AI Verify Testing Framework and Toolkit

· About AI Verify Testing Framework and Toolkit

Key Takeaways

  • AI Verify is a voluntary governance testing framework and toolkit, not a Singapore statute or regulation, for organisations that want to assess AI systems against internationally recognised AI principles.[1][2]
  • It applies to both traditional AI and, after the 2025 update, generative AI use cases, with new checks for risks such as leakage of personal or sensitive data, hallucinations, and toxicity.[2][3][4]
  • The framework was first released in 2022 and was enhanced in May 2025, with the updated version publicly described by IMDA and the AI Verify Foundation as covering additional GenAI risks.[3][4][5]
  • The toolkit is open-source and intended for self-assessment or third-party testing, and it generates reports to document alignment with the framework’s process checks and technical tests.[1][2][6]
  • There are no statutory fines under AI Verify itself, because compliance is voluntary; enforcement comes only if an organisation’s AI use separately breaches other applicable laws such as Singapore’s PDPA or sector-specific rules.[1][2][7]
  • Singapore and NIST published a crosswalk to reduce duplicated compliance work, making the framework easier to map for organisations operating in both Singapore and the United States.[3][4]

What It Is

AI Verify is Singapore’s AI governance testing framework and software toolkit developed by the Infocomm Media Development Authority (IMDA) and the Personal Data Protection Commission (PDPC) to help organisations test whether an AI system behaves as claimed and is implemented responsibly.[1][2] The framework is designed around internationally recognised AI governance principles and combines process checks with technical tests for performance-related concerns such as fairness, robustness, and explainability.[1][2][6]

AI Verify was launched in 2022 as an international pilot and minimum viable product for traditional AI systems.[1][7] In May 2025, IMDA announced an enhanced framework to address generative AI risks and a crosswalk with the US NIST framework.[3][4][5] Public government materials in 2026 continue to describe AI Verify as a testing framework and toolkit, with the updated version available for both traditional and GenAI use cases.[2][7]

The framework is not a law with an independent enforcement authority or mandatory phase-in schedule.[1][2] That means there are no “in force” statutory commencement dates in the way there would be for an Act or regulation; the relevant dates are the launch in 2022 and the enhancement in 2025.[3][5]

Who Must Comply

AI Verify does not impose a legal compulsion threshold, because it is a voluntary framework intended for any organisation that wants to validate responsible AI practices.[1][2] The AI Verify Foundation states that anyone can use the Testing Framework and Toolkit, including AI system owners and companies interested in integrating the toolkit or building on top of it.[2]

There is no published territorial limitation in the framework itself; it is positioned for international use and is aligned with widely used AI governance concepts.[1][2] The 2025 Singapore-NIST crosswalk underscores that it is meant to be usable by organisations operating across jurisdictions.[3][4]

There are no exemptions in the regulatory sense, because there is no mandatory compliance regime to exempt from.[1][2] Practical limits still matter: the toolkit is most useful where an organisation has an AI system that can be meaningfully evaluated through process checks or technical testing, and the published materials emphasise supervised-learning testing origins and later GenAI extensions.[2][6][7]

Core Requirements

  1. Establish governance process checks. Organisations should document policies, controls, accountability, and review processes against the framework’s governance principles, using the toolkit’s process-check workflow to generate a summary report.[1][2][6]
  1. Test fairness. The framework includes technical tests intended to detect unfair outcomes or unintended discrimination, particularly in models where output differences across groups are relevant.[1][2][7]
  1. Test robustness and reliability. Organisations should assess whether the AI system remains stable under perturbations or unexpected inputs and whether claimed performance holds under realistic conditions.[1][6][7]
  1. Test explainability. The toolkit supports assessment of whether system behaviour can be sufficiently explained to internal stakeholders, reviewers, and business partners.[1][6]
  1. Address GenAI-specific risks where relevant. The enhanced framework extends the original structure to risks including leakage of personal or sensitive data, hallucinations, and toxicity in generative AI systems.[3][4][5]
  1. Generate and retain a testing report. The toolkit is designed to produce a report that summarises how the system aligns with the framework, which can be used for internal assurance or external communication.[1][2][6]
  1. Use an auditable, repeatable evaluation method. The framework is built for self-assessment and third-party testing, so organisations should preserve inputs, versions, assumptions, and outputs to support repeatability and review.[2][6]

