AI governance & ethics specialist

What does an AI governance & ethics specialist do?

An AI governance and ethics specialist helps an organisation use AI safely and within the law.

You set rules for how models are built, bought and used. You then check that teams follow them.

The role usually sits in risk, compliance, legal or a data and AI office. Banks, insurers, public sector bodies and large technology firms are common employers. Smaller firms may fold the work into a privacy or risk role.

You work with data scientists, engineers, product managers, legal counsel and the data protection officer. In financial services you also work with compliance teams who answer to the Monetary Authority of Singapore (MAS). The Personal Data Protection Act (PDPA) applies across all sectors.

What the work involves

• Review proposed AI use cases and rate their risk before teams start building.
• Run or request tests on models for accuracy, bias, privacy leaks and unsafe outputs.
• Write and update AI policies, approval steps and risk registers.
• Advise product and engineering teams on PDPA duties, vendor terms and documentation.
• Brief senior managers and audit teams on open AI risks and the fixes under way.
• Track new guidance from Singapore regulators and update internal controls.

Pay in Singapore

Back to top

Skills an AI governance & ethics specialist needs

Back to top

AI governance & ethics specialist job description

We are hiring an AI governance and ethics specialist to set up and run controls for AI systems across the organisation.

You will review use cases, assess risks and agree test plans with product teams. You will also keep our practices in line with the PDPA and the rules of our sector. You will report to risk, compliance or the head of data and AI.

Responsibilities

• Assess new AI projects and vendor tools for legal, ethical and operational risk.
• Maintain an inventory of AI systems and a risk register with named owners.
• Design approval gates that projects must pass before launch and after major changes.
• Agree evaluation plans with engineers, covering accuracy, fairness, safety and privacy.
• Run data protection impact assessments for AI systems that use personal data.
• Write policies on staff use of generative AI tools and third-party models.
• Map internal controls to ISO 27001, the NIST AI Risk Management Framework and local guidance.
• Support internal audit and regulator queries with evidence and documentation.
• Train staff and managers on responsible AI practice.
• Report incidents, near misses and trends to senior management.

Requirements

• Degree in law, information systems, computer science, public policy, risk management or a related field.
• Typically 2 to 5 years in compliance, risk, privacy, audit, data or technology work.
• Working knowledge of the PDPA and of frameworks such as ISO 27001 and the NIST AI Risk Management Framework.
• Enough AI literacy to read model evaluation results and question engineers on how a system works.
• Clear writing and the ability to explain technical risks to non-technical managers.
• Privacy, security or risk certifications are often a plus.

Back to top

AI governance & ethics specialist career path

Most people reach this role from compliance, risk, privacy, audit or data work.

From there, you can grow into leading an AI risk function for a whole organisation.

1. Risk or compliance analyst (AI focus)

   Entry

   You support reviews, keep registers up to date and collect evidence for audits.

2. AI governance specialist

   Mid

   You assess AI projects on your own, run impact assessments and agree test plans with engineers.

3. Senior AI governance manager

   Senior

   You own policies and control design, advise senior stakeholders and handle regulator contact.

4. AI risk and governance lead

   Lead

   You lead a team, set standards across business units and decide on high-risk approvals.

5. Head of AI governance

   Head

   You set the organisation's AI risk position and report to the board or senior risk committee.

The titles are ones commonly used in Singapore; employers may name the levels differently.

Related jobs and their pay

Back to top

AI governance & ethics specialist interview questions

We wrote these questions from the skills this job needs. They are not an official question bank.

1. How would you build an AI risk register for a customer-facing chatbot?

   What a good answer covers

   • Starts with the use case, users and data the chatbot touches
   • Lists harms such as wrong answers, data leaks, bias and misuse
   • Rates likelihood and impact with a clear scale
   • Assigns an owner and a control to each risk
   • Sets a review cycle and triggers for re-assessment

2. How do the NIST AI Risk Management Framework and ISO/IEC 42001 differ, and how would you use them together?

   What a good answer covers

   • NIST is a voluntary framework organised around govern, map, measure and manage
   • ISO/IEC 42001 is a management system standard that an organisation can be audited against
   • Use NIST to shape risk practice and ISO to structure and evidence the management system
   • Links both to existing ISO 27001 controls to avoid duplicate work

