What people say they value vs. what they do

privacy and bias were still edge cases.

in 2019 they were treated as problems for later, and nobody was designing for them. imda wanted to locate the gaps between awareness and practice, and the cultural and organisational reasons they persisted.

we talked to the people building it.

middle and senior stakeholders at companies developing or deploying ai, the ones making the calls on data and models. we mapped where privacy and bias risks sat, and paid attention to what "fairness" meant in different rooms.

1. week 1
   Sampling framemapped companies developing ai against companies deploying it, across sectors and sizes, so no single industry dominated.
2. weeks 1 to 4
   Recruitmentthe hardest stretch. our vendor handled outreach, but senior stakeholders sit behind gatekeepers, so it still took a lot of follow-ups and careful assurances on confidentiality.
3. week 2
   Discussion guidereviewed with imda and stripped of anything that sounded like an audit, so people would speak candidly instead of defensively.
4. weeks 3 to 6
   In-depth interviewsmostly one-to-one, so nobody had to perform for a colleague or a superior.
5. weeks 6 to 8
   Coding & reportingcoded each interview against a map of where privacy and bias risks sat, and wrote up the gap between knowing and doing.

most companies knew about the risks and did very little.

privacy was a compliance checkbox. bias got caught after the fact, if at all. many companies didn't realise their datasets were skewed until the damage was done.

it fed into the model ai governance framework.

the research was part of the context for singapore's model ai governance framework, first published in 2019 and since extended to generative ai (2024) and agentic ai (2026). it also showed that regulation alone was insufficient. companies needed education and a shared way to talk about responsibility before something went wrong.