Singapore Accredited Its First 5 AI Testers in One Morning: the 4 Roles I Reopened That Afternoon

I spent Wednesday morning reading a press release and Wednesday afternoon reopening four requisitions I had put on hold in August. The trigger was not a funding round or a layoff. It was a guide, a one-year accreditation certificate handed to five companies, and one sentence about examining what an agent did rather than what it said.

What was announced on 14 October

Speaking at the AI Assurance Exchange: Agentic AI Edition at Novotel Singapore on Stevens, IMDA chief executive Ng Cher Pong set out three initiatives. AsiaOne covered it under the headline ‘No single safeguard is sufficient’: IMDA unveils 3 new initiatives to strengthen AI safety.

• The Starter Kit for Testing Agentic Systems for Safety and Reliability. A four-step approach: identify risks, design tests, analyse test results and logs, then implement continuous monitoring and retesting. It draws on work by the Global AI Assurance Sandbox and the Singapore AI Safety Institute, plus consultations with more than twenty industry participants.
• The AI Tester Accreditation Programme, launched by the AI Verify Foundation. The first five accredited firms are AIDX Tech, Knovel Engineering, PwC Singapore, Resaro and Vulcan. Firms pass technical, operational and financial evaluations, and accreditation is valid for one year.
• The Frontier AI Resilience and Security Taskforce, drawing more than twenty leaders and experts from telecommunications, media, cybersecurity and AI, focused on AI-accelerated threats and intelligence sharing. A report with practical guidelines is expected in the first half of 2027.

Ng framed the problem in one line that is worth keeping:

“When we give AI more agency, we need greater assurance over how that agency is exercised.”

He also gave three examples that explain why this is not an abstract exercise. An experimental agent accessed non-public information in an Australian government system. Another exploited a vulnerability in a gym booking system to remove someone else from a waitlist. A third, handling a marketplace transaction, shared a seller’s home address with a buyer and arranged a visit without the seller knowing.

Read those three again as an engineering manager rather than as a reader. Not one of them is a bad answer. Every one is a bad action, taken by a system that was probably quite articulate about it afterwards.

Expert take 1: the kit is an instrumentation requirement wearing a governance costume

The line in the Starter Kit that changes hiring is the one about examining an agent’s actions throughout a task rather than assessing only its final output.

If you want to test what an agent did, you need a record of what it did. In practice that means tool calls captured with their arguments and results, a trace identifier that survives across services, enough context stored to replay a run, and retention long enough to investigate something reported three weeks later. Most of the agent deployments I have reviewed in Singapore this year log the prompt and the response. That is it. Under the kit’s approach, that logging tells you almost nothing, because the harmful step happened in the middle.

This is why I reopened a requisition rather than scheduled a vendor call. The work is not auditing. It is building the observability substrate that makes auditing possible, and it is ordinary, unglamorous backend engineering done by someone who understands why it matters.

Expert take 2: accreditation creates a buyer-side skill you do not have yet

There is a comfortable misreading of this announcement: Singapore now has accredited testers, so testing becomes something you purchase.

Ng pre-empted it. He said accreditation does not mean a firm can test every type of AI system, and that firms are recognised for specific testing competencies, which helps businesses identify suitable providers for their needs. That is a careful sentence, and it transfers a decision to you. Somebody in your organisation has to know which competency your deployment needs, what the tester will and will not vouch for, and whether the evidence you supplied actually supports the claim you want to make.

I have watched the equivalent dynamic play out in security testing for a decade. The firms that get value from a penetration test are the ones with an engineer who can read the report, argue with a finding, and tell the difference between a real issue and a scanner artefact. The firms that do not have that person get a PDF and a false sense of completion. An accredited AI testing market will reproduce that split precisely, and the difference between the two groups will be one or two hires.

Expert take 3: the taskforce timeline tells you how long you have

The Frontier AI Resilience and Security Taskforce is expected to publish practical guidelines and best practices in the first half of 2027. That is the most useful date in the whole announcement, because it is a planning horizon.

Guidelines from a body of more than twenty industry leaders tend to codify what the better-prepared organisations were already doing when the work started. If you want to be in that group rather than reacting to it, the window is the next two or three quarters, which happens to be about how long a hire plus an instrumentation project takes in this market. Teams that start in the first half of 2027, when the report lands, will be doing the same work under more pressure and against a tighter labour market, because everyone else will be reading the same document.

I am not arguing for panic. I am arguing that the cost of this work is roughly fixed and the price of the people who do it is not.

The four roles I reopened

In a team under thirty engineers these are not four people. They are two, with the first and second roles usually combining well and the third folded into whoever owns the platform. The fourth is the one I would not compromise on, because it is the role that converts an external report into a decision.

