1. Introduction

Autonomous Trustworthiness Certification Liability in Singapore concerns the civil and legal responsibility of organisations, certification bodies, technology providers, auditors, platform operators and other professionals who assess, certify or represent that an autonomous system is trustworthy, safe, reliable, transparent, ethical or legally compliant.

The concept becomes particularly important when artificial intelligence (AI), automated decision-making systems, autonomous vehicles, financial algorithms, digital identity platforms and smart infrastructure receive trustworthiness certifications.

For example, a certification organisation may issue a certificate stating that an AI recruitment system is fair, unbiased, secure and reliable. If the system subsequently discriminates against applicants, exposes confidential information or causes financial losses, questions arise:

Was the certification process negligent?

Did the certifier conduct adequate testing?

Did the organisation make misleading representations?

Can affected individuals claim compensation?

Is the technology developer independently liable?

Can a certificate be withdrawn or declared invalid?

Who bears responsibility when an autonomous system fails despite certification?

Important legal qualification: Singapore does not presently recognise a separate, comprehensive tort called autonomous trustworthiness certification liability. Such disputes would generally be analysed through established principles of contract law, negligence, negligent misstatement, misrepresentation, consumer protection, professional liability and applicable statutory regulation.

2. Legal framework in Singapore

Several areas of Singapore law are relevant.

A. Contractual liability

The certifier and the organisation seeking certification may enter into a contractual relationship covering:

Testing and verification obligations.

Accuracy of certification reports.

Cybersecurity and data protection assessments.

Compliance with technical standards.

Disclosure of known system weaknesses.

Renewal, suspension and withdrawal of certificates.

Allocation of financial responsibility for certification failures.

Under Singapore contract law, a party may be liable where it breaches an express or implied contractual obligation and causes legally recoverable loss.

The principal legislation includes the Civil Law Act 1909 and the Contract Act is not a separate Singapore statute; contractual obligations are principally governed by common law and applicable legislation.

B. Negligence and negligent misstatement

A certification body may face negligence claims where it owes a duty of care to an organisation or third party, breaches that duty and causes reasonably foreseeable damage.

Relevant considerations include:

Whether the certifier assumed responsibility.

Whether the claimant reasonably relied on the certification.

Whether the relationship was sufficiently proximate.

Whether imposing liability is fair, just and reasonable.

Whether the loss is legally recoverable.

A certificate does not automatically establish a duty of care to every person who relies upon it.

C. Misrepresentation and consumer protection

A trustworthiness certificate can become legally problematic if it contains false or misleading statements.

Examples include:

Claiming that an AI system is independently audited when it has not been.

Representing that a system is bias-free without adequate testing.

Falsely advertising compliance with cybersecurity standards.

Concealing material system vulnerabilities.

Misrepresenting the independence or qualifications of the certifier.

The Misrepresentation Act 1967 and Consumer Protection (Fair Trading) Act 2003 may become relevant, depending on the nature of the transaction and claimant.

D. Personal Data Protection Act 2012

Certification involving personal data must also be considered against Singapore's Personal Data Protection Act 2012 (PDPA).

Relevant issues include:

Unauthorised processing of personal information.

Inadequate security safeguards.

Improper disclosure of personal data.

Accountability for data-processing arrangements.

False representations concerning privacy compliance.

Certification does not exempt an organisation from its statutory data protection obligations.

3. Autonomous trustworthiness certification and liability

A. Meaning of autonomous trustworthiness certification

Autonomous trustworthiness certification refers to an independent assessment of whether an automated or AI-driven system satisfies defined standards of reliability, fairness, accountability, transparency, safety and security.

The certification process may involve:

In Singapore, the IMDA's Model AI Governance Framework and AI Verify initiative provide important governance and testing references. However, participation in voluntary testing or compliance initiatives does not automatically create statutory immunity or establish that a system is legally trustworthy.

