Responsible AI at Work: Privacy, Accuracy and Human Oversight

Is this task suitable for an AI tool?#

A task suits an AI tool when the output can be checked by someone qualified, a mistake can be caught before it causes harm, and the information needed is something you are allowed to share with the tool. If any of those is missing, change the task or keep it manual.

For the last row, IMDA's Starter Kit for Testing LLM-Based Applications notes that hiring tools may have stringent requirements, and lists bias in decision making among its five key risks.

What does PDPC's guidance say about personal data in generative AI?#

PDPC's Advisory Guidelines on Use of Personal Data in Generative AI, issued on 20 July 2026, clarify how personal data can be used in generative AI models and systems. They are advisory: PDPC states they are not legally binding and do not constitute legal advice, so read the document and take advice where needed.

PDPC's PDPA Overview explains that the PDPA provides a baseline standard of protection for personal data in Singapore. Personal data means data about an individual who can be identified from that data, or from that data and other information the organisation has or is likely to have access to.

The generative AI guidelines identify three groups of stakeholders:

• Model Providers, who develop and make available generative AI models;
• System Providers, who develop and make available generative AI systems;
• System Deployers, who use or enable the use of generative AI systems under their authority.

A business giving staff an AI tool is likely to be looking at the third role, though the guidelines note an organisation may play different roles in different contexts. They say System Deployers bear primary responsibility for ensuring that the systems they choose can meet their obligations under the PDPA, and need sufficient information on upstream safeguards when procuring them.

What practical controls does the guidance describe?#

For System Deployers, the guidelines describe being clear about the purpose of processing and how much personal data it needs, safeguarding new data such as prompts and outputs, telling users what personal data may go in, writing policies down and reviewing safeguards as risks change. Each translates into simple workplace habits.

The guidelines include an example of an organisation running an HR chatbot. It designates its HR unit as responsible for the chatbot's prompts and outputs, sets guidelines on what personal data can go in prompts, scans prompts for common personal identifiers, limits prompt logs to authorised maintenance staff, and documents all of this in internal AI governance guidelines shared with employees. A small business can borrow the shape of this without the tooling.

How do you protect personal and confidential information day to day?#

Before entering workplace information, check your organisation's rules and the tool's data-handling terms. Use fictional or anonymised examples for early experiments. Do not paste customer identifiers, staff records or confidential documents into an unapproved service, even if the task seems harmless or the tool is popular with colleagues.

1. Check that the tool is approved for work use.
2. Remove names, contact details, identification numbers and account details, or replace them with placeholders such as [CUSTOMER].
3. Paste only the part of the document the task needs.
4. Ask whether you would be comfortable if the person the data is about read your prompt.
5. Keep the output where your team stores working documents, not in a personal account.

Worked example. Instead of pasting a complaint email with the customer's name, address and order history, write: "Draft a polite reply to a customer whose order arrived three days late and who complained about a driver's manner. Apologise, say we are reviewing the delivery and offer a call back. Do not promise compensation." The tool gets what it needs to draft, and a staff member adds the details before sending.

How should you check AI-generated content?#

Treat generated content as a draft or proposal, never a final answer. Review factual statements, calculations, citations and instructions before using them. Where an output may affect customers, students or employees, set the right level of human checking in advance, and make sure the checker has time and authority to reject it.

Watch for bias and exclusion#

AI-generated text can reflect uneven or unsuitable assumptions. Review examples involving different users, accessibility needs and language backgrounds, rather than assuming one successful test represents everyone. IMDA's Starter Kit describes perturbation testing: changing selected attributes, such as a name, and comparing the results. Our guide to testing and evaluating AI-generated outputs shows how to set this up in a test matrix.

Who is accountable when AI is used at work?#

Name the people responsible before a tool goes into regular use: who approves deployment, who maintains the reference information, who reviews incidents and who can suspend the tool if results become unreliable. In a small business one person may hold several roles, but each should be written down.

