "show me the test report".
AI Verify Foundation and IMDA (aiverifyfoundation.sg). Check current toolkit scope before citing in a contract.
Singapore · financial sector
MAS Veritas: test AI against the FEAT principles.
2018
FEAT principles
Fairness, ethics, accountability, transparency.
2019
Veritas launched
MAS and an industry consortium.
2021
Fairness methodology
Credit scoring and customer marketing.
Jun 2023
Veritas Toolkit 2.0
Open source.
Ongoing
MindForge
Generative AI risk in finance.
A principle becomes a test a bank can run and an auditor can read.
MAS, Veritas initiative page and media releases, 2019 and 2021; MAS Annual Report 2023/24; Rajah & Tann Asia on Project MindForge. Check the Veritas Toolkit repository for the current version.
Brief comparison · four bets
Four ways to write the rules.
European Union
Rights first, one law
The betClear rules build trust, and market size forces the world to comply.
United States
Market first, many hands
The betInnovation leads. Liability and enforcement correct it afterwards.
China
State first, by technology
The betControl the information environment and strategic technology together.
Singapore
Trust first, test and sector
The betPractical assurance beats a long statute in a small open economy.
Author's synthesis from the EU AI Act, US federal and state position, China's AI measures and IMDA frameworks.
Brief comparison · European Union
The AI Act: obligations rise with the risk.
UnacceptableBanned: social scoring, face scraping
High riskHiring, credit, education: oversight and logging
Transparency riskChatbots and synthetic content disclosed
Minimal riskMost AI: no new duties
Penalties
Up to EUR 35m or 7% of turnover for banned practices. EUR 15m or 3% for most others.
Reach
Applies to anyone whose AI output is used in the EU.
Regulation (EU) 2024/1689, Articles 5, 6, 50 and 99. The ceiling is the higher of the fixed sum or the turnover share.
Brief comparison · European Union
The clock is moving. In 2026 it was reset.
1 Aug 2024
In force
2 Feb 2025
Bans and AI literacy
2 Aug 2025
General-purpose models
27 Jul 2026
Digital Omnibus in force
2 Dec 2027
Standalone high-risk
was Aug 2026
2 Aug 2028
Product-embedded
was Aug 2027
The dates moved. The obligations did not.
Addleshaw Goddard, 1 Jul 2026; Freshfields, Jul 2026; Official Journal of the EU, 24 Jul 2026.
Brief comparison · side by side
Five regimes you may meet.
EU
Singapore
United States
China
Gulf
Instrument
One binding law
Voluntary plus sector rules
Agencies, courts, states
Targeted measures
Strategies, data laws
Accountable
Provider, deployer
The firm; named managers
Developer, deployer
Provider, state filing
Deployer
Enforcement
Fines to 7%
Supervisory
Litigation, FTC
Administrative
Licences
Proof
Conformity file
Test report, ISO 42001
Varies by sector
Model filing
Licence conditions
Gulf is a broad summary: rules differ by country and move fast. Verify each text.
Governing AI at Scale
3
10 minutes
The ASEAN extension.
One regional guide, ten legal systems, and the problem of a shared baseline.
ASEAN at a glance
A US$300 billion digital economy, governed by consensus.
10
member states
US$300bn+
digital economy, 2025 (e-Conomy SEA)
Feb 2024
ASEAN Guide on AI Governance and Ethics
Jan 2025
Expanded guide for generative AI
Consensus sets a common vocabulary. Each country writes its own law.
ASEAN Guide on AI Governance and Ethics (Feb 2024); Expanded Guide on Generative AI (Jan 2025); Google, Temasek and Bain, e-Conomy SEA 2025.
On the record · ASEAN
The regional guides, and who writes them.
drewnetworkasia.com · ASEAN Guide on AI Governance and Ethics
The expanded ASEAN Guide covers generative AI (Jan 2025).
imda.gov.sg · ASEAN Working Group on AI Governance
Singapore’s IMDA leads the ASEAN working group on AI governance.
DNA Law; IMDA. Screenshots taken 3 Nov 2026.
Ten systems
Same principles, different speeds.
Singapore
Frameworks and sector rules
Vietnam
AI law in force 1 Mar 2026
Malaysia
Draft AI Governance Bill
Indonesia
Regulations drafted
Thailand
Draft AI Act
Philippines
Bills in Congress
Brunei, Cambodia, Laos, Myanmar, Timor-Leste
Early stage
Statuses checked 3 Nov 2026. This area moves monthly: a starting point for counsel.
Baker McKenzie, Feb 2026; Rahmat Lim, 2026; national sources on the final slide.
On the record · three countries
One law in force. Two drafts out for consultation.
en.baochinhphu.vn · First-ever Law on AI approved
Vietnam: law passed Dec 2025, in force 1 Mar 2026.
bakermckenzie.com · Malaysia AI Governance Bill
Malaysia: consultation on a draft bill, Jul 2026.
tilleke.com · Thailand draft AI Act
Thailand: draft Act for public hearing, Jul 2026.
