AI Compliance in Asia: Singapore, Japan, Korea, India, and China

Singapore — The model for practical AI governance

Singapore has positioned itself as the global leader in practical, business-friendly AI governance. Rather than rushing to pass restrictive legislation, Singapore has built a framework of guidance, tools, and voluntary frameworks that companies can actually use.

IMDA Model AI Governance Framework

The Infocomm Media Development Authority (IMDA) published the Model AI Governance Framework — now in its second edition — which provides detailed guidance on responsible AI deployment. The framework is not legally binding but is widely adopted as best practice and informs regulatory expectations in Singapore.

The framework covers: human oversight of AI, transparency and explainability, testing and monitoring, data governance, and organizational accountability. Companies following this framework are well-positioned for both Singapore regulatory reviews and alignment with the EU AI Act.

AI Verify — Singapore's testing toolkit

IMDA developed AI Verify, an open-source AI governance testing toolkit that allows companies to test and document their AI systems against a set of internationally aligned principles. AI Verify produces a testing report that can be shared with customers and regulators as evidence of responsible AI practice. It is the closest thing to a global "AI compliance certificate" that currently exists.

Personal Data Protection Act (PDPA) and AI

Singapore's PDPA governs personal data processing. The PDPC (Personal Data Protection Commission) has published guidance on the PDPA's application to AI. Key points:

• Purpose limitation applies — AI must only use personal data for the purpose it was collected
• Consent is required for using personal data to train AI unless another legal basis applies
• The "deemed consent by notification" provision allows use of personal data for secondary purposes with proper notification
• No automated decision-making provision equivalent to GDPR Article 22 — Singapore takes a softer approach

Japan — Innovation-first with soft regulation

Japan has deliberately chosen a light-touch approach to AI regulation, prioritizing economic competitiveness and AI adoption over strict rules. The government has consistently stated its preference for voluntary guidelines over mandatory law.

AI Guidelines for Business

Japan's Ministry of Economy, Trade and Industry (METI) published "AI Guidelines for Business" in 2024, covering principles for responsible AI development and deployment. These are non-binding guidance documents, not enforceable law.

Japan aligns broadly with the Hiroshima AI Process — a G7 initiative to develop international AI governance standards. For companies operating across multiple G7 countries, Japan's voluntary framework fits within this broader international alignment.

Act on the Protection of Personal Information (APPI)

Japan's APPI (amended 2022) is the relevant data protection law for AI processing personal data. Key AI implications:

• Consent required for using personal data beyond the original collection purpose
• Third-party sharing restrictions — providing personal data to AI vendors requires consent or a legal basis
• No AI-specific provisions in APPI currently
• Cross-border transfer restrictions for transfers outside Japan

Japan does not have AI-specific hard law. Companies operating only in Japan face the lightest regulatory burden of any major economy. This is unlikely to remain true — watch for Japan to pass AI-specific legislation in 2026–2027 as EU AI Act influence spreads.

South Korea — Sector-specific AI rules

South Korea has taken a sector-by-sector approach to AI regulation rather than a comprehensive AI law. Rules vary significantly depending on your industry.

AI Basic Act (Framework Act on AI)

South Korea passed the "Act on the Development of Artificial Intelligence and Establishment of Trust" in late 2024, creating a foundational AI governance framework. The law:

• Establishes a national AI committee and coordinator
• Requires high-impact AI systems to implement safety measures
• Creates disclosure requirements for AI that affects individuals in significant ways
• Requires AI-generated content disclosure (deepfakes, AI-written content in public contexts)
• Establishes an AI safety institute

The law is principles-based and the detailed implementing regulations are still being developed. It is less prescriptive than the EU AI Act but more than Japan's voluntary approach.

Personal Information Protection Act (PIPA)

Korea's PIPA (significantly amended in 2023) includes provisions specifically relevant to AI:

• Automated decision-making provisions — individuals can request human review of automated decisions that significantly affect them
• Right to explanation — individuals can request the basis for automated decisions
• Sensitive data restrictions apply to AI that processes health, biometric, or financial data
• Cross-border data transfer restrictions

India — Building the framework

India is in the process of finalizing comprehensive data protection and AI governance frameworks. The country's approach has shifted significantly over several draft versions.

Digital Personal Data Protection Act (DPDPA)

India passed the Digital Personal Data Protection Act in August 2023. Key provisions for AI processing of personal data:

• Consent required as the primary legal basis for processing personal data
• Data principal rights: access, correction, erasure, grievance redressal
• Significant data fiduciary designation — large-scale or sensitive data processors face additional obligations
• Cross-border data transfer: Indian government can restrict transfers to specific countries (blocklist approach)
• Children's data: parental consent required, no behavioral monitoring of children

The DPDPA implementing rules (Digital Personal Data Protection Rules) are expected to be finalized in 2025–2026. The Rules will determine the practical requirements for AI companies operating in India.

AI governance — NASSCOM and emerging policy

India does not yet have an AI-specific law. The Ministry of Electronics and Information Technology (MeitY) has published responsible AI principles, and industry bodies like NASSCOM have their own frameworks. Hard AI law is likely to follow once the DPDPA implementing rules are established.

China — The world's most comprehensive AI law

China has the world's most extensive AI regulation framework, with multiple laws covering specific AI applications. These laws are strictly enforced and apply to any company serving Chinese users — including foreign companies.

Algorithm Recommendation Regulations (2022)

China's Algorithm Recommendation regulations require:

• Disclosure to users that algorithm recommendations are being used
• User right to opt out of personalized recommendations
• Prohibition on using algorithms to exploit user behavior in addictive ways
• Price discrimination prohibition — cannot show different prices to different users based on their data profile
• Registration with the Cyberspace Administration of China (CAC) for large-scale algorithm services

Deep Synthesis (Deepfake) Regulations (2022)

China prohibits deep synthesis technology (AI-generated video, audio, images) used to create false information. Requirements:

• Disclosure that content is AI-generated (watermarking or labeling)
• Consent required before generating synthetic content depicting a real person
• Content moderation requirements

Generative AI Regulations (2023)

China's regulations on generative AI services (in force August 2023) are among the world's first comprehensive rules for LLMs and generative AI. Requirements:

• CAC registration/filing required for generative AI services with public-facing products in China
• Training data must come from lawful sources and not violate intellectual property
• Generated content must not violate Chinese law (including political content restrictions)
• Label all AI-generated content
• User identity verification required
• Security assessments required before launch

Foreign companies providing AI services to Chinese users are subject to these regulations. The compliance burden is substantial and many foreign AI companies have exited the Chinese market rather than comply.

Comparison: Asia's AI regulatory landscape

Practical compliance priorities for Asia-Pacific operations

1. China: highest priority. If you serve Chinese users with any AI features, you face mandatory registration, content moderation, and labeling requirements. Get legal advice specific to your product before entering the Chinese market.
2. India: data protection first. Comply with DPDPA consent requirements now. Monitor the implementing rules expected in 2026 for additional obligations.
3. Singapore: use AI Verify. Running your AI through the AI Verify toolkit and keeping the report is low-cost insurance and demonstrates good faith to regulators throughout the region.
4. Japan and South Korea: data protection compliance covers most of it. APPI and PIPA compliance, plus noting automated decision-making provisions in Korea, handles the main requirements for now.
5. Watch for change. Japan, India, and Singapore are all expected to move toward harder AI law in the next 2 years as EU AI Act influence spreads globally.

Further reading

• AI Compliance by Country: The 2026 Guide
• AI Transparency Requirements: Country-by-Country
• EU AI Act Timeline and Deadlines