IMDA's GenAI Navigator tells you which AI tools to use. It does not tell you how to govern them.

The governance gap in GenAI adoption

IMDA's GenAI Navigator is a genuinely useful tool. It takes a business's profile and recommends specific GenAI solutions that are likely to be relevant. For an SME that does not know where to start with AI, it removes a significant barrier.

What it does not do is explain the compliance obligations that come with deploying those solutions.

When you use a GenAI tool that processes customer data, you have obligations under the PDPA. When an AI system makes recommendations that affect customers or employees, you have accountability obligations under the IMDA Model AI Governance Framework. When the tool is provided by a vendor who uses your data to train their model, you have contractual and risk questions that your standard vendor onboarding process is not designed to catch.

Most SME owners and operators know something about these obligations in general terms. Almost none of them have a specific, documented governance baseline that covers the tools they are actually deploying.

What this engagement covers

The SME Governance Starter is a fixed-scope, two-week engagement designed for SMEs deploying GenAI tools. It covers:

GenAI tool inventory and data flow mapping. A half-day workshop to document which AI tools are in use, what data they process, where that data goes, and what the vendor's obligations are under their terms of service. This is the foundation for everything else.

Risk assessment against IMDA Framework and PDPA obligations. A structured review of each tool in scope against the IMDA Model AI Governance Framework principles and PDPA data handling requirements. Written findings with a traffic light rating for each tool.

One-page GenAI governance policy. A plain-language written policy for staff covering how GenAI tools should and should not be used, what data can and cannot be input, how outputs should be reviewed, and who is responsible for what. Designed to be understood by people without a legal or technical background.

Leadership briefing. A one-hour session with the founder and relevant leadership covering what was found, what the obligations are, and what the priority actions are. You leave knowing exactly what to do next.

Scope and pricing

This engagement is designed to be accessible for SMEs. It is fixed-scope and fixed-fee, discussed on the AI Governance Review. It covers up to five AI tools. Additional tools can be added at a flat rate per tool.

It is not a substitute for a full governance framework if your AI use is complex. But it is the right starting point for an SME that is deploying GenAI tools and wants a documented, defensible governance baseline before the tools go into regular use.