Workplace AI Guidance Outlines Steps for Responsible Use

United Ceres Workforce Learning has published practical guidance on responsible artificial intelligence use at work. The resource addresses several key areas: deciding whether a task suits an AI tool, protecting personal and confidential information, checking generated content for bias, and naming who is accountable for the result. The guide draws on frameworks from Singapore's Personal Data Protection Commission and the Infocomm Media Development Authority.

The PDPC's Advisory Guidelines on Use of Personal Data in Generative AI, issued on 20 July 2026, are described as advisory in nature. They are not legally binding and do not constitute legal advice. The guidelines identify three stakeholder groups: model providers, system providers, and system deployers. The Personal Data Protection Act provides a baseline standard of protection for personal data in Singapore. Separately, IMDA's Starter Kit for Testing LLM-Based Applications identifies bias in decision making as one of five key risks. The United Ceres guide recommends treating every AI output as a draft and setting the level of human checking before using the tool.

Organisations adopting generative AI tools face a set of practical decisions that go beyond technical implementation. One central question is whether a given task is appropriate for an AI system at all. Tasks involving highly sensitive personal data, for instance, may not be suitable regardless of the tool's capability. Another question concerns data protection: when an employee inputs information into a generative AI interface, that data may be transmitted to external servers or used to retrain models. Understanding what happens to the data is a prerequisite for using the tool responsibly.

Human oversight is another area that requires deliberate attention. AI systems can produce outputs that appear confident and well-reasoned but contain factual errors, biased assumptions, or invented references. Without a human reviewer who understands the subject matter and the limitations of the technology, these errors can pass into final documents, decisions, or communications. The level of checking needed depends on the risk associated with the output. A draft internal memo may require less scrutiny than a customer-facing financial recommendation or a hiring decision.

Accountability is the final piece. When an AI-generated output is used in a decision or communication, someone must be responsible for its content. This is not a technical question but an organisational one. Clear policies that assign ownership for AI outputs help prevent situations where no one takes responsibility for errors or harmful consequences. The United Ceres guidance emphasises naming the person accountable for the result as a core part of responsible AI training at work.

Bias in AI outputs is a well-documented risk. Language models trained on large datasets can reproduce stereotypes, overrepresent certain groups, or make assumptions that are not supported by the data. The IMDA's starter kit classifies bias in decision making as one of five key risks for organisations deploying large language models. Checking for bias requires more than a quick scan. It involves understanding the context of the output, the demographic groups it may affect, and the potential for the output to reinforce existing inequalities. This is especially important in hiring, lending, healthcare, and other high-stakes domains.

The PDPC's advisory guidelines offer a framework for thinking about data protection in the generative AI context. Model providers develop and train the underlying models. System providers build applications on top of those models. System deployers are the organisations that make those applications available to end users. Each group has different responsibilities under the Personal Data Protection Act. For deployers, the key obligation is to ensure that personal data used as input is collected, used, and disclosed in accordance with the law. This may involve anonymising data, limiting the types of data that can be entered, or implementing access controls.

One practical recommendation from the United Ceres guide is to treat every AI output as a draft. This shifts the mindset from accepting generated content as final to reviewing and editing it before use. It also encourages organisations to establish clear thresholds for human review. For low-risk tasks, a quick check may suffice. For higher-risk tasks, a more thorough review process should be in place, possibly involving multiple reviewers or subject matter experts.

The broader context for this guidance is the rapid adoption of generative AI tools across industries in Singapore and globally. Companies are using these tools for content creation, customer service, data analysis, and software development. The pace of adoption has outpaced the development of governance frameworks in many organisations. As a result, employees may be using AI tools without clear policies on data protection, bias checking, or accountability. This creates legal and reputational risk for employers.

Regulators in Singapore have taken a proactive approach. The PDPC's advisory guidelines and IMDA's starter kit are examples of soft regulation that provides direction without imposing binding rules. They allow organisations to develop their own policies based on their specific circumstances while following general principles. The advisory nature of the guidelines means that organisations are not required to comply, but doing so reduces the likelihood of regulatory action and helps build trust with customers and the public.

For organisations developing their own AI policies, the United Ceres guidance offers a structured starting point. It covers the main areas that any policy should address: task suitability, data protection, human oversight, bias, and accountability. These areas are interconnected. A decision about task suitability affects the type of data that will be processed, which in turn affects the data protection measures required. The level of human oversight needed depends on the risk of bias and the consequences of an error. Accountability ties everything together by ensuring that someone is responsible for the outcome.

The recommendation to set the level of human checking before using the tool is particularly important. Without advance planning, human review can become an afterthought. Employees may rely on AI outputs without critical evaluation, or they may overcorrect and waste time reviewing trivial outputs. A predefined tier system for human review, based on the sensitivity and risk of the task, helps allocate review resources effectively. This approach also makes it easier to scale AI use across an organisation while maintaining consistent standards.

Responsible AI training in the workplace is not a one-time event but an ongoing process. As AI tools evolve, the risks and best practices change with them. Regular updates to training materials, based on new regulatory guidance and real-world incidents, help keep employees informed. The United Ceres resource positions itself as a practical guide that organisations can adapt to their own needs, rather than a prescriptive set of rules.

The guidance also highlights the importance of understanding the limitations of AI tools. Generative AI models do not understand the content they produce. They generate text based on patterns in their training data, which can include errors, biases, and outdated information. Treating AI outputs as drafts is a recognition of this limitation. It encourages a culture of verification rather than blind trust.

For organisations in Singapore, the existing legal framework provides a baseline. The Personal Data Protection Act sets rules for how personal data can be collected, used, and disclosed. The PDPC's advisory guidelines extend these principles to the generative AI context. Organisations that follow these guidelines are better positioned to comply with the law and to defend their practices if a complaint arises. The IMDA's starter kit adds a practical dimension by identifying specific risks and offering testing approaches.

Ultimately, the goal of responsible AI training is to enable organisations to benefit from AI tools while managing the associated risks. This requires a combination of clear policies, employee training, and ongoing oversight. The United Ceres guidance provides a framework that organisations can use as a starting point, building on the work of Singapore's regulators and adapting it to their specific context. By covering task suitability, data protection, human oversight, bias, and accountability, it addresses the main challenges that organisations face when deploying generative AI in the workplace.