Which AI Rule Applies When? Singapore, Australia, Canada, Malaysia

For a bank, insurer or telco working in Singapore, Australia, Canada and Malaysia, almost none of the AI rules from financial regulators is law yet. Of nine instruments opened for this post, one is enacted law: Australia's duty to describe automated decisions in a privacy policy, from 10 December 2026. Six are guidance or supervisory expectations. Two Malaysian items are proposals. Guidance still matters: MAS calls its text supervisory expectations, OSFI expects institutions to follow its guideline and APRA warns of enforcement. This is for the COO and CRO who must decide which paper reaches which entity, and by when.

Every status and date below comes from the regulator's own page. Where a page does not say whether a document is binding, we say so instead of guessing. This is general information, not legal advice; have counsel in each market confirm the status of anything you act on. Our earlier MAS post covers the 2018 FEAT principles and the 2026 MindForge toolkit; the MAS guidelines of 7 October 2026 are the newer text.

Update, 28 October 2026: We re-read the OAIC, APRA, OSFI, BNM and LEGISinfo pages and searched for news on Malaysia's AI Governance Bill. Nothing changed: the start dates of Australia's duty and OSFI E-23 stand, and we found no report that the bill has been approved by Cabinet or tabled. The day counts now run from 28 October. The MAS dates follow its guidelines of 7 October.

Which of these AI rules is actually law?

One of the nine instruments is enacted law: Australia's automated-decision transparency duty, which starts on 10 December 2026. The other eight describe what a regulator expects or proposes. The useful question is not "is it binding" but "who will supervise against it, and from when". OSFI states the position for Canada in one line: "Although Guidelines are not laws, institutions are expected to follow them" (OSFI, guidelines and regulatory notices).

The table gives each instrument, the status its own issuer gives it and the date that status was set.

Five notes on the table. "Enacted law" for the Australian duty rests on the Privacy and Other Legislation Amendment Act 2024, which the Federal Register of Legislation shows as assented on 10 December 2024. Counsel should confirm its scope and whether each entity is covered. Separately, the OAIC's guidance of 30 September 2026 is explanatory, not law, and is not counted as an instrument; it is where we read that APP entities "must include" the information in their privacy policy, with the duty applying from 10 December 2026. The MAS pages call the guidelines "supervisory expectations" and do not state a legal status. The IMDA framework calls itself a living document and invites feedback; we found no penalty or legal duty in its text. The Malaysian government portal says MOSTI launched its guidelines in September 2024; the PDF itself carries no date.

Canada's federal AI bill did not pass. Bill C-27, whose title includes the Artificial Intelligence and Data Act, was before a House of Commons committee when its session ended on 6 January 2025 (Parliament of Canada, LEGISinfo). LEGISinfo marks the page as relating to a prior session, still shows the bill at committee stage and records no Royal Assent. This post covers federal rules only; provincial law is out of scope. LEGISinfo's list of bills for the current session (45th Parliament, 1st session) shows no bill with artificial intelligence in its title among those introduced by 28 October 2026. It does list two related bills from June 2026: C-36, a privacy bill sponsored by the Minister of Artificial Intelligence and Digital Innovation, and C-34, a digital-safety bill that a Canadian Heritage release says covers AI chatbots. We read only their LEGISinfo pages, not their text, so ask counsel whether either sets duties for your firm.

When does each rule start?

The first date is Australia's, 43 days from 28 October 2026, and the last is the later MAS expectation, 710 days out. The Privacy Act duty starts on 10 December 2026. OSFI E-23 takes effect on 1 May 2027. The MAS guidelines take effect on 7 October 2027. Paragraph 1.8 of the MAS guidelines says firms may meet Sections 3 to 4 from 7 October 2027 and Sections 5 and 6 by 7 October 2028, and the MAS release says firms may implement in phases. APRA and BNM have set no dates.

A start date is not the same as an exposure date. APRA has no deadline, yet its letter of 30 April 2026 says what it will do:

we will take stronger supervisory action and, where appropriate, pursue enforcement.

APRA, Letter to industry on artificial intelligence, 30 April 2026.

The same letter says "most entities recognise that existing prudential standards apply to AI risk". The exposure in Australia therefore sits in rules already in force, applied to AI, and not in a new AI rulebook. The 27 August 2026 release adds a figure: APRA and ASIC held nine roundtables in June and July with more than 600 attendees, and urged boards to move beyond awareness.