B. Liability of certification organisations

Certification organisations may face civil liability in the following circumstances.

1. Negligent certification

A certifier may be liable if it fails to conduct reasonable testing, ignores known defects or issues a certificate without sufficient technical verification.

For example, a certification organisation approves an autonomous vehicle safety system without adequately testing its emergency braking functions. An accident subsequently occurs because of a defect that reasonable testing would have identified.

2. False certification

Liability may arise where an organisation knowingly or negligently provides inaccurate information about a system's reliability, security or compliance.

3. Inadequate verification

A certification body that merely accepts the developer's representations without performing the checks required by its engagement may breach its contractual or tortious obligations.

4. Failure to disclose limitations

Certification reports should accurately communicate the scope of testing, excluded risks and limitations. A certificate for a limited laboratory assessment should not be presented as proof of complete real-world safety.

5. Failure to update certification

An organisation may face liability if it continues representing a system as certified despite becoming aware of material changes, vulnerabilities or defects that undermine the original assessment.

Whether this creates a legal duty depends on the contract, applicable regulations, representations made and surrounding circumstances.

C. Liability of AI developers and system operators

Certification does not transfer all responsibility from the developer to the certifier.

AI developers may be responsible for:

Defective algorithm design.

Inadequate training data.

Failure to address foreseeable system vulnerabilities.

Misleading technical documentation.

Failure to disclose known defects.

Inadequate testing before deployment.

System operators may separately be responsible for negligent deployment, insufficient supervision, inappropriate reliance on automated recommendations and failure to respond to known system warnings.

D. Third-party reliance on certification

This is one of the most important issues in Singapore civil law.

Suppose a bank purchases an AI fraud-detection platform because an independent certification body describes it as highly accurate. The platform subsequently produces serious errors, resulting in financial losses.

The bank may have contractual claims against the developer and potentially the certifier.

However, if an unrelated customer or investor relies on the same certificate, that person must independently establish the necessary legal relationship and elements of the relevant cause of action.

Under Singapore's negligence framework, foreseeability alone does not automatically establish liability.

4. Important Singapore case laws

The following decisions provide the principal legal foundations for analysing certification-related liability. They are not all AI certification disputes; they establish analogous principles concerning professional verification, negligent representations, reliance and responsibility.

Case 1. Spandeck Engineering (S) Pte Ltd v Defence Science & Technology Agency [2007] SGCA 37

COURT OF APPEAL · 2007

Facts and legal issue:

The dispute concerned a contractor's negligence claim against the Defence Science and Technology Agency. The Court of Appeal considered the appropriate test for establishing a duty of care, including in cases involving pure economic loss.

Judgment and principles:

The Court established Singapore's unified test for determining whether a duty of care exists:

Factual foreseeability of harm.

Sufficient legal proximity between the parties.

Policy considerations that may negate the imposition of a duty.

Application to autonomous certification:

If a certification body issues a report specifically intended to guide a particular organisation's decision to purchase or deploy an autonomous system, the relationship may be sufficiently close to support a duty of care.

However, the claimant must establish legal proximity and overcome any relevant policy considerations.

Importance: This is the foundational Singapore authority for assessing negligence claims against autonomous certification organisations.

Case 2. JSI Shipping (S) Pte Ltd v Teofoongwonglcloong [2007] SGCA 40

COURT OF APPEAL · 2007

Facts and legal issue:

The dispute concerned professional negligence by auditors and the appropriate standard of care required when verifying financial information.

Judgment and principles:

The Court of Appeal explained that professional liability must be assessed by reference to the reasonable care and skill expected of an ordinary competent professional undertaking the relevant engagement.

An auditor must exercise appropriate professional judgment and cannot simply rely on unsupported representations where proper verification is required.

Application to autonomous certification:

A certification organisation should not issue a trustworthiness certificate merely because an AI developer declares that its system meets relevant standards.

The certifier must undertake reasonable verification within the scope of its engagement.

