AI governance, sized for an SME.
Your team is probably already using AI. FPA helps you put proportionate guardrails in place: clear policies, sensible data handling and human review where it matters, aligned with Singapore's PDPA and AI Verify.
In short: good AI governance for an SME is short, practical and owned by named people. Know what AI you use, control what data goes into it, and make sure a person can explain and stand behind every consequential decision.
What proportionate AI governance looks like
- An AI inventory. A simple list of the AI tools in use, who uses them and for what, including the ones nobody officially approved.
- An AI use policy. What staff may and may not do, which tools are approved and what data must never go into them.
- Risk tiers. Low-risk uses such as drafting internal notes move fast. High-impact uses (hiring, credit, customer-facing advice) get review points and testing.
- Human oversight by design. For each AI workflow, it's clear who reviews what, and when.
- PDPA-aligned data handling. Consent, purpose limitation, retention and vendor checks for any AI processing personal data.
- Training. Short, practical sessions so people understand the rules and why they exist.
AI in hiring and people decisions
AI used to screen candidates, assess performance or inform pay carries the highest expectations. Employment decisions should stay fair and merit-based, and a person should be able to explain why a candidate was rejected. Being certified to run HR does not by itself show that your AI screening can be explained. We help HR teams design AI-assisted processes where the AI drafts and a person decides, with the evidence recorded.
Governance built into everything we build
Governance is a stage in FPA's method (Discover → Diagnose → Redesign → Build → Govern → Deploy & Measure), not an afterthought. Every automation and agent we deliver comes with documented scope, permissions, review points and logs.
Further reading: Responsible AI governance: a Singapore business guide.
FPA provides practical governance support, not legal advice.
Related
Common questions
Does a small business really need AI governance?
Yes, at the right size. If staff are using AI tools with customer, employee or commercial data, you already have AI risk. For an SME, governance means a short AI use policy, a list of the AI tools in use, clear rules on data, and named people who review consequential outputs. It doesn't need a committee.
What Singapore frameworks apply to AI governance?
The Personal Data Protection Act (PDPA) applies whenever personal data is used, including in AI tools. Singapore's Model AI Governance Framework and the AI Verify testing framework, both from IMDA, give voluntary guidance on transparency, fairness, human oversight and accountability. For AI used in hiring and people decisions, fair employment expectations also apply.
What is shadow AI?
Shadow AI is staff using AI tools the business hasn't approved or doesn't know about, often by pasting confidential information into public chatbots. It's common and usually well-intentioned. The fix is a clear policy, approved tools that meet the need, and simple training, not a blanket ban.
Is FPA providing legal advice?
No. FPA provides practical governance and implementation support. For legal interpretation of specific obligations, we recommend you consult a qualified lawyer, and we're happy to work alongside them.
Know where AI is already being used in your business?
Start with a conversation. We'll keep it practical.