Should You Complete A.I. Verify Before You Buy an AI Tool?
5 min read
Yes — if you have a week or so of slack before sign-off, rather than after the tool is already answering customers. The reason is the word the government itself uses: the self-assessment is voluntary. No submission step sits behind it and no one is waiting on your answers, so the only version worth having is the one you write while you still choose the vendor, the scope and the data terms. [1]
The description comes from a speech by SMS Tan Kiat How at the SGTech Global Future Series Digital Trust Forum on 28 October 2022. Singapore launched A.I. Verify at the World Economic Forum that year; it enables organisations to be transparent about their AI systems and build trust with their stakeholders, and it allows a self-assessment taken voluntarily. Ten international and homegrown companies — among them Google, Meta, DBS Group, Singapore Airlines and two start-ups — gave feedback before it reached businesses. [1]
Why "voluntary" settles the timing
A voluntary exercise has no reviewer and no deadline attached to it, which sounds like a good reason to skip it. Read the other way, it means the audience is entirely one you appoint: the colleagues deciding whether to switch the tool on, and later a client who asks how a decision was reached. [1]
Timing is the difference. Answers written before sign-off can still change what you accept — what data the vendor may process, what the tool may decide on its own, what you require in writing. Answers written afterwards describe a setup you can no longer reshape. That is the whole case for doing it early, and it is a case about leverage rather than compliance.
The 2022 record, and what to check now
Two features of the official description matter for a small team. A.I. Verify is framed as a transparency and trust instrument rather than a technical control, and taking part is optional. There is no tier to qualify for, and nothing about your standing changes because you filled in the form. [1]
One caution on dates. What we can point to is a speech delivered on 28 October 2022 describing a launch at the World Economic Forum that year. Read as a picture of the tool's purpose, it is clear. Read as a description of the form on IMDA's site today, it is not enough. Check IMDA and the Personal Data Protection Commission for the current version and anything added since. [1]
The same speech noted that the PDPC launched its Data Protection Essentials programme in April that year, to help small and medium enterprises better protect consumer data and recover quickly from data breaches. If your immediate worry is the data rather than the model, that is the closer fit. [1]
Three questions a small team can actually answer
Start with the data. Singapore amended the Personal Data Protection Act in 2020 to enhance organisational accountability in personal data protection while supporting organisations' use of data for innovation — accountability sits with the organisation using the tool, not with the vendor's software. Write down what data the tool is handed, where it goes, and who inside your business can see it. [1]
Then the human step. Government material argues the optimistic case: people and AI algorithms working together have been shown to perform better than either acting alone, with examples drawn from healthcare diagnosis and freestyle chess, and AI offers predictive power without substituting for human judgment, improving rather than replacing human decision-making. Practically, that means naming the step a person keeps. [2]
Finally, explainability. The same IMDA-authored article notes that companies are considering how to minimise or mitigate inherent bias in their algorithms and how to enhance the explainability of AI, and it points to a proposed Model AI Governance Framework that IMDA released in January 2019, setting out principles and practical guidance for organisations taking on greater use of AI. [2]
A useful test of your own: could a non-technical colleague describe, in one sentence, why the tool suggested what it suggested? If nobody can, that is a finding worth writing down — and worth raising with the vendor before you pay, not after.
What a voluntary form cannot settle
It does not certify anything. Because participation is voluntary, a completed self-assessment records your own answers; it is not an approval, an audit result or evidence that anyone has tested your deployment. Nor will it tell you whether a particular use triggers a particular legal obligation. [1]
That last question belongs with your own legal or compliance adviser, alongside your contract. The form's job is narrower: it makes the human step explicit. Whoever reviews the output when it is wrong stays accountable for it, and the record is where you show that this was decided rather than assumed. [1] [2]
The decision is narrower than it sounds. If a tool will touch customer or client data, complete the self-assessment while you still hold leverage over the contract, the scope and the data terms; the answers give your colleagues something concrete to argue from. If the tool handles nothing sensitive and decides nothing anyone relies on, the exercise is still cheap, but the urgency is lower.
Keep the completed record with the procurement file rather than in an inbox. Revisit it when the tool is retrained, replaced or extended to a new use, and check IMDA and the PDPC for the current version before you rely on the wording. [1]
Sources
