Asia-Pacific: Singapore Proposes Incident Sharing, Australia’s Safety Bill, Japan’s Diet AI Trial, China’s AI Filings

On 28 October 2026, Singapore’s Prime Minister and Minister for Finance, Lawrence Wong, proposed a pilot for sharing information on AI incidents and near misses at the virtual leaders’ meeting on frontier AI safety co-hosted by Norway and Finland. He called for work on common categories, the scope of information to be shared and secure exchange arrangements.

Wong’s remarks set out a policy proposal for a voluntary pilot; he did not announce its formal launch. He suggested that interested countries and participants cooperate voluntarily, first agreeing on common incident categories and the scope of information, then testing secure collection and exchange methods. The proposal encompasses serious failures identified by deployers, and near misses that cause no actual harm and may not trigger existing reporting requirements. This information could supplement safety evidence that comes predominantly from model developers, while protecting security and commercially sensitive information. The speech established no uniform reporting threshold, deadline or mandatory exchange channel.

For enterprises operating connected agents, payment assistants or automated operations systems, we recommend recording both incidents that cause harm and near misses stopped in time. For example, when a limit blocks an unauthorised payment or a person intervenes to stop an abnormal modification, retain the task objective, model version, authorisation scope, key calls and reason for intervention. Reviews should distinguish model judgements, prompt injection, permission configuration and external system failures, rather than counting only final losses. When preparing information for sharing, we recommend separating shareable descriptions of risk mechanisms from customer data, credentials and vulnerability details, with clear arrangements for de-identification, approval and recipient access. Procurement contracts should also allocate responsibilities for supplier notification, evidence preservation and cooperation with investigations. These are deployment recommendations; external reporting must still be checked against applicable rules.

The proposal builds on existing international cooperation. A Call for Control of Frontier AI Models, published by Norway’s government on 21 September 2026, had already called for sharing serious safety incidents, pre-deployment testing and independent evaluation. Singapore has now suggested testing classification and exchange mechanisms through a small, voluntary pilot. Further developments to verify include any formal announcement of participants, common categories, sharing rules and confidentiality arrangements. Enterprises operating across regions can first establish a common internal evidence base for incidents while maintaining separate jurisdictional reporting responsibilities, keeping voluntary sharing pilots distinct from existing statutory reporting procedures.

On 29 October 2026, Australian Prime Minister Anthony Albanese confirmed at a press conference that the Online Safety Amendment (Digital Duty of Care) Bill 2026 had passed the House of Representatives the previous day, and called on the Senate to support it.

The Bill has passed its third reading in the House of Representatives but must complete further legislative procedures; its provisions are not yet in force. Proposed section 25B expressly covers AI services that generate material using the internet. Section 27 would require written risk assessments at least annually and before significant changes that could introduce new risks, with records retained for at least six years. Section 25E(1)(da) would classify material or conduct that simulates emotional intimacy and encourages a child’s dependence on it in place of human relationships as harmful to children, subject to the excluded-material provisions. Section 26A would also prohibit taking the cost of measures into account when determining whether safety action or measures are appropriate or effective.

For enterprises providing generative AI services to Australian users, we recommend first checking the service category, provider and parties exercising day-to-day control, then integrating risk assessments into approvals for model, feature and version changes. Companion products could focus testing on whether persistent memory, personalised relationship settings and repeated interactions reinforce minors’ dependence on AI as a substitute for real human relationships. Record the controls, evidence of effectiveness, periods of applicability and review findings. When an external model is updated, check whether the original assessment remains valid. Manage the retention plan for assessment evidence separately from the retention of user conversations, determining the latter according to privacy obligations and necessity. These are implementation preparation recommendations; specific responsibilities must also be assessed against exemptions, exclusions and the final text.

An exposure draft was published on 8 September 2026, and the Bill was formally introduced on 15 October before passing the House this week. The current text provides for different commencement arrangements: Schedule 2, which contains the digital duty of care, and the related Schedule 3 would commence on the day following the end of a 12-month period starting on Royal Assent. The notice and removal arrangements in Schedule 1 would commence the day after Royal Assent. Enterprises should therefore plan separately for systemic risk governance and content response, rather than assuming a uniform 12-month commencement period for the entire Bill. Senate amendments, Royal Assent and supporting rules still need to be checked; the House passage date cannot determine a fixed commencement date.

