Specialist Risk Group Singapore, in collaboration with Stories of Asia
One prompt. Email addresses belonging to 95,364 customers exposed [1]. For senior HR leaders, a recent Singapore data incident was less a story about technology than a story about who checked, who was trained and who decided. The AI risk map for people leaders is being drawn in real time, and the organisations that treat it as a cross-functional risk will be better placed than those that treat it as an IT issue.
One prompt, one very large consequence
In an incident published by Singapore’s Personal Data Protection Commission (PDPC) on 21 September 2026, an employee used a personal generative AI tool to develop code for a marketing email, resulting in the exposure of email addresses belonging to 95,364 customers. The PDPC identified insufficiently robust pre-deployment testing, reliance on one employee without supervisory review, and no governance framework or policies for employees’ use of generative AI. Testing checked activity logs but not the contents of the actual test email [1].
None of those gaps is exotic. Each is a basic control that existed long before AI. What has changed is the speed from a single instruction to a significant consequence, and the fact that the person at the keyboard may be the only checkpoint between the two.
Before asking whose fault it was
When something goes wrong, the instinctive HR question is whether the employee is to blame. It may be the wrong first question. A more useful sequence runs like this:
- Was the person trained for the task, and tested on it, and tested again?
- Was there a second pair of eyes between the output and the customer?
- Were the basics behind the workflow sound, from where data sits to how it is secured?
- Were there clear rules on when and how AI could be used at all?
An employee cannot be held fully accountable for factors outside their control. Equally, organisations cannot respond to every risk by adding another layer of review on top of the last one. The aim is the right checks in the right places, and clarity on who responds first: typically the business and its IT or security function, with HR joining when human error requires guidance.
A risk the market cannot yet price
How large would the financial and legal consequences of an incident like this be? The honest answer depends on the facts, applicable law and available insurance. AI-related exposures may engage cyber, technology errors and omissions, professional liability, employment practices and other policies, depending on the facts and policy wording. Coverage, exclusions, limits and insurer appetite vary. Organisations should map exposures with their broker and legal advisers rather than assume either that no cover exists or that a dedicated AI policy is required [2].
That shifts the emphasis. Before any conversation about transferring risk, organisations need to identify it, decide who owns it and understand what they are willing to retain. Insurance supports a risk plan; it does not replace one.
Principles travel further than policies
Policies are static, and AI is not. No leader can inspect every process, and no policy can anticipate every use. The more durable first layer is a short set of guiding principles that employees can apply when the rulebook runs out: integrity, accountability, and a preference for risk management over convenience.
Convenience is the real temptation. AI output arrives instantly, sounds confident and tends to affirm the person asking. In one workplace example shared at the session, a team was challenged for taking days to fact-check a task a chatbot had answered in seconds. When they did check, a large share of the information proved inaccurate. The speed was real. The reliability was not.
This is the pattern with every tool that makes a task easier: reliance grows quietly until the underlying skill, such as checking, questioning or navigating without help, has faded. AI amplifies a well-designed process. It amplifies a poor one just as efficiently.
A rulebook still being written
The regulatory picture across the region is uneven. Vietnam’s standalone Law on Artificial Intelligence took effect on 1 March 2026. Singapore currently uses a practical governance approach that includes non-binding guidance such as the Model AI Governance Framework for Agentic AI, while Malaysia’s National Guidelines on AI Governance and Ethics are voluntary and directed broadly at the public and consumers, policymakers and developers, and technology developers and providers [3].
Waiting for certainty is not a strategy. HR can stay informed, prepare what is within its remit and avoid waiting for regulators to define questions the organisation can already see. Few organisations can yet point to a genuinely AI-centric operating model, with job design, skills and structure rebuilt around it. Even emerging roles such as prompt engineer continue to vary widely between organisations.
The people questions that cannot wait
Who owns the agent? AI agents are already being used across recruitment workflows such as sourcing, screening, outreach and scheduling, with human accountability still required for hiring decisions [4]. If a candidate arrives with an AI tool shaped by years of work, does what it knows belong to the candidate or to a previous employer? The same question applies to employees who run work through personal accounts when a company tool is blocked. Data ownership, confidentiality and security sit squarely inside HR's remit.
Are we cutting for productivity or building for people? A 2026 secondary-source tracker reports examples of employers reversing or pulling back from AI-related workforce decisions, while cited surveys report regret among some leaders who cut roles in favour of AI. The evidence is still emerging and should not be read as a market-wide trend [5]. The safer lesson is not that every displaced role will return, but that leaders should prove the operating model before removing human capability [5]. A tool is neutral. The intention of the leaders deploying it is not.
What is the hidden cost of being more productive? Research at a US technology company found that generative AI could intensify work: employees worked faster, widened their task scope and extended work into more hours of the day. A 2026 vendor-led workplace survey also reports substantial time spent checking, correcting and contextualising AI output; its estimates should be treated as self-reported findings rather than universal benchmarks [6]. Wellbeing support, including employee assistance programmes, belongs in the AI risk response.
