Liability and accountability

Read the PDF edition (4 pages)

The institution remains responsible

Who is liable when an artificial intelligence system makes a mistake? Singapore has so far answered this question without new legislation. The institution that deploys a model remains responsible for its outcomes in the same way as for any other process. The FEAT Principles of 2018 already stated that firms are accountable for internally developed and externally sourced models alike. The Guidelines of 2026 confirm this for third-party AI and place oversight with the board, which remains accountable even when it relies on experts inside or outside the firm.¹

The duties that an institution owes to its customers do not change when a model is used. A bank that rejects a loan application, an insurer that declines cover and a representative who recommends a product remain subject to the rules on fair dealing, disclosure and suitability under the statutes described in Part E. The FEAT Principles add an element of procedural fairness: data subjects should have channels to request a review of AI-driven decisions, in which verified supplementary data that they provide is taken into account.² The final Guidelines translate this into the expectation that high-risk uses, particularly those affecting customer outcomes, receive stronger human oversight and lower degrees of autonomy. MAS gives the example of human review of all decisions in credit decisioning or insurance underwriting. It also recognises decision-deferral mechanisms that escalate cases to a human when predefined thresholds are breached.³

Individual accountability of senior managers

Accountability also attaches to individuals. MAS issued its Guidelines on Individual Accountability and Conduct on 10 September 2020, with effect from 10 September 2021. They require institutions to identify the senior managers responsible for core functions and to hold them responsible for the actions of their employees and the conduct of the business under their purview. Material risk personnel must be fit and proper and subject to effective risk governance.⁴ A model that takes credit decisions or monitors transactions falls within the purview of an identifiable senior manager. When it fails, the question is whether that manager exercised appropriate oversight. The use of artificial intelligence offers no shelter from that question.

Contracts made by algorithms: Quoine v B2C2

Singapore’s courts have already confronted the question of how the law of contract applies when machines conclude transactions. Quoine Pte Ltd v B2C2 Ltd arose from trades on a cryptocurrency exchange on 19 April 2017, when an error in the exchange’s systems caused B2C2’s trading algorithm to buy Bitcoin with Ethereum at about 250 times the market rate. When Quoine reversed the trades, B2C2 sued. The Singapore International Commercial Court found for B2C2. On 24 February 2020 the Court of Appeal, sitting with two international judges, upheld by a majority the finding that Quoine was liable for breach of contract, while it reversed the finding of breach of trust.⁵

The majority held that the algorithms in question were deterministic: they would always produce the same output from the same input and did only what they had been programmed to do. Where contracts are concluded between such algorithms, the knowledge relevant to the doctrine of unilateral mistake is that of the programmers at the time of programming, together with any later knowledge if a programmer let the algorithm run in order to exploit a mistake. The question is whether the programmer, knowing that an offer would only be accepted by a party labouring under a mistake, programmed the algorithm to take advantage of it.⁶ Lord Mance dissented. He would have asked how any reasonable trader on the exchange, knowing what was happening, would have regarded the trades. On that test the trades were voidable in equity for unilateral mistake.⁷

The decision is a leading authority in the common law world on algorithmic contracting. Its limits are equally instructive. The majority reasoned from the deterministic character of the algorithms. Generative and agentic systems are probabilistic and may produce different outputs from the same input. Whether the programmer’s state of mind remains the right reference point for such systems is an open question, which the Court of Appeal did not have to decide. The role of the Singapore International Commercial Court in commercial disputes of this kind is examined in Part F.

Data protection and confidentiality

Liability may also arise under data protection law. The Personal Data Protection Act 2012 applies to the collection, use and disclosure of personal data in the design and deployment of AI systems, as the PDPC’s advisory guidelines confirm.⁸ Financial penalties for breaches can reach ten per cent of an organisation’s annual turnover in Singapore where that turnover exceeds S$10 million, and S$1 million in other cases.⁹ For banks, the statutory duty of banking secrecy imposes an additional constraint on what customer data may be sent to external model providers. The contractual and technical safeguards that MAS observed, such as private clouds, on-premise servers and data loss prevention tools, respond to this constraint.¹⁰