Importance: This decision provides a strong analogy for establishing professional standards of care in independent certification.

Case 3. PlanAssure PAC v Gaelic Inns Pte Ltd [2007] SGCA 41

COURT OF APPEAL · 2007

Facts and legal issue:

The case involved an auditing firm accused of failing to detect financial irregularities and fraud during its audits of a company.

Judgment and principles:

The Court considered the responsibilities of professional auditors, the appropriate degree of investigation and the importance of professional scepticism.

The Court explained that an auditor is not expected to detect every instance of fraud. Nevertheless, reasonable professional care requires further investigation when suspicious circumstances arise.

Application to autonomous certification:

A certifier cannot be expected to guarantee that an AI system will never fail. However, where testing reveals suspicious outputs, security weaknesses or inconsistent performance, the certifier may be required to investigate further.

Issuing an unconditional certificate despite significant warning signs may constitute negligence.

Importance: This case helps distinguish reasonable certification from careless or superficial certification.

eLitigation+1

Case 4. Standard Chartered Bank v Coopers & Lybrand [1993] SGHC 215

HIGH COURT · 1993

Facts and legal issue:

The plaintiffs were financial institutions that alleged they had suffered losses after relying on allegedly negligent audited financial statements.

The dispute concerned whether auditors could owe a duty of care to third parties who relied on their professional statements.

Judgment and principles:

The decision examined negligent misstatement and the limitations of professional responsibility towards third parties.

It highlighted the importance of identifying the intended purpose of a professional statement and the persons to whom responsibility may be owed.

Application to autonomous certification:

A certification body that prepares a report for a specific corporate purchaser may have a different relationship with that purchaser from its relationship with unknown members of the public.

A certificate's public availability does not automatically make the certifier liable to everyone who encounters it.

Importance: This case is particularly useful for determining the limits of third-party reliance on autonomous trustworthiness certificates.

Case 5. RSP Architects Planners & Engineers v Management Corporation Strata Title Plan No 1075 [1999] SGCA 30

COURT OF APPEAL · 1999

Facts and legal issue:

The dispute concerned professional negligence by architects in the design and supervision of a condominium development.

The Court considered whether professional responsibilities could extend beyond the immediate contractual relationship.

Judgment and principles:

The case is important in understanding professional responsibility and the circumstances in which a professional may owe duties to parties beyond the person who directly engaged the professional.

Application to autonomous certification:

A certification body may sometimes be exposed to claims by intended users or beneficiaries of its assessment, even where those persons did not directly sign the certification agreement.

The outcome depends on the nature of the undertaking and the proximity between the certifier and claimant.

Importance: It provides an analogy for assessing whether certification responsibility can extend beyond the immediate contracting organisation.

Case 6. Deutsche Bank AG v Chang Tse Wen [2013] SGCA 49

COURT OF APPEAL · 2013

Facts and legal issue:

The dispute concerned investment advice, negligence and the responsibilities of a financial institution towards its customer.

The customer alleged that the bank had failed to exercise appropriate care in managing and advising on investments.

Judgment and principles:

The Court of Appeal examined the circumstances in which a professional or financial institution assumes responsibility towards another party.

The decision illustrates that a duty of care must be established from the actual relationship, undertaking and circumstances rather than assumed merely because one party possesses specialist expertise.

Application to autonomous certification:

An organisation that markets itself as an independent AI trustworthiness assessor may assume responsibilities through the specific services and assurances it provides.

However, the existence and extent of its duty depend on the facts and the scope of its undertaking.

Importance: This decision is useful for evaluating the relationship between certification expertise, reliance and professional responsibility.

eLitigation+2

Case 7. Deloitte & Touche LLP v Hin Leong Trading (Pte) Ltd (in compulsory liquidation) [2026] SGCA 33

COURT OF APPEAL · 2026

Facts and legal issue:

This recent decision concerned claims against a company's former auditor arising from substantial trading losses and alleged failures relating to financial reporting and auditing.