How do the four regulators compare?

All four name AI, but only 2 of the 4, MAS and OSFI, have a start date, and 0 are law. MAS, APRA and OSFI each keep the regulated firm accountable when a third party supplies the AI. BNM has only asked questions so far. Use the matrix to hide a market, filter by topic or show only the rows where the answers differ.

On vendors, the wording differs. MAS says financial institutions "remain accountable" for AI developed, operated or provided by third parties, and should consider limiting, suspending or replacing a third-party AI service when risk falls outside appetite. OSFI's E-23 covers models or data sourced from third-party vendors. APRA's letter expects firms to map the full AI supply chain and secure audit and transparency rights in contracts. In each case the duty sits with the regulated firm. Our reading is that the vendor is not itself regulated by these papers, but its contract has to carry the evidence.

Which rule reaches a use case that crosses borders?

Three questions settle it: who licenses the entity, whether the AI decides about a person, and whether a vendor supplies it. A group-wide tool does not carry one rule across borders. Each licensed entity answers to its own regulator, and privacy law can reach the same tool from a different direction, including at a telco that no financial regulator supervises.

Illustrative example: a group has a bank in Singapore, a bank in Australia and a federally regulated insurer in Canada. All three use one claims-and-complaints triage tool, bought from a single vendor, with 40 AI uses across the group on its register. Singapore asks for the MAS expectations from 7 October 2027. The Australian entity faces the privacy-policy duty from 10 December 2026 if the tool makes or informs significant decisions about people, plus APRA's stated expectations. The Canadian insurer faces E-23 from 1 May 2027. The numbers are made up; the sequence is the point: the earliest date belongs to the entity whose tool decides about customers.

Which rule applies to my entity?

A telco is not a financial institution, so the bank and insurer papers do not apply to it as a telco. What can reach it is cross-sector: Australia's privacy duty applies to organisations covered by the Privacy Act, and the IMDA framework is aimed at any organisation deploying agentic AI. We did not map telecom regulators in any of the four markets, so check yours.

Malaysia has no binding AI rule from Bank Negara Malaysia or the Ministry of Digital, and MOSTI's national guidelines are voluntary. BNM's discussion paper of 5 August 2025 "aims to gather feedback that will inform BNM's regulatory and development approach", and feedback closed on 17 October 2025. The Ministry of Digital opened engagement on a proposed AI Governance Bill on 10 July 2026, and said the bill "will not directly regulate AI output". On 10 September 2026 the Digital Minister said the draft was complete and going to Cabinet, with tabling hoped for that quarter or by the first quarter of 2027 (The Star, 10 September 2026). Our Malaysia bill post covers the bill in more depth.

Pick a market and an entity type to see the paper that reaches it, its status and its date. The tool uses coded rules only. It cannot see your licence, so treat the result as a starting point for your compliance team.

For the COO, the point is sequencing: the first date is a privacy duty, not a financial-regulator one. For the CRO, the point is that the non-binding papers are likely to be the yardstick supervisors use, which each regulator can confirm. Compliance owns the status column of the table and should re-check it each quarter. Vendor management owns the evidence a vendor must hand over under each regulator's third-party language. Our AI work record post covers what to log, and the agent identity post covers who each agent acts as.

Where Origin Pi stands

The practical response is not four programmes. It is one register of AI uses, each with a named owner, a vendor, a note on whether it decides about a person, and the licensed entity that runs it. Every paper above asks for a version of that list, and the dates then decide the order of work.

We design and build the layer underneath: bounded permissions per agent, a confirm step where a person approves consequential actions, and an audit trail that can answer a regulator's question without a reconstruction. It is part of our AI compliance work. We do not claim that this makes a firm compliant with any paper above.

Take the data with you

Download the figures in this post as one CSV file with each source and read date, plus the at-a-glance card as a PNG. If you reuse either, please cite this post.

• Data file, every figure with its source and date (CSV, 6 KB)
• At-a-glance card (PNG, 102 KB)

Your next step, this week:

1. List every AI use in the group, mark the ones that decide about a person, and write the licensed entity next to each.
2. Ask counsel whether each Australian entity is covered by the Privacy Act duty, and put the privacy policy change on the plan before 10 December 2026.
3. Give each Canadian federally regulated entity an owner for an E-23 gap check before the guideline takes effect.