A generative AI model that hallucinates a fact is not purely a model problem. It is a responsibility question, and ASEAN's regulators have now answered it in writing. What is the responsibility of developers using generative AI comes down to this: developers are accountable for the controls they have the technical ability to apply, data quality, safety testing, security by design, while deployers and enterprises carry responsibility for how the system is actually used. This guide breaks down what that split means in practice across ASEAN.

What is the responsibility of developers using generative AI: 

Developers using generative AI are responsible for data quality, safety testing, security by design, and transparent disclosure of model capabilities and limitations, based on the level of control they hold over the system. Singapore's IMDA and AI Verify Foundation, in their Model AI Governance Framework for Generative AI, explicitly assign accountability based on each stakeholder's degree of control, meaning model developers, application deployers and cloud service providers each carry different obligations. ASEAN's own Expanded Guide on AI Governance and Ethics, Generative AI, published January 2025, extends this to six specific generative AI risks that enterprises across the region need developers to address directly.

What is the function of artificial intelligence in assigning developer responsibility?

The function of artificial intelligence in an enterprise determines who is responsible when something goes wrong, since responsibility follows control, not job title.

A legal framework meaning relevant here is this: regulators increasingly define responsibility by what a stakeholder can technically control, not by who built the underlying base model originally.

Which statement accurately reflects the application of responsible AI practices is a question ASEAN's frameworks answer directly, responsibility is layered across model developers, application deployers, cloud service providers and the enterprise deploying the system, not concentrated in one party.

For a broader breakdown of how this applies specifically to generative AI, see AI governance for generative AI and AI governance for GenAI adoption.

Ready to Scale AI? Start with a Free Assessment

Why this matters now for ASEAN enterprises

Three developments make this an active compliance question in 2026, not an abstract ethics debate.

• Singapore's framework explicitly assigns accountability by control. The IMDA and AI Verify Foundation's Model AI Governance Framework for Generative AI, finalised 30 May 2024, states directly that responsibility is assigned based on the level of control each stakeholder, model developers, application deployers and cloud service providers, has over generative AI development.

• ASEAN has formally named six generative AI risks developers must help address. The Expanded ASEAN Guide on AI Governance and Ethics, Generative AI, launched at the fifth ASEAN Digital Ministers' Meeting in January 2025, identifies mistakes and anthropomorphism, factually inaccurate responses and disinformation, deepfakes and fraudulent activity, intellectual property infringement, privacy and confidentiality, and embedded bias as the six risks enterprises operating across the region must manage.

• These frameworks build on an existing regional foundation. ASEAN's base Guide on AI Governance and Ethics, released February 2024, already established layered governance structures proportionate to AI risk, which the generative AI specific guidance extends directly.

See how this connects to broader governance automation in AI governance as code and the fuller 2026 picture in AI governance framework 2026.

A framework for mapping responsibility to the six ASEAN GenAI risks

Here is how developer responsibility maps against each named risk, and what enterprises deploying the resulting system need to own separately.

1. Mistakes and anthropomorphism. Developers are responsible for disclosing model limitations clearly. Enterprises are responsible for not presenting the system as more capable or human like than it is.

2. Factually inaccurate responses and disinformation. Developers own model testing and evaluation rigor. Deployers own human review for high stakes outputs, since no current evaluation method fully eliminates hallucination risk.

3. Deepfakes, impersonation and fraudulent activity. Developers own security by design, input moderation and malicious use safeguards. Enterprises own monitoring for misuse within their own deployment.

4. Intellectual property infringement. Developers own training data provenance where they control it. Enterprises own usage policy for generated content within their own business.

5. Privacy and confidentiality. Both parties share this, developers through data quality and privacy enhancing techniques, enterprises through how customer data actually flows into prompts.

6. Embedded bias. Developers own testing for bias in training data and outputs. Enterprises own monitoring for bias in how the system is actually applied to real decisions. AI security and compliance services support enterprises building this monitoring layer directly.