3. How would you test a language model for bias before launch?

   What a good answer covers

   • Defines the groups and outcomes that matter for the use case
   • Builds test sets with matched prompts across groups
   • Chooses measurable metrics and sets pass thresholds in advance
   • Reviews samples by hand, not only scores
   • Documents limits and re-runs tests when the model or prompts change

4. Which evaluations would you require before approving an LLM assistant that answers staff questions on HR policy?

   What a good answer covers

   • Accuracy against the current policy documents
   • Refusal and escalation for questions it should not answer
   • Tests for leaking other staff members' personal data
   • Adversarial prompts and jailbreak attempts
   • Human review of a sample, with sign-off from the HR owner

5. How does the PDPA affect the use of personal data to train or fine-tune a model?

   What a good answer covers

   • Identifies the purpose and whether consent or an exception covers it
   • Applies purpose limitation, notification and retention rules
   • Considers anonymising or minimising data before use
   • Protects data in the training pipeline and with vendors
   • Confirms the position with legal counsel where exceptions are relied on

6. When would you run a data protection impact assessment for an AI system, and what goes in it?

   What a good answer covers

   • Runs it when the system uses personal data in new or high-impact ways
   • Maps data flows from source to model to output
   • Identifies risks to individuals and their likelihood
   • Lists controls and residual risk
   • Records the decision and who accepted the risk

7. A credit decision model must be explainable. How do you decide what level of explanation is enough?

   What a good answer covers

   • Separates explanations for customers, staff and regulators
   • Matches depth to the impact of the decision
   • Checks that explanation methods are faithful to the model
   • Considers simpler models when explanation needs are high
   • Documents the reasoning and limits

8. How would you map existing ISO 27001 controls to an AI system, and where do they fall short?

   What a good answer covers

   • Maps access control, logging, supplier and change management to the AI pipeline
   • Notes gaps such as prompt injection, data poisoning and model drift
   • Adds AI-specific controls and tests
   • Keeps one control set to avoid duplicate audits

1. A product team wants to launch in a week. Your bias tests show weaker results for one customer group. What do you do?

   What a good answer covers

   • Shares the evidence and the size of the gap with the team
   • Asks whether the gap affects outcomes that matter to customers
   • Offers options such as fixes, narrower scope or human review
   • Escalates to the risk owner if the team will not act
   • Records the decision and any conditions on launch

2. The business wants to send customer emails to a third-party LLM hosted outside Singapore. How do you assess this?

   What a good answer covers

   • Finds out what personal data is in the emails
   • Checks the PDPA duties on transferring data overseas and on vendors
   • Reviews contract terms on storage, training use and deletion
   • Considers masking data or choosing a local or private deployment
   • Sets monitoring and an exit plan

3. You find that staff are pasting client documents into a public chatbot. How do you respond?

   What a good answer covers

   • Stops the immediate risk and assesses what data was shared
   • Checks whether a breach notification duty could apply
   • Writes a clear acceptable-use rule
   • Offers an approved tool so staff have an alternative
   • Trains staff and monitors use

1. Tell us about a time you had to push back on a senior stakeholder over a risk.

   What a good answer covers

   • Describes the risk and evidence clearly
   • Shows respect for the business goal
   • Offers alternatives rather than only saying no
   • States the outcome and what you learned

2. Describe how you explained a technical AI risk to a non-technical audience.

   What a good answer covers

   • Uses a simple example tied to a business impact
   • Avoids jargon and defines unavoidable terms
   • Checks understanding and invites questions
   • Ends with a clear decision or action

1. How would you use the Model AI Governance Framework and AI Verify in your work?

   What a good answer covers

   • Names the Infocomm Media Development Authority (IMDA) and the Personal Data Protection Commission (PDPC) as the source of the framework
   • Uses the framework as a guide for internal controls and documentation
   • Explains that AI Verify is a testing toolkit and reports test results, not a legal approval
   • Notes that the guidance is voluntary and may be updated

2. A bank wants to use a model to flag suspicious transactions. How would the MAS FEAT principles shape your review?

   What a good answer covers

   • Names fairness, ethics, accountability and transparency as the lenses
   • Checks for unfair impact on customer groups
   • Confirms who is accountable for model decisions
   • Requires documentation and a way to explain alerts
   • Aligns with the bank's compliance and model risk teams

Common questions about an AI governance & ethics specialist job

Sources