Opening Address by SMS Tan Kiat How at GovTech STACK Conference 2026 Day 2

Good morning, everyone.

Before I start, a very warm congratulations to GovTech and GovTech colleagues on your significant milestone – 10 years of public good, and it has been an amazing journey over these 10 years.

Almost 30 years ago, I accepted a Singapore Government scholarship from the National Computer Board to study computer engineering.

Back then, Singapore was building the digital foundations of a country determined to compete, connect and serve its people better.

I have witnessed successive waves of change since. Technologies and skills have evolved, but our purpose remains unchanged: To improve lives and make Singapore work better.

Today’s national platforms and essential services were built across generations of engineers, designers, cybersecurity professionals, operations teams and public officers.

Many of you here today, helped build them. Your work matters even more today.

AI is changing what machines can do and how work is organised.

Today, I want to discuss how we transform boldly with human accountability, build secure and resilient systems, and develop the people who will shape Singapore’s technological future.

Transform boldly, with human accountability

For the past few years, we have focused on how AI can assist us, from answering questions and writing code to assisting us when drafting speeches. Increasingly, AI is moving beyond assisting us to taking actions on our behalf.

Agentic AI can now plan, use tools and access systems to carry out more complex workflows. By taking on routine tasks, it could free ou officers to focus on complex cases and better serve Singaporeans. More importantly, it creates opportunities to rethink how public services are designed and delivered, rather than simply automating existing tasks.

actions have consequences. An assistant that drafts a wrong message is different from an agent that sends it. Recommending a payment is different from making one. We must therefore be clear about which actions an agent is authorised to take, which tools it may use, and when a person must approve its actions.

These principles are reflected in IMDA's Model AI Governance Framework for Agentic AI, which provides organisations with structured guidance on managing the risks of agentic AI deployment.

GovTech has considered how to translate these principles into concrete technical requirements for the whole of government, covering human oversight, permissions management, tool access, testing, and monitoring.GovTech’s Agentic Risk and Capability, or ARC, Framework connects an agent’s capabilities to appropriate safeguards. For higher-risk actions, including financial transactions, official communications and data deletion, stronger controls such as human approval are needed.

The Standard will also guide Desk, GovTech’s secure personal digital assistant for public officers, as it develops more agentic capabilities. It will help determine which actions canproceed automatically and which require human approval.

Besides the Government, businesses deploying agents for customer service or internal operations face these choices too. The goal is neither maximum autonomy nor maximum control. It is to give AI room to act within clear boundaries, while people and organisations remain accountable for the outcomes.

Trust must extend across the workflow

Defining an agent’s authority is only the first step. Once agents operate across applications and tools, we also need to understand what they actually do.

If an agent produces an unexpected result, can we retrace its steps? Which information did it retrieve? Where did something go wrong? A trustworthy model does not automatically make a trustworthy system.

We need to evaluate the deployed workflow, monitor agent behaviour and investigate errors as applications change. This is particularly important when several agents and tools work together.

To this end, GovTech is developing GovHarness as shared infrastructure for building and operating AI agents across Government. It supports deployment, connections to tools, and capabilities for monitoring and evaluation. GovHarness will also include common guardrails and evaluations. Instead of every team rebuilding its own monitoring and testing arrangements, these shared capabilities can help developers observe agent actions, identify unexpected behaviour and improve how their applications perform.

The same challenge arises in enterprises connecting agents to multiple business applications. Trust must extend beyond the model to the workflow around it. We need to know not only what agents are allowed to do, but whether they are doing it as intended.

Cybersecurity and operational resilience are essential

But even well-governed agents depend on a much larger digital environment. If the underlying services are vulnerable or unreliable, the applications built on them will be too.

I can help defenders find vulnerabilities faster, but it can also help attackers move faster. Agentic systems introduce additional risks through their permissions and connections.

Secure development, least-privilege access, monitoring and incident response must remain essential.

Not every disruption is a cyberattack. An expired certificate, an outdated security key, a misconfiguration or an overlooked dependency can also disrupt an essential service. As systems become more interconnected, a small failure can have wider, and more serious consequences.

We therefore need to understand dependencies, test recovery, monitor failures and have clear procedures for incident response. Cybersecurity protects against threats; resilience helps services withstand disruption, and more importantly, recover. Both matter to the Government and to businesses whose customers depend on their systems.

As digital public services become even more central to everyday life, Singaporeans must be able to depend on them. Our ambition is therefore to build more intelligent systems, and this must therefore be matched by an equally strong commitment to reliability and resilience.

Make the scure path the easy path

As we strengthen the security and resilience of our digital systems, we must also make it easier for more people to innovate safely. AI-assisted development is already enabling officers without traditional software-engineering expertise to build applications that address problems they encounter at work.