Samta.ai's Veda platform and the Veda AI decision analytics product support the enterprise side of this split directly, keeping generative AI outputs traceable to source data, acting as the engineering execution layer once the governance responsibilities themselves are clearly assigned. Digital transformation managed services support the ongoing operational side of this once deployed.

Comparing five stakeholder responsibilities under ASEAN and Singapore frameworks

Stakeholder	Primary responsibility	Key controls	Framework reference	Risk if neglected
Model developer	Data quality, safety testing, security by design	Bias testing, content moderation, security safeguards	IMDA Model AI Governance Framework, Accountability dimension	Model level failures propagate to every downstream deployer
Application deployer	Appropriate use, human review, disclosure to end users	Usage policy, human in the loop review, output monitoring	IMDA Model AI Governance Framework, Trusted Development and Deployment	Misuse within one enterprise's specific context
Cloud service provider	Infrastructure security, access control	Platform level security controls	IMDA Model AI Governance Framework, Security dimension	Infrastructure level breach affecting all tenants
Enterprise end user organisation	Business context, policy, monitoring in production	Internal AI governance policy, incident reporting	ASEAN Expanded Guide, Generative AI risk categories	Business specific harm from unmanaged deployment
Regulator or policymaker	Setting the framework itself, reviewing adequacy	Guidelines, consultation processes, enforcement where applicable	ASEAN Guide on AI Governance and Ethics, 2024 base	Regulatory gaps leaving harm unaddressed

The first two rows are where most enterprise confusion sits, since many organisations assume a vendor's model level testing covers their own deployment risk entirely. For a platform level comparison relevant to the enterprise monitoring layer, see Veda versus a general Data Intelligence Platform.

Discover Where Your AI Models Are Most Exposed

Real world use cases

Regulated industry angle: financial services deploying a GenAI customer assistant

A financial services firm deployed a generative AI assistant built on a third party model to answer customer questions. The firm assumed the model vendor's own safety testing fully covered the deployment, until a review found the assistant occasionally generated confident but incorrect answers about specific product terms. Applying the ASEAN framework's risk categories directly, the firm added disclosure that responses were AI generated and built a human review path for any answer touching specific contractual terms, closing the gap between developer level testing and deployment level risk. See related delivery patterns in Samta.ai's case studies.

General enterprise: internal content generation tool with no usage policy

A manufacturer gave staff access to a generative AI writing tool with no internal policy on what content it could be used for. An employee used it to draft external facing material that inadvertently echoed a competitor's proprietary language, an intellectual property risk the underlying model's own training data controls could not have prevented. A clear internal usage policy, separate from whatever the model developer had already done, closed this gap directly, since this risk sat squarely in the enterprise's own responsibility layer.

Key risks and failure modes

• Assuming model level testing covers deployment level risk. A model that passed developer testing can still be misused or misapplied within a specific business context.

• Treating all six ASEAN GenAI risks as equally relevant. Different use cases carry different risk weightings, a customer facing chatbot carries more disinformation risk than an internal drafting tool.

• No clear internal usage policy for generative AI tools. Staff given access without guardrails create risk the model developer never controlled in the first place.

• Ignoring the cloud service provider layer entirely. Infrastructure security sits outside both developer and deployer control, and needs its own explicit ownership.

• Confusing voluntary guidance with binding regulation. Both the ASEAN guides and Singapore's Model AI Governance Framework for Generative AI are voluntary, best practice frameworks, not enforceable law, which does not reduce their practical value for enterprise risk management.

• No incident reporting process when something does go wrong. Both frameworks expect organisations to have a defined escalation path, not just preventive controls.

When to apply this responsibility framework, and how deeply

Apply it rigorously if:

• Your generative AI deployment is customer facing or touches regulated business decisions

• You operate across multiple ASEAN markets with varying local expectations

• You rely on third party base models and have not separately assessed your own deployment risk

• A prior incident or near miss has already surfaced a gap in usage policy

A lighter approach may be enough if:

• Your generative AI use is purely internal, low stakes drafting or summarisation

• You are in early pilot stage with a small, controlled user group

• No customer data or regulated content flows through the system

Need Help Scaling AI Across Your Enterprise?

