I had two open Singapore requisitions on Friday, both titled “Senior Backend Engineer, Platform”. By Monday afternoon I had rewritten both, and the trigger was a decision taken in Brussels by people who have never heard of either company.
On 31 August 2026, the European Commission designated ChatGPT as a Very Large Online Search Engine under the Digital Services Act, and Reddit and Roblox as Very Large Online Platforms. Each had declared reaching at least 45 million average monthly users in the EU, the threshold that triggers designation.
The headline everyone ran was that ChatGPT is now regulated. The part that matters for anyone building an engineering team is subtler: the DSA has formally decided that a conversational AI interface is an information gateway, not a piece of software. Once that categorisation exists, it does not stay in Europe, and it does not stay limited to chatbots.
What the obligations actually require someone to build
Designated services have until January 2027. The obligations sound abstract in summary (assess and mitigate systemic risks relating to illegal content, negative effects on minors, users’ physical and mental wellbeing, fundamental rights, electoral processes and public security) and this abstraction is exactly why companies mis-staff the work.
Translate one line into engineering terms. “Assess systemic risk to minors” requires you to know which users are minors, which is itself an inference problem with its own privacy constraints. Then to measure what those users are actually exposed to, which requires instrumenting a recommender or retrieval system at a granularity most products never needed. Then to demonstrate that a mitigation reduced exposure, which requires a baseline you probably did not capture, and a way to distinguish reduction from displacement.
None of that is a policy document. It is data engineering, instrumentation and statistical honesty, delivered to a standard where an external auditor can check it. That is a specific engineering profile, and in most organisations it currently belongs to nobody.
Our Expert Take (1 of 3)
The reflex when a regulation lands is to hire a compliance manager and consider the box ticked. I have watched this fail three times in APAC platform teams. The compliance manager writes an excellent assessment of what should be measured, hands it to engineering, and discovers that the telemetry required to measure any of it does not exist and will take two quarters to build. The sequencing that works is the reverse: put an engineer on the instrumentation first, and bring in the compliance specialist once there is data to reason about. Companies that hire in that order hit the deadline. Companies that hire in the intuitive order request an extension.
Why a Brussels decision reaches a Singapore hiring plan
The objection I hear immediately is that Singapore is not in the EU. True and irrelevant, for three reasons.
Where the engineers already are. A substantial share of global platforms run Asia Pacific operations out of Singapore. Compliance engineering gets staffed next to the systems it must instrument, not next to the regulator. The team that knows how the recommender works is here.
The work is engineering, not law. Legal interpretation happens in Europe. Building the measurement, generating the evidence and maintaining it through every model and ranking change happens wherever the platform is built. That distinction is what routes the headcount.
Templates travel. Regulatory regimes of this kind are copied. Singapore already has its own online safety expectations, and the instrumentation built for a January 2027 EU deadline is largely the same instrumentation any comparable regional requirement will demand. Building it once for Europe and reusing it is considerably cheaper than building it twice.
Our Expert Take (2 of 3)
There is a detail in this designation that I think is under-discussed. ChatGPT was designated as a search engine, not as a platform. That framing implies the regulator sees the conversational interface as the thing that decides what a person learns. Any company shipping a retrieval-augmented assistant to consumers should read that carefully, because the logic does not depend on being OpenAI. It depends on scale and on the interface being a person’s route to information. Several Singapore-based products are closer to that description than their founders currently assume, and the time to build the evidence trail is before anyone asks for it.
Scoping a trust and safety engineering hire in Singapore?
We help platform teams define the role, benchmark the band and screen for the measurement mindset that this work actually needs. Let’s discuss it.
Talk to our Singapore teamThe profile to hire, and how to recognise it
The distinguishing skill is not moderation policy knowledge. It is measurement under adversarial conditions.
An ordinary backend engineer builds a system that behaves correctly when used as intended. A trust and safety engineer builds instrumentation that stays truthful when people actively try to evade it, and that holds up when an external auditor examines it a year later.
The interview signal that separates them reliably: ask how they would prove a mitigation actually reduced a harm. Strong candidates immediately raise baseline, displacement and measurement bias: they ask what the rate was before, whether the behaviour moved elsewhere, and whether the detector itself changed. Weaker candidates describe a dashboard.