But building quickly is not the same as deploying safely. We cannot expect every officer to become an expert in hosting, authentication and cybersecurity just to test an idea. The answer is not to lower our standards. It is to build those standards into the platforms people use.

Rabbit Deploy, a GovTech provided platform, provides a Government-managed way for officers to deploy and test AI-assisted applications. With gov.sg (opens in new tab) hosting, Government single sign-on, logs and continuous security scanning built into the pathway, officers can now focus on whether their application solves a real problem.

Today, Rabbit Deploy supports over 8,000 users across 90 agencies, with over 5,000 active applications on the platform. This shows how a common, secure platform can enable more officers to build and deploy solutions to improve their work. We believe that our officers, especially those at the frontline, would know what the problems are. Therefore, we want to give them the tools and environment to experiment, innovate and come up with solutions to their pain points.

Take Integrated Treasury, an application built by a finance officer using AI-assisted development and deployed on Rabbit Deploy. It reduced the time needed to consolidate information from 14 sources, from 12 hours to just one hour a month; saving over 130 staff-hours a year. That is significant.

The important point is not just the time saved. The person who understood the problem could help build the solution, with shared infrastructure making it easier to test safely.

GovTech’s role is therefore not only to deliver projects, but to build reusable platforms and retain deep expertise in engineering, design, product, cybersecurity and AI. Developing and operating these foundations also strengthens the technical capability that Singapore needs.

Technological sovereignty begins with our people

While we can procure technology from around the world, we must also have the people and expertise to understand, adapt, secure and operate it. This brings me to an important point: technological sovereignty.

Debates about sovereignty often focus on where data sits, where computing power comes from, or whether we own particular models and infrastructure. Those choices matter. But sovereignty is also about people and expertise.

Singapore benefits from global technology companies and research ecosystems. We cannot, and should not, build everything ourselves. Yet without people who can assess, manage and operate these technologies, our choices will become more limited.

Our strongest foundation is not simply the infrastructure we own. It is the people we develop. Capability is built through difficult design decisions, debugging, responding to incidents and learning from more experienced colleagues. These experiences develop judgement.

AI creates a new challenge. If AI writes much of the routine code, how will a junior engineer learn to recognise poor architecture? If AI flags vulnerabilities, how will a security professional learn to investigate an unusual signal?

We should automate the task, not the learning. That requires more than just training courses.We need strong foundations in engineering, architecture, data and cybersecurity, alongside AI fluency. We must design work that preserves opportunities to review consequential decisions, learn from failures and receive mentorship.

We also need multidisciplinary teams, clear ownership of outcomes and a culture that values reliability and technical depth as much as speed. These responsibilities apply to technology leaders in Government and industry alike.I know change can be difficult and personal. Some colleagues will be uncertain about their roles and careers. Leaders must explain why change is needed, treat people with dignity and provide credible opportunities to learn. Experience and institutional knowledge do not lose their value when technology changes. We must build a culture that values experience and embraces the future, while providing pathways for organisations to change. Leaders must walk the talk, and that applies to all organisations that use technology in their daily operations, whether in the Government or private sector.

To the engineers, developers, operations teams and cybersecurity professionals here: much of your most important work may never make the headlines.

A vulnerability prevented, an incident contained, a service people can depend on. These contributions matter – all your work matter as we increasingly become more interconnected, with our economy and society relying on digital technologies, especially AI.

Singapore as a place where trusted innovation works

The expertise we build in Government also matters beyond Government. Many organisations face similar questions about safe AI deployment, resilience and human responsibility.

In healthcare, for example, AI that summarises a record is different from AI that recommends care or initiates an action. The more consequential the task, the more important the boundaries, monitoring and human oversight.

Singapore can bring policymakers, technologists, researchers, agencies and industry together around demanding real-world problems. We can translate governance principles into engineering practice, demonstrate what works and share lessons across sectors.

To our international technology partners and guests here today, we look forward to deepening our collaboration beyond bringing new technologies to Singapore, to working alongside our public officers and engineers to develop solutions that address real-world challenges.

Conclusion

Almost 30 years ago, I chose computer engineering because I believed technology could help build a better Singapore. I still do. But technology alone is never enough. It takes people who understand it: people who can build and secure complex systems, exercise judgement, take responsibility and help the next generation develop the same expertise.

The generations before us built Singapore’s digital foundations. We must build on these foundations, harnessing AI to create real value for our businesses and good jobs for our workers, while keeping our systems secure, resilient and worthy of public trust.

The next chapter of Singapore’s digital future will not be built by technology alone. It will be built by people like you.

I wish you all the best and have a wonderful conference. Thank you, everyone.