Conclusion

Responsibility for generative AI does not sit with one party. It follows control, and both ASEAN and Singapore have now written down exactly where that control sits for developers, deployers and the enterprises using the output. Map your own deployment against the six risk categories above, and assign ownership explicitly rather than assuming it is already covered. The next step is finding out exactly where your own gap sits.

About Samta

Samta.ai is a Singapore-headquartered AI Product Engineering & Data Intelligence partner helping enterprises build production-grade AI systems for regulated and data-intensive environments.We help organizations move beyond experimentation by engineering scalable, explainable, and enterprise-ready AI solutions from data foundations and model development to workflow automation and deployment.

Our capabilities combine deep AI expertise, data engineering, and product engineering to deliver measurable business impact across FinTech, BFSI, cybersecurity, regulatory technology, and enterprise operations.

Our enterprise AI products power real-world intelligence systems:

• TATVA : AI-driven data intelligence platform for governed analytics, monitoring, and operational insights

• VEDA : Explainable and audit-ready AI decisioning engine built for compliance-sensitive enterprise workflows

• CORA-Property Management Solutions: : Predictive intelligence platform for real-estate pricing, portfolio optimization, and investment analytics

Backed by ecosystem partnerships with Microsoft, Databricks, Snowflake, and AWS, Samta.ai delivers agile, cost-efficient AI engineering with faster turnaround and enterprise-grade scalability. Trusted by enterprises across FinTech, BFSI, and digital transformation initiatives, Samta.ai embeds AI governance, data privacy, and compliance-by-design principles directly into the AI lifecycle , enabling organizations to scale AI with transparency, accountability, and operational control. 

Enterprises leveraging Samta.ai automate 65%+ of repetitive data, analytics, and decision workflows while maintaining governance, explainability, and measurable business outcomes. Samta.ai provides the strategic consulting, AI engineering, and data modernization expertise needed to align enterprise operations with next-generation AI transformation goals.

Frequently asked questions

1. What is the responsibility of developers using generative AI?

   Developers are responsible for the controls within their technical control, data quality, safety testing, security by design, and clear disclosure of model capabilities and limitations. Singapore's IMDA and AI Verify Foundation explicitly assign this responsibility based on the level of control each stakeholder holds, meaning developers are not responsible for every downstream use of the system they build.

2. What does fair and responsible AI for consumers actually require?

   It requires that consumers understand when they are interacting with AI, that the system does not produce discriminatory outcomes due to embedded bias, and that privacy and data protection laws are respected throughout. ASEAN's frameworks tie this directly to testing for bias in training data and outputs, combined with clear disclosure to end users that they are interacting with a generative AI system.

3. What is the regulatory framework and legal issues in business around generative AI in ASEAN?

   ASEAN currently relies on voluntary guidance rather than binding regional law, specifically the Guide on AI Governance and Ethics (2024) and its Expanded Guide for Generative AI (2025). Individual member states, including Singapore through IMDA, layer their own frameworks on top. Businesses operating across the region should treat these as practical risk management tools even though most carry no direct legal enforcement mechanism yet.

4. What is the role of artificial intelligence in business responsibility structures?

   Artificial intelligence does not remove responsibility, it redistributes it across the chain of parties who touch the system, model developers, application deployers, cloud service providers and the business using the output. The role of AI in this structure is as a tool whose risks must be actively managed at each layer, not a system that absolves any single party of accountability.

5. What can artificial intelligence do that shifts responsibility to developers specifically?

   Generative AI can produce confident sounding but factually incorrect output, generate content that resembles real people or organisations, and reflect biases present in its training data, all of which sit primarily within developer control to test for and mitigate. What AI cannot do is guarantee correct use once deployed, which is why enterprise level responsibility remains separate and necessary.