Judgment and principles:

The Court of Appeal revisited the foundations of negligence in Singapore and articulated a structured approach involving:

Actionable damage.

Duty of care.

Breach of duty.

Factual causation.

Legal responsibility.

The absence of an applicable defence.

The decision emphasises that negligence claims must be analysed through established legal requirements rather than an unnecessarily expanded collection of overlapping doctrines.

Application to autonomous certification:

A claimant alleging negligent AI certification should identify the actual damage, the duty undertaken by the certifier, the particular verification failure and the causal connection between that failure and the loss.

Merely proving that an autonomous system failed after certification will not automatically establish the certifier's liability.

Importance: This is a particularly useful modern authority for structuring professional certification negligence claims in Singapore.

eLitigation+1

Case 8. Ma Hongjin v Sim Eng Tong [2021] SGHC 84

HIGH COURT · 2021

Facts and legal issue:

The case addressed the legal requirements of negligent misrepresentation.

Judgment and principles:

The court identified the essential elements of negligent misrepresentation:

A false representation of fact.

Actual reliance by the claimant.

A duty to exercise reasonable care.

Breach of that duty.

Damage caused by the breach.

Application to autonomous certification:

If a certification organisation falsely represents that an AI system has passed independent fairness and security testing, a claimant who actually relied on that representation may potentially bring a negligent misrepresentation claim, subject to proving all the required elements.

Importance: This decision is directly relevant to false or careless trustworthiness representations.

laws.sg+1

5. Statutory and regulatory responsibilities

A. Personal Data Protection Act 2012

The PDPA establishes obligations concerning the collection, use, disclosure and protection of personal data.

For autonomous certification systems, organisations should ensure that:

Personal information used in testing is appropriately protected.

Data-processing arrangements satisfy applicable requirements.

Personal data is not improperly disclosed.

Security safeguards are appropriate.

Accountability for data handling is clearly allocated.

A certification report cannot replace the organisation's own statutory compliance obligations.

B. Consumer Protection (Fair Trading) Act 2003

This legislation may apply where a supplier makes misleading or deceptive representations to consumers.

For example, a technology company advertising an AI system as independently certified and completely secure, when no such independent assessment exists, may face consumer protection consequences.

C. Misrepresentation Act 1967

Section 2(1) is particularly relevant to contractual claims involving misrepresentations.

Where an actionable misrepresentation induces a party to enter into a contract, the representor may face statutory liability unless it establishes the statutory defence.

This may apply where an organisation purchases an autonomous platform based on false certification statements.

D. Protection from malicious and deceptive digital practices

Other relevant legal frameworks include:

Computer Misuse Act 1993, where unauthorised computer access or related prohibited conduct occurs.

Cybersecurity Act 2018, where applicable cybersecurity obligations arise.

Applicable professional and sector-specific regulatory requirements.

These statutes do not establish a universal trustworthiness certification liability regime, but they may create additional obligations depending on the circumstances.

6. Different forms of civil liability

7. Civil remedies available in Singapore

Depending on the legal cause of action and evidence, affected parties may seek:

1. Compensatory damages

Compensation for financial losses caused by negligent certification, subject to causation, remoteness and other applicable requirements.

2. Contractual damages

A purchaser may claim damages where the certification organisation fails to fulfil its contractual obligations.

3. Rescission

A contract induced by actionable misrepresentation may, where legally available, be rescinded.

4. Injunctions

A court may grant appropriate injunctive relief to prevent continuing wrongful conduct.

5. Declaratory relief

A claimant may seek a declaration concerning contractual rights, obligations or the legal consequences of disputed certification representations.

6. Regulatory complaints

Depending on the subject matter, complaints may be made to relevant Singapore authorities, including the Personal Data Protection Commission or the Cyber Security Agency of Singapore.

