Part of the AI Regulation News hub.
Singapore's MDDI and IMDA opened a three-week public consultation on a draft Digital Infrastructure Bill that would license large data centres and major cloud services.
The thresholds are the whole story. A ten megawatt critical IT load and a hundred million Singapore dollars of annual local revenue are the two numbers that decide whether a provider is inside this regime or outside it.
Bottom line: A consultation on a draft Bill. It binds nobody. MDDI and IMDA state plainly that the document and the draft Bill are released only for consultation and do not represent the final legislation.
Who this affects: General counsel, regulatory affairs leads and heads of infrastructure at data centre operators, colocation providers and IaaS and PaaS cloud providers serving users in Singapore.
Issue date: 1 July 2026. Submissions were due within three weeks, no later than 22 July 2026 at 10am, and MDDI and IMDA reserved the right to reject late submissions.
What changed: Two new licensing regimes are proposed: a major FDI licence for security and resilience, and a separate DC licence aimed at environmental sustainability. Related amendments would align definitions in the Cybersecurity Act 2018 and the Cybersecurity (Amendment) Act 2024.
Analysis: SaaS is expressly carved out of the major FDI service definition. That looks like scoping, but it draws a line straight through the AI supply chain: the model API you buy may sit inside the regime as PaaS while the application built on top of it sits outside.
Primary sources: MDDI consultation, 1 July 2026 · Annex A, draft Digital Infrastructure Bill (PDF)
- Instrument (EN)
- Draft Digital Infrastructure Bill
- Authority
- Ministry of Digital Development and Information (MDDI) with the Infocomm Media Development Authority (IMDA)
- Jurisdiction
- Singapore
- Status
- Public consultation on a draft. Not introduced as final legislation.
- Bindingness
- None. The consultation states the draft does not represent the final legislation.
- Issue date / next deadline
- 1 July 2026. Submissions closed 22 July 2026 at 10am.
- Licence thresholds
- DC facility service in a data centre with critical IT load of 10MW or more serving unrelated parties; cloud computing service with Singapore revenue of S$100 million or more per year averaged over three preceding years
- Second licence
- DC licence for operators of data centres with critical IT load of 3MW or more
- Primary source
- https://www.mddi.gov.sg/newsroom/public-consultation-on-digital-infrastructure-bill/
Two licences, two different purposes
The Bill would create a major FDI licence and a DC licence, and they are not aimed at the same problem. The first is about security and resilience. The second is about energy and water.
A major foundational digital infrastructure service is defined by two conditions together: loss or impairment of the service is likely to cause widespread disruption or deterioration of the operations of businesses or organisations in Singapore, and the service is specified in the Schedule.
The Schedule would specify two things. A DC facility service provided in a data centre with a critical IT load of at least 10MW that serves parties unrelated to the operator, meaning cloud and colocation facilities. And a cloud computing service generating at least S$100 million a year from users in Singapore averaged over the three preceding years, falling within IaaS or PaaS but not SaaS.
What a major FDI licensee would owe
Three duties are set out. Implement processes and measures for the security of the service, including physical security and cybersecurity. Implement business continuity and disaster recovery plans for timely resumption after interruptions. Notify IMDA when a cybersecurity incident or a service delivery disruption occurs.
The detail would not live in the Act. MDDI and IMDA say requirements and practices would be set out in regulations and codes of practice, taking reference from the published Advisory Guidelines for Resilience and Security of Cloud Services and DCs.
That structure is worth flagging to anyone modelling compliance cost. The Bill sets the perimeter; the obligations that actually bite would arrive later in instruments not yet drafted.
The sustainability licence and what IMDA would weigh
The DC licence catches a wider set of facilities, at 3MW rather than 10MW. An operator running a data centre that also provides a specified DC facility service would need both licences, though IMDA says it would streamline a combined application.
In assessing an application, IMDA would look beyond experience and capability to the energy efficiency and water efficiency of the data centre. It may also consider the characteristics of the energy sources, including renewability and the extent of greenhouse gas emissions from generating the electricity used, and the economic or strategic importance of the applicant's business operations to Singapore.
Licensed operators would have to meet facility-level power usage effectiveness requirements. The Bill would also let IMDA set future requirements on IT equipment energy efficiency and facility-level water efficiency, with consultation before finalising them.
Powers, penalties and the definitional tidy-up
IMDA would administer the Act and hold four sets of powers: granting, renewing, suspending, revoking and conditioning licences; issuing codes of practice and directions, including directions requiring compliance with an applicable code; imposing financial penalties for non-compliance in appropriate cases; and enforcement and investigation carried out by IMDA enforcement officers.
The consultation also flags related amendments to the Cybersecurity Act 2018 and the Cybersecurity (Amendment) Act 2024, aligning the definitions of foundational digital infrastructure service and data centre facility service. MDDI and IMDA describe the reason as consistency between regulatory frameworks.
For counsel tracking Singapore, that alignment is the connective tissue. The same facilities are being approached from two directions, cybersecurity through CSA and operational resilience plus sustainability through IMDA, and the drafters are making sure the two regimes at least mean the same thing by the same words.
What we did not verify
We opened the MDDI consultation notice of 1 July 2026 in full, including its footnote defining critical IT load.
We did not open Annex A, the draft Bill itself, nor the Green DC Roadmap, the Advisory Guidelines for Resilience and Security of Cloud Services and DCs, the DC Call For Application materials, or any of the submissions received. Everything here comes from the consultation notice.
We will not say what the final legislation will contain, whether the thresholds will survive, or when the Bill will be introduced. The notice gives no introduction date and states expressly that the draft does not represent the final legislation. We also do not know the outcome of the consultation, which closed on 22 July 2026.
Thresholds in a draft are still the cheapest thing to model against, because they tell you which side of a regime you would sit on if the draft survives. Run your Singapore critical IT load against 3MW and 10MW, and your Singapore cloud revenue against the three-year S$100 million average, before the licence application process exists. If you sell SaaS built on someone else's PaaS, note that the regulated party in this draft is your supplier, not you.
Source File
https://www.mddi.gov.sg/newsroom/public-consultation-on-digital-infrastructure-bill/
Open the MDDI consultation notice dated 1 July 2026 and confirm paragraph 7 sets the 10MW critical IT load and S$100 million cloud revenue thresholds and excludes SaaS, paragraph 10 sets the 3MW DC licence threshold, and paragraph 16 gives the 22 July 2026 10am submission deadline.
Please note that the information in this document and the draft Bill are being released only for the purpose of consultation and does not represent the final legislation. ยท MDDI and IMDA, 1 July 2026
FAQ
Is the Digital Infrastructure Bill law?
No. It was published in draft for a three-week public consultation that ran from 1 July 2026 to 22 July 2026. MDDI and IMDA state the draft does not represent the final legislation.
Which cloud services would be caught?
Under the draft, an IaaS or PaaS service with revenue from users in Singapore of at least S$100 million per year averaged over the three preceding years. SaaS is expressly excluded from the major FDI service category.
Would a data centre operator need one licence or two?
An operator of a data centre with a critical IT load of at least 3MW would need a DC licence. If it also provides a specified DC facility service, it would need a major FDI licence as well, with a streamlined combined application process.
What powers would IMDA gain?
The consultation lists licensing powers, the power to issue codes of practice and directions, the power to impose financial penalties for non-compliance in appropriate cases, and enforcement and investigation powers for IMDA enforcement officers.
Related briefings
Sponsored Training
Practical AI training for regulated professionals, built around verification, documentation and a defensible process. See the courses.