On 30 October 2026, Japan’s Digital Agency began providing a prototype AI application for drafting Diet responses to approximately 180,000 government staff through its government AI environment, Gennai. The application supports source retrieval, information organisation, response drafting and content verification.

The Digital Agency’s announcement sets out a trial arrangement for government staff using AI to assist in preparing Diet responses. It states that the accuracy and appropriateness of AI outputs are not guaranteed. Staff must verify facts and consistency with government policy against original source materials, retaining responsibility for policy judgements and finalising responses. Those delivering responses remain responsible for answers based on text that has been reviewed and coordinated. Although the system provides source-checking and inconsistency-checking functions, staff must still establish whether the generated content is supported by the materials, rather than adopting AI drafts directly.

For enterprises using AI to draft regulatory responses, customer communications or formal reports, we recommend ensuring that key facts can be traced to specific sources and versions. Test for genuine citations that do not support the conclusion, outdated materials and conflicting versions of responses. Assign responsibility separately for reviewing facts, professional judgements and final publication. Before a draft becomes an official document, retain revision and approval records and give reviewers original materials and sufficient time. Procurement acceptance should assess source traceability, version management and human editing capabilities, rather than comparing generation speed alone. These are deployment recommendations that enterprises can draw on; the announcement creates no generally applicable rules for private businesses.

The supporting materials show that development began in April 2026, with 102 staff from 16 ministries and agencies participating in evaluation. Some feedback has already informed improvements. During the extraordinary Diet session, the prototype will be tested in real workflows for effectiveness, usability and output quality. Following improvements based on the results, full provision is planned for the ordinary Diet session beginning in January 2027. Enterprises can draw on this approach: involve staff with practical business expertise in acceptance, then use real workflows to assess quality and review workload. When expanding deployment, assess both efficiency and how responsibilities are fulfilled. The timing of full provision and subsequent adjustments remains subject to Digital Agency announcements.

On 30 October 2026, the Cyberspace Administration of China published its nineteenth batch of domestic deep synthesis service algorithm filings, and called on relevant service providers and technical support providers that had not completed the procedures to apply promptly.

The announcement discloses algorithm filing information under China’s existing deep synthesis governance regime. The attachment lists algorithm names, roles, entities, application products, principal uses and filing numbers, covering both service providers and technical support providers. Of particular relevance to enterprises, the filings also cover technical support providers generating production schedules for business customers. Entry 7 generates production scheduling Gantt charts and process-sequence text tables from inputs such as text, handwritten work orders and equipment dashboard photographs. The entry is registered as a technical support provider, and the list does not name a specific application product. Checks therefore need to extend beyond consumer-facing apps to upstream technical support and its specific uses.

For enterprises procuring industry-specific generative services, digital humans or conversational systems, we recommend mapping the filing fields to the contracting entity, actual interfaces, deployed products and business uses. Check upstream technical support filings separately from the procedures that downstream products themselves need to complete. A technical support entry without a separately listed application product cannot, by itself, establish that a downstream product has completed its procedures. Recheck filing and security assessment matters when suppliers, underlying interfaces or functions change. Technical acceptance should also test whether labels survive downloading, transcoding and external publication, and whether generation, publication and incident handling records can be linked. These are deployment recommendations; specific responsibilities must be determined by actual roles and functions.

The Provisions on Administration of Deep Synthesis of Internet-based Information Services have applied since 10 January 2023. Article 19 requires service providers with public opinion attributes or social mobilisation capabilities to complete filing, change and deregistration procedures, with corresponding requirements for technical support providers. Entities that have completed filings must also prominently display their filing numbers and provide disclosure links on the websites and applications through which they offer services. Article 20 separately requires security assessments under the relevant rules when applicable new products, applications or functions are launched. The new list provides more specific evidence for checking entities and uses without changing these thresholds. Enterprises can use the Internet Information Service Algorithm Filing System to check that disclosed information remains consistent with the actual service.