Government News Vietnam, Dec 2025; Baker McKenzie, Jul 2026; Tilleke & Gibbins, Jul 2026. Screenshots taken 3 Nov 2026.
The regional lever
DEFA: a digital economy agreement for the whole region.
2025
Talks accelerate
27-29 May 2026
Negotiations concluded
Nov 2026
Signing targeted
49th ASEAN Summit
Within 180 days
Ratification
Indonesia's target
Covers
Trade and data
Covers
Trust and security
Covers
Emerging tech, incl. AI
Rajah & Tann Asia, 2026; Allen & Gledhill, 2026; Bernama, 2026. Signing was targeted, not confirmed, at the time of writing.
The ASEAN extension
The hard part: one regional baseline.
Why it is hard
Consensus, no interferenceThe bloc decides together and leaves domestic law alone.
Ten systems, many speedsOne law in force, several drafts, others at an early stage.
Uneven capacityTesting and supervision skills differ by country.
What a shared baseline needs
One vocabularyThe guide's seven principles, defined the same way.
Tests that travelA report accepted in more than one country.
One incident formatThe same facts, reported once.
Until then: build to the highest common standard, add a layer per country.
ASEAN Guide on AI Governance and Ethics (Feb 2024). Right column: the author's reading.
In practice
One hub, many local layers.
The hub holds the inventory, tiers, tests and sign-offs. Each layer adds only what that jurisdiction or customer requires.
Governing AI at Scale
4
12 minutes
Deployment implications.
Governance as a design constraint, with oversight, audit, cost and timeline.
Deployment implications · design
Governance is a design constraint: six gates before go-live.
GATE 1
Register
One inventory, a named owner.
Evidence: the register
GATE 2
Tier
Impact, autonomy, reliance.
Evidence: tier record
GATE 3
Assess
People, data, security, law.
Evidence: assessment
GATE 4
Test
Accuracy, bias, misuse.
Evidence: test report
GATE 5
Approve
A named person signs.
Evidence: sign-off
GATE 6
Monitor
Drift, incidents, kill switch.
Evidence: logs, KRIs
One flow serves the EU, Singapore and ISO 42001. Build it once.
Governing AI at Scale
Case 1 · Liability does not stop at the chatbot
Air Canada's chatbot made a promise. The airline had to keep it.
Customer, Nov 2022My grandmother has died. Can I get the bereavement fare?
ChatbotBook now, then request the bereavement rate within 90 days of your ticket.
Airline's actual policyNo retroactive bereavement claims.
Tribunal, Feb 2024: the airline is responsible for its chatbot.
"A separate legal entity" was rejected.
Control: ground answers in approved policy and test the failures that cost money.
CBC News, 15 Feb 2024; Moffatt v. Air Canada, 2024 BCCRT 149. Dialogue paraphrased from the tribunal's findings.
Case 3 · Governing to go faster
DBS: governance that let a bank scale AI, and a regulator that watched.
~S$1bn
value from AI in 2025
4
PURE tests on every use case
2022
MAS capital add-on after outages
Nov 2023
MAS paused non-essential activities
Both halves are the lesson: innovation and accountability, one conversation.
DBS Annual Report 2025 ("approximately SGD 1 billion", unaudited); MAS releases, 7 Feb 2022 and 1 Nov 2023. Full case: terencekok.com/research/case-studies/dbs-bank/.
Deployment implications · oversight
The more it can do alone, the more you must prove.
L1
Answers
A person acts.
Disclosure, grounding
L2
Suggests
A person decides.
Reviewer sampling
L3
Acts, reversible
Can be undone.
Logging, rollback
L4
Money or data
Pays, grants access.
Approval gates, limits
L5
Irreversible
Deletes, deploys, signs.
Two-person rule, kill switch
Tiers adapted from the Agentic Operational Risk Standard, terencekok.com/research/agentic-operational-risk/, and the IMDA Agentic AI framework v1.5.
Deployment implications · oversight in practice
Most firms have a policy. Fewer enforce it.
58%
have an AI policy that is consistently enforced
32%
have one that is enforced inconsistently
19%
report no consequences from ungoverned AI
49%
say better observability would let them run agents on critical processes
Agentic AI trails AI overall: 54% scaling or mature, against 78%. No single function owns it.
Redwood Software with Leger, Enterprise benchmarks in AI and agentic orchestration 2026: 300 senior technology, risk and AI leaders in the US, Canada and the UK. A vendor-sponsored survey; treat as indicative.
Deployment implications · audit
Oversight and audit: one standard, shown to many regulators.