8. Defences available to certification organisations

Certification organisations may rely on several legal defences.

Absence of duty of care: The claimant was not within the class of persons to whom the certifier owed a duty.

Absence of reliance: The claimant did not actually rely on the disputed certification.

Reasonable professional conduct: The assessment complied with the applicable standard of reasonable professional care.

Causation: The claimant's loss was not caused by the alleged certification failure.

Contractual limitations: Valid contractual exclusions or limitations may restrict liability, subject to applicable legal controls.

Contributory negligence: The claimant's own negligence may reduce damages where the defence is available.

Scope limitations: The certificate expressly covered only particular tests, conditions or operational environments.

Importantly, a disclaimer does not automatically protect a certifier against negligence, fraud or every form of statutory liability.

9. Emerging legal challenges

Autonomous trustworthiness certification raises several developing legal questions.

A. Algorithmic accountability

Courts may need to determine whether a certification organisation adequately investigated algorithmic bias, discriminatory outcomes and unreliable decision-making.

B. Continuous certification

Traditional certificates often assess a system at a particular point in time. Autonomous systems can change through software updates, retraining and changing operational environments.

This creates questions concerning:

Continuing monitoring.

Reassessment after major updates.

Disclosure of newly discovered vulnerabilities.

Suspension of outdated certification.

Responsibility for post-certification failures.

C. Multiple-party liability

A single autonomous system may involve a developer, data provider, certification body, cloud service provider and operational organisation.

Determining which party caused the damage requires examining each party's actual responsibilities and contribution to the loss.

D. International certification

Singapore-based technology companies may obtain certifications from foreign organisations and deploy their systems internationally.

This creates additional questions concerning contractual jurisdiction, applicable law, recognition of foreign certifications and cross-border enforcement.

E. Human oversight

Certification of an autonomous system should not be treated as a substitute for appropriate human supervision.

Where organisations delegate important decisions to automated systems, their own responsibilities must still be assessed independently.

10. Recommendations for strengthening Singapore's legal framework

Singapore could strengthen trustworthiness certification governance through the following measures:

1. Certification accreditation: Establish clear qualification and independence requirements for organisations conducting high-risk AI assessments.

2. Mandatory disclosure: Require transparent disclosure of certification scope, testing methodology and material limitations where appropriate.

3. Continuous monitoring: Introduce reassessment requirements for significant system modifications and newly discovered vulnerabilities.

4. Professional accountability: Develop clearer standards of reasonable care for independent AI auditors and certification professionals.

5. Consumer protection: Strengthen safeguards against false claims concerning AI safety, fairness and trustworthiness.

6. Liability allocation: Encourage clear contractual allocation of responsibilities among developers, certifiers and system operators.

7. Independent verification: Promote technically independent testing rather than exclusive reliance on developer-provided information.

8. Accessible remedies: Ensure that individuals and organisations harmed by misleading or negligent certification can pursue appropriate legal remedies.

11. Conclusion

Autonomous Trustworthiness Certification Liability in Singapore is an emerging area of civil-law application involving the intersection of professional negligence, contractual responsibility, technological accountability and consumer protection.

Although Singapore does not currently have a standalone statutory regime specifically governing civil liability for autonomous trustworthiness certification, established legal principles provide a substantial foundation for resolving these disputes.

The most important judicial authorities are Spandeck Engineering, JSI Shipping, PlanAssure PAC v Gaelic Inns, Standard Chartered Bank v Coopers & Lybrand, Deutsche Bank v Chang Tse Wen and Deloitte & Touche v Hin Leong Trading.

Together, these decisions help establish the principles of reasonable professional care, legal proximity, reliance, verification, causation and recoverable damage.

The central legal principle is that certification is not an absolute guarantee of technological perfection. Nevertheless, an organisation that undertakes to certify an autonomous system must exercise the reasonable care required by its contractual, professional and legal responsibilities.