Where does empowerment end? SK Telecom has publicly described assigning employee IDs, departments, roles and permissions to AI agents and managing them through employee-like procedures [7]. That forces a practical question: how far should agents be empowered, who supervises them, and what controls govern their access and actions?
What HR leaders can do now
- Define decision modes. Distinguish AI-assisted from AI-made decisions, and name who is accountable in each case.
- Anchor on principles. Agree a short list of principles that employees can apply when a situation is not covered by policy.
- Build checks between generation and release. For anything customer-facing, review the actual output rather than the activity log, and name the reviewer.
- Train, test and retest. Treat AI competence like any other controlled skill, and confirm the security basics sit behind it.
- Empower people to challenge. Given the speed from prompt to consequence, give employees a clear and safe route to escalate concerns.
- Clarify data ownership. Cover candidates' AI agents, personal accounts and employee data in policy, and keep it under review.
- Watch the workload. Measure whether AI efficiencies are genuinely reducing effort, and treat wellbeing as part of the risk response.
- Talk to your broker early. Map AI exposures against existing cover, and use the conversation to identify and own risk before deciding what to transfer
Responsibility remains human
“AI may be moving faster than policy, regulation and insurance, but the leadership principle is already clear: organisations must know where human accountability sits, build the right checks around their people and technology, and understand which risks they can manage, retain or transfer. The strongest response will not be the fastest adoption of AI; it will be the most deliberate.”
Collin Yap, CEO, Asia Pacific, Specialist Risk Group
AI may accelerate decisions, but responsibility stays with people. Regulation, insurance and organisational design are all still forming, and no one has a crystal ball. History offers some comfort: society took time to learn how to use social media well, and a similar learning curve is likely here. The organisations that get there sooner will be those that stay logical, calm and deliberately human while the technology moves.
Where does your organisation's plan hold up, and where would the next prompt find a gap?
Editorial note
This article provides general risk-management commentary. It is not legal, employment, data-protection or insurance advice. Laws, regulatory guidance and policy terms may change, and organisations should obtain advice on their circumstances and policy wording.
Sources
[1] Singapore PDPC, Voluntary Undertaking by Bee Cheng Hiang Marketing Pte Ltd, published 21 September 2026. Confirms 95,364 affected individuals, that the affected data comprised email addresses, the employee’s personal use of a generative AI tool to develop the script, inadequate testing, lack of supervisory review, and absence of an AI governance framework or policy. The undertaking records a potential compliance matter resolved without a full Commission decision; it should not be described as a finding that AI itself malfunctioned.
[2] Aon, Q2 2026: Global Insurance Market Overview. Supports the need for high-quality risk information, clear submissions and a tailored assessment of appetite, pricing and terms. It is not authority for coverage under any particular policy; coverage analysis requires the actual wording and facts.
[3] Vietnam, Law on Artificial Intelligence No. 134/2025/QH15; Singapore IMDA, Updated Model AI Governance Framework for Agentic AI; Malaysia Government, National Guidelines on Artificial Intelligence Governance and Ethics. The Vietnam effective date is confirmed by the Vietnamese Government portal. The Singapore and Malaysia instruments cited here are governance guidance, not statutes.
[4] AIHR, AI Agents for Recruiting: How They Work + Top 9 Tools. Supports current use of agents across connected recruitment tasks while retaining human responsibility for hiring decisions. The claim that AI agents are interviewing other AI agents was removed because no reliable source was found.
[5] Programs.com, AI Layoff Reversals: Every Company That Rehired Workers Replaced by AI. This is a commercial secondary-source tracker rather than primary research. Its examples and survey summaries should be attributed and not generalised to the wider market.
[6] UC Berkeley, Does AI Actually Free up Workers’ Time?; Glean Work AI Institute, Work AI Index 2026. The Berkeley item describes an eight-month ethnographic study at one 200-person US technology company with more than 40 interviews. The Glean report is vendor-led and contains self-reported survey findings; neither source should be presented as universally representative.
[7] Seoul Economic Daily, SK Telecom Drives AX Innovation 2.0, Assigns Employee IDs to AI Agents. Supports the specific reported example of employee IDs, affiliations, job functions and authority for AI agents. The English article states that it is AI-translated from Korean, so the example should remain attributed to the publication and should not be treated as direct company wording.
This material is provided for general information only and reflects publicly available information and government announcements as at the date of publication. Announced measures may be subject to further legislation, implementation details, eligibility criteria and changes. This material does not constitute insurance, legal, employment or financial advice. Insurance coverage is subject to insurer underwriting and the applicable policy terms, conditions, exclusions and limits. The availability and suitability of cover will depend on the circumstances of each risk.