The second signal is comfort with uncertainty. This work never produces clean numbers. Someone who needs a definitive answer before acting will stall; someone who can state a confidence interval, act, and revisit will deliver.
What Singapore is paying in 2026
Monthly figures from offers benchmarked in Singapore during 2026.
| Profile | Without regulatory work | With demonstrable T&S / regulatory work |
|---|---|---|
| Backend / data engineer, 4-6 yrs | SGD 8,500-12,500 | SGD 11,000-16,000 |
| Senior, owns an assessment end to end | SGD 13,000-18,000 | SGD 16,000-23,000 |
| Lead, speaks credibly to auditors | SGD 18,000-24,000 | SGD 23,000-30,000 |
The premium is roughly twenty to thirty percent, and unusually it is not compressing as quickly as other AI-adjacent premiums. The reason is worth stating honestly: the supply constraint is not knowledge, it is appetite. Relatively few engineers enjoy work whose output is evidence rather than features, and that does not change with training throughput.
Our Expert Take (3 of 3)
If you take one operational decision from this designation, make it this: find out today whether anyone in your organisation could reconstruct, six months after the fact, why a specific piece of content was actioned or a specific recommendation was made. Not whether they could find the log line, whether they could reproduce the decision. In most teams the honest answer is no, and that gap is the single largest predictor of how painful a compliance deadline becomes. It is also fixable now, cheaply, and expensive to fix under time pressure with an auditor waiting.
What to do in the next thirty days
Establish whether the threshold logic could ever apply to you. Not today’s user count, the trajectory, and whether your interface is a route to information. Founders consistently underestimate this.
Audit decision reproducibility. Pick one moderation or ranking decision from six months ago and try to reconstruct why it happened. The result tells you your real starting position.
Hire the instrumentation engineer before the compliance specialist. This ordering is counterintuitive and it is the one that hits deadlines.
Look internally first. The person who already understands your data model and your ranking system is a faster path to capability than an external hire who understands regulation but not your systems.
If you are building the surrounding team, our guides on hiring a data engineer in Singapore and building a cybersecurity engineering team in Singapore cover the sourcing and screening mechanics.
Frequently asked questions
What exactly did the European Commission announce on 31 August 2026?
It designated ChatGPT as a Very Large Online Search Engine under the Digital Services Act, and Reddit and Roblox as Very Large Online Platforms. All three declared reaching at least 45 million average monthly EU users, the designation threshold. ChatGPT is the first AI chatbot brought under this regime, meaning the DSA now treats a conversational interface as an information gateway. Designated services have until January 2027 to comply, with obligations covering systemic risks around illegal content, minors, physical and mental wellbeing, fundamental rights, electoral processes and public security.
Why does an EU regulation change hiring in Singapore?
Not because Singapore adopts EU law. First, many global platforms run APAC operations from Singapore, and compliance engineering is staffed next to the systems it instruments. Second, systemic risk assessment is engineering work, not solely legal work: it needs people who can instrument a recommender, measure exposure and produce auditable evidence. Third, these regimes set templates, and instrumentation built for the January 2027 EU deadline is largely reusable for comparable regional requirements.
Is a trust and safety engineer different from a backend engineer?
Meaningfully, though the overlap is large and most successful hires come from backend or data engineering. The distinguishing skill is measurement under adversarial conditions: instrumentation that stays truthful when people try to evade it and survives external audit. The interview signal is whether a candidate thinks in evidence rather than features. Ask how they would prove a mitigation reduced a harm; strong candidates raise baseline, displacement and measurement bias, weaker ones describe a dashboard.
What should Singapore employers pay for this profile in 2026?
A mid-level backend or data engineer with four to six years sits at SGD 8,500-12,500 monthly; with genuine trust and safety or regulatory reporting experience, SGD 11,000-16,000. Seniors who can own a systemic risk assessment end to end reach SGD 16,000-23,000. The premium is roughly twenty to thirty percent and is compressing more slowly than other AI-adjacent premiums, because the constraint is appetite for evidence-driven work rather than available training.
Building platform risk capability before January 2027?
We scope the roles, benchmark Singapore bands and shortlist engineers who have produced auditable evidence, not just dashboards. Let’s discuss your plan.
Start the conversation