Deadlines and Penalties

| Milestone | Date | What applies | |---|---:|---| | Initial launch of AI Verify for traditional AI | 2022 | International pilot and minimum viable product for testing AI governance claims.[1][7] | | Enhanced framework for GenAI and NIST crosswalk announced | May 2025 | Broader coverage for GenAI risks and alignment mapping with NIST.[3][4][5] | | Current public government descriptions | 2026 | AI Verify remains a voluntary testing framework and toolkit, with no mandatory compliance deadline.[2][7] |

There are no maximum fines or statutory sanctions under AI Verify itself because it is not a law or regulation.[1][2] Any penalties would arise only from separate legal obligations, such as privacy, consumer protection, employment, or sectoral regulation, if an AI deployment independently violates those rules.[1][7]

How to Comply

  1. Inventory AI use cases and classify risk. Identify each AI system, its purpose, data sources, users, and whether it is traditional ML or GenAI, then map it to a risk tier and control owner.
  1. Adopt a governance baseline. Use ISO 27001 for security controls, NIST CSF 2.0 for enterprise risk functions, and ISO/IEC 42001 for an AI management system where those standards already exist in the organisation.
  1. Run the AI Verify process checks. Document accountability, human oversight, data governance, and deployment controls using the framework’s checklist approach and retain evidence for auditability.[1][2][6]
  1. Perform technical tests on fairness, robustness, and explainability. Use the toolkit to benchmark the model against its claimed performance, then remediate observed bias, instability, or poor interpretability.[1][6][7]
  1. Add GenAI safeguards where relevant. Test for leakage of personal or sensitive information, harmful output, hallucinations, and toxicity, and layer policy controls around prompting, retrieval, and output review.[3][4][5]
  1. Document residual risk and sign-off. Record exceptions, compensating controls, model limitations, and business acceptance decisions so the report reflects actual governance, not just test results.
  1. Re-test after material changes. Re-run testing after model updates, new datasets, prompt changes, vendor changes, or deployment shifts, because AI Verify is designed for repeatable assessment rather than one-time certification.[2][6]

Related Regulations

  • Singapore PDPA: If AI processing involves personal data, privacy duties under the PDPA still apply independently of AI Verify, especially around collection, use, disclosure, and protection obligations.[1][7]
  • Singapore Model AI Governance Framework: This is the broader policy framework that AI Verify operationalises through testing; the two are complementary rather than conflicting.[7]
  • EU AI Act: For organisations serving EU markets, the AI Act can impose mandatory risk-management, technical documentation, and oversight duties that go beyond AI Verify’s voluntary checks.
  • NIST AI RMF 1.0 / GenAI Profile: The 2025 crosswalk suggests substantial overlap in risk management language, but NIST remains a US framework and not a Singapore requirement.[3][4]
  • ISO/IEC 42001: This management-system standard overlaps with governance and documentation expectations, but it is broader and more formalised than AI Verify’s testing-oriented toolkit.

FAQ

Does AI Verify apply to companies outside Singapore?

Yes. The framework is presented as an international testing toolkit and the Foundation states that anyone can use it.[1][2] There is no citizenship, incorporation, or establishment test in the framework itself because it is voluntary rather than a statute.[1][2]

Is AI Verify mandatory for all AI systems?

No. Singapore public materials describe it as a testing framework and toolkit that organisations may use to validate responsible AI implementation.[1][2] It is not a law, so there is no universal legal obligation to adopt it.

Does AI Verify cover generative AI?

Yes, after the 2025 enhancement the framework was updated to address GenAI risks.[3][4][5] Public materials describe the update as adding attention to issues such as sensitive-data leakage, hallucinations, and toxicity.[3][4][5]

What penalties apply if a company does not use AI Verify?

None under AI Verify itself, because the framework does not create legal penalties.[1][2] However, if an AI system causes a breach of privacy, consumer, employment, or sector-specific law, those separate regimes can carry fines or other sanctions.[1][7]

Does AI Verify certify an AI system?

No. It is a testing and documentation framework that helps organisations assess claims and produce a summary report, but it is not a government certification scheme.[1][2][6] The report supports internal assurance and external communication, not formal legal approval.[2][6]

How does AI Verify relate to NIST?

Singapore announced a crosswalk with the comparable NIST framework in 2025 to reduce duplicated compliance work for organisations operating in both jurisdictions.[3][4] That mapping helps harmonise controls, but it does not replace either framework’s own governance expectations.[3][4]

Sources

Put it into practice

More compliance guides