IMDA's page on Artificial Intelligence in Singapore lists governance resources, including the Model AI Governance Framework, the Model AI Governance Framework for Agentic AI, Safe & Secure Use of Generative AI for Individuals and Transparency Guidelines for Generative AI Chatbots. It also describes AI Verify, an AI governance testing framework and software toolkit whose framework outlines 11 governance principles. These are useful references when you write your own guideline; check each one for what it covers.

For employers, accountability includes training. AI Training for SMEs and Employers covers planning staff training, and how to identify AI training needs in a Singapore SME helps you work out who needs what.

What could this look like in a Singapore firm?#

Consider a 12-person logistics firm in Jurong whose customer service team wants to use a generative AI tool to draft replies to delivery enquiries. This is an illustrative scenario. The operations manager decides to start with one task, one approved tool and a short written guideline before anyone uses it with real customers.

The guideline fits on one page:

• Purpose: draft replies to delivery enquiries; no other use.
• Do not paste: customer names, addresses, phone numbers or account details.
• Reviewer: the customer service lead reads every draft before it is sent.
• Testing: a small test matrix of normal, missing-information and out-of-scope enquiries, rerun after any change.
• Review: the manager revisits the guideline when the tool adds new features.

If the team later wants to build its own app, five practical AI application ideas for small businesses and Build AI Apps Without Coding: A Practical Guide show where to start.

Common mistakes in workplace AI use#

Many problems come from habits rather than technology: assuming a tool is approved because colleagues use it, pasting whole documents, and treating fluent text as checked. None of these needs a large budget to fix, only a clear rule and a named person who keeps the rule up to date.

• Assuming a popular tool is approved. Check first.
• Pasting whole documents. Share only what the task needs.
• Treating fluent output as correct. A confident answer can still be wrong.
• Leaving ownership vague. If nobody can suspend the tool, nobody is accountable.
• Treating guidance as a guarantee. PDPC and IMDA documents help, but read them and take advice for your situation.
• Writing the policy once. Review it as tools and uses change.

At UCC Workforce Learning, practical AI training includes responsible use, privacy, model evaluation and human oversight, so people build useful skills while keeping responsibility for decisions and outcomes.

Sources#

1. Advisory Guidelines on Use of Personal Data in Generative AI, Personal Data Protection Commission (PDPC), accessed 7 November 2026
2. PDPA Overview, Personal Data Protection Commission (PDPC), accessed 7 November 2026
3. Artificial Intelligence in Singapore, Infocomm Media Development Authority (IMDA), accessed 7 November 2026
4. Starter Kit for Testing LLM-Based Applications for Safety and Reliability, Infocomm Media Development Authority (IMDA), accessed 7 November 2026

Frequently asked questions#

Where does responsible AI use at work start?+

With deciding whether a task suits an AI tool, what information can go into it and who is accountable for the result. A task suits an AI tool when someone qualified can check the output, a mistake can be caught before it causes harm, and you are allowed to share the information needed.

Can I paste workplace information into an AI tool?+

Check your organisation's rules and the tool's data-handling terms first, and use fictional or anonymised examples for early experiments. Do not paste customer identifiers, staff records or confidential documents into an unapproved service.

What are PDPC's Advisory Guidelines on Use of Personal Data in Generative AI?+

Guidelines issued by PDPC on 20 July 2026 that clarify how personal data can be used in generative AI models and systems. PDPC states they are advisory, not legally binding and do not constitute legal advice, so read the document and take advice where needed.

What do the PDPC guidelines say about organisations that use AI tools?+

They describe System Deployers, who use or enable the use of generative AI systems under their authority, as bearing primary responsibility for ensuring the systems they choose can meet their obligations under the PDPA. They also describe practices such as specifying purpose, safeguarding prompts and outputs, and telling users what personal data may be input.

Can AI-generated content be used as it is?+

Treat it as a draft or proposal. Review factual statements, calculations, citations and instructions, and set the right level of human checking where an output may affect customers, students or employees.

Who is responsible when an AI tool is used at work?+

Name who approves deployment, who maintains the reference information, who reviews incidents and who can suspend the tool if results become unreliable. In a small business one person may hold several roles, but each should be written down.