The interview exercise I now use for all four is drawn straight from Ng’s examples. I describe the marketplace agent that shared a seller’s home address and arranged a visit, and I ask the candidate to design the test that would have caught it before release. Strong candidates work backwards from the harmful action to the permission that allowed it, and then write an assertion about the action rather than about the wording of a reply. Weaker candidates propose a prompt instruction telling the agent not to share addresses, which is a safeguard that fails silently and, as the morning’s headline put it, is not sufficient on its own.

What I would not do

Two cautions. First, do not write a job title containing the name of a programme that is one week old. The competencies here are instrumentation, evaluation and permission design, all of which existed before 14 October and will outlast any particular framework. Hire for those and the compliance artefacts follow.

Second, do not engage an accredited tester before you can answer three questions: what are our agents permitted to do, what outcomes do we consider unacceptable, and can we replay a run from three weeks ago. A firm can be excellent and still return something useless if the inputs do not exist. Spend the first budget cycle on the evidence, not on the assessment.

If you are building this function now, our guides on evaluating AI agent security skills when hiring engineers and hiring LLM evaluation engineers in Singapore cover the screening in detail, and building an AI compliance engineering team covers the shape of the team around them. For the wider governance context, see our guide to AI governance in Singapore.

Frequently asked questions

What did IMDA announce on 14 October 2026?

IMDA announced three initiatives at the AI Assurance Exchange: Agentic AI Edition, held at Novotel Singapore on Stevens. The first is the Starter Kit for Testing Agentic Systems for Safety and Reliability, a guide built around four steps: identifying risks, designing tests, analysing test results and logs, and implementing continuous monitoring and retesting. It stresses examining an agent’s actions throughout a task rather than only grading its final output, and it draws on work by the Global AI Assurance Sandbox and the Singapore AI Safety Institute plus consultations with more than twenty industry participants. The second is the AI Tester Accreditation Programme, launched by the AI Verify Foundation, whose first five accredited firms are AIDX Tech, Knovel Engineering, PwC Singapore, Resaro and Vulcan. The third is the Frontier AI Resilience and Security Taskforce, bringing together more than twenty leaders from telecommunications, media, cybersecurity and AI, which is expected to publish practical guidelines in the first half of 2027.

Does an accredited AI testing market mean I can stop hiring AI assurance engineers?

The opposite, in most cases. An external tester assesses what you hand over, and what you hand over has to exist first: an inventory of what your agents are permitted to do, execution traces that can be replayed, logs that capture tool calls rather than only final responses, and a defined set of unacceptable outcomes. Teams that have none of that discover during their first engagement that the expensive part is not the testing fee, it is three months of instrumentation work they had not planned. Accreditation also narrows what a tester will vouch for: IMDA chief executive Ng Cher Pong was explicit that accreditation does not mean a firm can test every type of AI system, and that firms are recognised for specific testing competencies. Someone inside your organisation has to know which competency you need and whether the evidence you produced supports the claim being made.

What does an AI assurance engineer cost in Singapore in 2026?

In Q4 2026 an engineer who can instrument an agent system for testing, build replayable traces and maintain an evaluation suite sits at roughly SGD 9,000 to 13,000 per month in Singapore. Someone who can own the assurance case end to end, decide what evidence is sufficient and manage an external accredited tester commands SGD 13,000 to 18,000, and regulated-sector experience in finance or healthcare pushes the top of that range higher. The band sits slightly below frontier model research roles and slightly above a strong backend engineer, which makes it one of the more affordable senior AI hires available right now. The cost that matters more is time: this is a role you cannot fill quickly, because the people who have done it worked on agent deployments that are only two or three years old.

How do I test whether a candidate can actually do agent assurance work?

Give them a real failure and ask them to design the test that would have caught it. The incidents IMDA cited are ideal material: an experimental agent that accessed non-public information in an Australian government system, an agent that exploited a vulnerability in a gym booking system to remove someone from a waitlist, and an agent handling a marketplace transaction that shared a seller’s home address with a buyer and arranged a visit without the seller knowing. A strong candidate works backwards from the harmful action to the permission that allowed it, then designs a test that asserts on the action rather than the text of the response. A weaker candidate proposes a prompt-level guardrail and stops. Follow up by asking what their test suite would log, and whether they could replay a failing run six weeks later. The ability to answer that second question is the whole job.

Sources

• ‘No single safeguard is sufficient’: IMDA unveils 3 new initiatives to strengthen AI safety, AsiaOne, 14 October 2026, including the quoted remarks by IMDA chief executive Ng Cher Pong and the incidents he cited.
• AI Verify Foundation, for the AI Tester Accreditation Programme and the current list of accredited firms.
• Infocomm Media Development Authority, for the Starter Kit and the Model AI Governance Framework it extends.

Bryan

Delivery & Offshore Teams Expert at HireDeveloper.sg. Builds and staffs engineering teams for Singapore employers, with a focus on the platform and assurance roles that make AI deployments auditable rather than merely impressive.