The courts and generative AI

The courts have set the standard for their own users. The Guide on the Use of Generative Artificial Intelligence Tools by Court Users, issued for the Supreme Court by Registrar’s Circular No. 1 of 2024 and adopted by the State Courts and the Family Justice Courts, does not prohibit the use of such tools. It provides, however, that court users are “fully responsible for the content in all your Court Documents” and must verify that references to case law, legislation, textbooks and articles exist and support the propositions for which they are cited. A declaration of the use of generative AI is required only when the court asks for one.¹¹

A sanction followed in 2025. In Tajudin bin Gulam Rasul v Suriaya bte Haja Mohideen, counsel cited a non-existent case that a generative AI tool had produced and admitted this only when questioned. The assistant registrar held that the duty to verify authorities is non-delegable, that blaming a junior lawyer carried no weight and that the court may order counsel personally to pay costs. Counsel was ordered to pay S$800 to the other side.¹² Although the case concerns a lawyer, the principle extends easily to finance. The professional who signs a document is responsible for its content, regardless of the tool used to draft it. Compliance officers, analysts and advisers who rely on generative AI stand in the same position as counsel before the court.

Notes

1. MAS, FEAT Principles (above), principle 8 – MAS, Response to Feedback, 7 October 2026, para 4.10(a): advice received from experts “is not a substitute for the board’s own oversight responsibilities. The board remains accountable”. ↩
2. MAS, FEAT Principles (above), principles 10 and 11. ↩
3. MAS, Response to Feedback, 7 October 2026, paras 10.48–10.50. ↩
4. MAS, Guidelines on Individual Accountability and Conduct, issue date 10 September 2020, effective date 10 September 2021, para 3, Outcomes 1–5. ↩
5. Quoine Pte Ltd v B2C2 Ltd [2020] SGCA(I) 2, Civil Appeal No 81 of 2019 (elitigation.sg, accessed November 2026): hearing on 14 October 2019, judgment on 24 February 2020; coram Sundaresh Menon CJ, Andrew Phang Boon Leong JA, Judith Prakash JA, Robert French IJ and Jonathan Mance IJ; majority judgment delivered by Menon CJ; appeal dismissed on breach of contract and allowed on breach of trust. ↩
6. Quoine v B2C2 [2020] SGCA(I) 2 at [15], [96]–[99] and [103]: a deterministic algorithm “will always produce precisely the same output given the same input”; knowledge to be assessed “by reference to the state of mind of the programmers of the algorithms at the time of the programming”. ↩
7. Quoine v B2C2 [2020] SGCA(I) 2 at [183], [194]–[195] and [200] (Mance IJ, dissenting). ↩
8. PDPC, Advisory Guidelines, 1 March 2024, Part II, section 2, and Part IV, section 8 (“PDPA Applies to Collection and Use of Personal Data in AI Systems”). ↩
9. Personal Data Protection Act 2012, s. 48J(3), as amended by the Personal Data Protection (Amendment) Act 2020, in force from 1 October 2022. ↩
10. MAS, Information Paper, December 2024, section 7.1 (overview): mitigation of data security risks “via measures such as the use of private clouds or on-premise servers, data loss prevention tools, and limiting the access of Generative AI to more sensitive information”. ↩
11. Tajudin bin Gulam Rasul and another v Suriaya bte Haja Mohideen [2025] SGHCR 33 at [37]–[39], quoting paras 3(1), 3(3), 5(1) and 5(3)(c) of the Guide; Supreme Court Registrar’s Circular No. 1 of 2024, State Courts Registrar’s Circular No. 9 of 2024 and Family Justice Courts Registrar’s Circular No. 1 of 2024. ↩
12. Tajudin bin Gulam Rasul and another v Suriaya bte Haja Mohideen [2025] SGHCR 33 (AR Tan Yu Qing, grounds of decision of 29 September 2025) at [11], [34], [40], [44], [52], [93] and [99]–[101]. ↩

For general information only. This article does not constitute legal or tax advice, does not replace advice on an individual case and creates no lawyer-client relationship. It reflects the legal position as of October 2026.