Control you run
ISO/IEC 42001
EU AI Act
Singapore
Inventory and owner
Asset, role controls
Provider, deployer duties
MAS inventory
Risk assessment
Risk, impact clauses
Risk management
MAS materiality; PDPC
Testing
Verification, validation
Accuracy, robustness
AI Verify
Human oversight
Oversight controls
Article 14
Agentic approval points
Logs and incidents
Event logs
Serious-incident reporting
MAS, CSA reporting
Author's control-area mapping for discussion. Confirm against your own Statement of Applicability.
Governing AI at Scale
Deployment implications · cost and timeline
What governance costs, and when it falls due.
1 Mar 2026
Vietnam AI Law in force
Oct 2027
MAS AI risk guidelines apply
phased to Oct 2028
2 Dec 2027
EU standalone high-risk
2 Aug 2028
EU product-embedded
Design it in
Inventory, tiers, test evidence, named owners. Built once, reused.
Retrofit it later
Re-test, re-document and re-approve systems already live.
Skip it
Shadow AI added US$670,000 to a breach. 40%+ of agentic projects face cancellation.
Design-in is cheaper than retrofit (my judgement, not a measured figure).
MAS, 7 Oct 2026; Official Journal of the EU, 24 Jul 2026; Baker McKenzie, Feb 2026; IBM Cost of a Data Breach 2025; Gartner, 25 Jun 2025.
To remember
Ten takeaways.
1Governance is what lets a pilot become a product.
2Regulators make different bets; the risks are the same.
3The EU Act binds you from outside the EU. Dates moved, duties did not.
4Singapore layers guidance, testing, sector rules and targeted law.
5ASEAN shares principles, not one law. Plan per country.
6Assurance is becoming a market: be ready to show a test report.
7A control is something done on Tuesday and provable on Friday.
8You own what your AI says and does, including through a vendor.
9The more autonomy, the more proof: approvals, limits, a kill switch.
10Start with the inventory. Everything else depends on it.
Governing AI at Scale
Take it further
A 30-day follow-up your course can assess.
1
Inventory
Five AI systems, including vendor tools. An owner for each.
2
Tier and gap
Rate L1 to L5. Mark which gates exist.
3
One page for the board
First control, regime, vendor question.
Pre-read: the Singapore case study and Four-Question Baseline. Faculty may adapt this as an assignment.
Governing AI at Scale
Go deeper · every link opened and checked 3 Nov 2026
Take the tools home. They are free and built from the same sources as this lecture.
The case study
Singapore's model with 55 sources.
Four Questions
Baseline for any deployment.
ISO 42001
Readiness checklist.
Agent Risk Matrix
Tier and controls per agent.
terencekok.com
Sources
What this lecture rests on.
Regulation (EU) 2024/1689 (AI Act); European Commission, AI regulatory framework page, accessed 3 Nov 2026; Digital Omnibus on AI, in force 27 Jul 2026.
Addleshaw Goddard, 1 Jul 2026; Freshfields, Jul 2026; Software Improvement Group, EU AI Act summary, Aug 2026.
MAS, Guidelines on AI Risk Management, 7 Oct 2026; MAS SAFR, 3 Jul 2026.
MDDI, 22 Jan 2026; IMDA, Model AI Governance Framework for Agentic AI v1.5, May 2026; CSA, 17 Jun 2026.
AI Verify Foundation and IMDA (aiverifyfoundation.sg); Singapore Accreditation Council, 17 Feb 2025.
ASEAN Guide on AI Governance and Ethics, 2 Feb 2024; Expanded Guide (Generative AI), Jan 2025; ASEAN AI Safety Network, Hanoi Digital Declaration, Jan 2026.
ASEAN DEFA: Rajah & Tann Asia, Allen & Gledhill, Bernama, 2026 (concluded May 2026; signing targeted Nov 2026).
Vietnam Law on AI No. 134/2025/QH15: Government Portal, Dec 2025; Baker McKenzie, Feb 2026.
Malaysia AI Governance Bill consultation, Baker McKenzie, Jul 2026; Thailand draft AI Act, Tilleke & Gibbins, Jul 2026; Indonesia and Philippines: Kontan, 4 Sep 2026; Philstar, 14 Jul 2026.
Google, Temasek, Bain, e-Conomy SEA 2025 (11 Nov 2025).
McKinsey, State of AI 2025; IBM, Cost of a Data Breach 2025; Stanford HAI, AI Index 2026; Gartner, 25 Jun 2025.
Moffatt v. Air Canada, 2024 BCCRT 149; CBC, 15 Feb 2024. CNN, 16 May 2024; SCMP, May 2024 (Arup).
Amnesty International, Xenophobic Machines, Oct 2021; Statistics Netherlands via Youth Institute (2,090 children).
Royal Commission into the Robodebt Scheme, 2023; DBS Annual Report 2025; MAS releases 7 Feb 2022 and 1 Nov 2023.
