Singapore's Cybersecurity Strategy 2026 sets out a Government plan to use AI for cyber defence, issue secure-AI guidance and move critical systems to quantum-safe cryptography

Key takeaways

• The strategy says "AI is no longer optional but essential in cyber defence."
• The Government says it will invest in AI harness engineering, and not in developing frontier AI models.
• CSA will develop practical secure-AI guidance, and the Government will develop baseline security requirements; the strategy gives no date for either.
• The strategy says the Government has issued CII owners three quantum-safe milestones, the first due by 31 March 2027.

Is the Cybersecurity Strategy 2026 binding, and who issued it?

The strategy does not present itself as a rule. The Cyber Security Agency of Singapore (CSA) publishes it as a national strategy that, in its own description, "sets out Singapore's approach" to national cyber defence, the wider cyberspace, emerging technologies and the cybersecurity workforce. It sets four strategic pillars and two enablers. Our reading is that a strategy of this kind binds no one by itself; the document does not state its legal status, and any duty would have to come from separate legislation or instruments. For example, our article on the CSA Cybersecurity Code of Practice update covers a different CSA instrument for critical-infrastructure owners.

This piece covers only Pillar 3, "Strengthen Capabilities for AI and Quantum". The CSA page gives the publication date as 13 October 2026.

What does Pillar 3 commit the Government to on AI in cyber defence?

Three things, each stated as a Government intention. The strategy frames AI as a threat, a tool and a target, and says "AI is no longer optional but essential in cyber defence." It then says the Government will pursue three approaches: build expertise to use leading AI models securely, invest in AI harness engineering, and promote adoption of AI cyber defence tools in the wider ecosystem.

On expertise, CSA and the Government Technology Agency of Singapore (GovTech) will build expertise to evaluate, adapt and securely operate AI systems for cybersecurity. On harnesses, the strategy defines an AI harness as the software, workflows and orchestration layers that turn AI models into operational cyber capabilities, and says: "Rather than investing in developing frontier AI models", the Government will focus on securely deploying, integrating and operating the best available models. On ecosystem adoption, the Government says it will lead by example, and that support for wider adoption would give priority to Critical Information Infrastructure (CII) owners. It lists funding support through initiatives such as the AI for Cyber Experimentation Sandbox, making Government-developed tools and AI harnesses available "where appropriate", publishing practical guidance, and "potentially recommending" suitable tools.

What does it say about adopting AI securely, and what is still to come?

The strategy says AI systems face threats including data poisoning and adversarial attacks, and that these risks could become more complex as agentic AI systems become more autonomous. In its overview chapter it adds that agentic systems could be manipulated to circumvent safeguards, deceive users or cause unintended actions, "outpacing AI governance".

The Government says it will "enable the secure adoption of AI by developing baseline security requirements and practical implementation guidance". CSA will develop practical guidance and implementation resources covering the development and deployment lifecycle, and Singapore will regularly review and update that guidance. The strategy gives no publication date for either item, and it does not say who the baseline security requirements would apply to. For the Government's own adoption, it says higher-risk deployments, such as those involving classified data, public-facing systems or agentic capabilities, "require stronger controls, safety testing, and guardrails".

The strategy also lists existing resources: the 2024 Guidelines and Companion Guide on Securing AI Systems, an Addendum on Securing Agentic AI published in June 2026, and TR 147, Cybersecurity Practices for Large Language Model (LLM) Applications, published in June 2026. It describes the Companion Guide's measures as controls that system owners "may consider".

What are the quantum-safe milestones and key dates?

The same pillar covers quantum. The strategy says the Government has issued guidance to CII owners setting out three milestones. It describes them as requirements that "apply specifically to CII owners", and says other organisations exposed to quantum risks are encouraged to complete migration by 2035. We did not open the guidance to CII owners, so we cannot say whether those milestones are enforceable or how.

What should CISOs and technology counsel do now?

Treat Pillar 3 as advance notice, not a compliance list.

• Read the existing resources the strategy names (the Securing AI Systems guidelines, the agentic AI addendum and TR 147) and compare them with your own AI inventory and agent permissions.
• If you own CII, check the quantum-safe milestones against your migration plan with your sector lead and CSA.
• Watch for the CSA secure-AI guidance and baseline security requirements, and record how you would map existing controls to them.
• Do not describe the strategy to clients or boards as imposing AI duties on private organisations; the strategy does not say that.

What we did not verify

What we opened: the CSA publication page and the 68-page PDF of "Singapore's Cybersecurity Strategy 2026", including Chapter 5 on Pillar 3 and the overview of the four pillars, on 25 October 2026.

What we did not open: the Guidelines and Companion Guide on Securing AI Systems, the Addendum on Securing Agentic AI, TR 147, the guidance to CII owners that sets the quantum milestones, any CII legislation, and the other pillars beyond their headings. We did not check whether any of the listed resources are binding.

What we refuse to claim: that the strategy binds any organisation, that the secure-AI guidance or baseline security requirements exist yet or have a date, or that the quantum milestones are enforceable. The reading that the strategy is non-binding is ours; the document does not state its legal status.

Related briefings

• AI Regulation News hub
• Asia-Pacific AI regulation tracker
• Attorneys and AI regulation
• CSA Cybersecurity Code of Practice update on cloud and AI threats for CII owners
• Singapore MDDI and the AI supply-chain deployer duty
• MAS agentic AI runtime safeguards for finance
• Hong Kong PCPD AI compliance check and agentic AI