InfoHandle Editorial — When a minister says Singapore may need independently verifiable proof that AI safety controls work before high-risk systems deploy, the obvious follow-up is which customer-facing rails will be classified high-risk first. CPF withdrawals, mortgage renewals and wire transfers should top that list.
The gap in the current pitch
Technology vendors are marketing “agents” that can complete multi-step tasks from a single prompt. Banks and government portals experimenting with those tools often highlight faster service, not immutable logs showing who authorised each step. Mrs Josephine Teo’s written parliamentary reply this week acknowledged that gap for essential services and floated tougher testing, deployment controls and oversight.
That language is welcome, but consumers already see beta chatbots on tax and transit sites. Without a published boundary — no autonomous payments, no credential storage, no training on live NRIC fields — pilots blur into production.
Why CPF and banks are the test case
CPF Board and the three local banks touch almost every household. A mistaken agent action there is not a wrong movie recommendation; it is a missed retirement sum or a fraudulent transfer. MAS technology risk management rules expect institutions to govern models, yet agent frameworks add non-deterministic behaviour that legacy checklists did not contemplate.
Singapore’s scam epidemic should also caution against anything that encourages users to delegate authentication. If an agent can click through OTP prompts on a user’s behalf, scammers will script the same path.
What policy should require
First, human confirmation for any movement of money or change of beneficiary. Second, tamper-evident audit logs shared with regulators on request, not buried in vendor clouds overseas. Third, independent red-team tests whose results are filed before scale-up, matching Mrs Teo’s emphasis on verifiable evidence.
Fourth, clear consumer liability rules when an agent errs — the institution, not the retiree, should bear the loss if the tool was bank-branded.
What we do not need
We do not need a moratorium on AI in the public sector; Singapore’s digitisation gains are real. We also do not need vague ethics charters without enforcement teeth. The middle path is sectoral standards published now, before agents are marketed to seniors as “set and forget”.
Parliament has been tough on scam mules this week; it should be equally concrete on software mules that move money without a living person accountable at the other end. Mrs Teo opened the door. The next step is naming the systems that must walk through it before October’s pilots become January’s defaults.