Governments spent years classifying data. Now they need to classify codes too

For a long time, IT governance in the public sector was focused on data classification, labelling sensitive data, tiering them according to their importance, and then handling them accordingly. 

This system gave public agencies a framework to manage risk in the digital world. 

But artificial intelligence (AI) is now forcing governments to do a new classification exercise, this time with code. 

As AI coding agents become central to how governments build software, the question that the public sector must now tackle is how to ensure that the code remained safe. 

“We cannot do this without proper code classification,” said Government Technology Agency of Singapore (GovTech Singapore)’s Deputy Chief Executive and Chief Technology Officer, Chang Sau Sheong, at the Industry Engagement (IE) 2026 event on May 19 in Singapore. 

IE is an annual event organised by GovTech Singapore to bring together industry leaders and public sector stakeholders to share upcoming ICT procurement priorities, co-create digital services, and shape Singapore’s Smart Nation initiatives. 

When human developers wrote code, the review process for compliance, security vulnerabilities and sensitivity was a manual and linear process. 

However, with AI agents writing thousands of lines of code within minutes, the government had to have technical guardrails and governance systems in place to keep pace with these agents.  

Governance layer between human developers and AI-generated code 

Chang shared that most Singapore public agencies are currently at the stage of experimenting with AI coding assistants, which is at level 2. 

He was referencing the five levels of AI engineering, with level 1 focusing on basic code suggestions, level 2 on AI coding assistants, level 3 and 4 on agents collaborating with each other to build software, level 5 as a self-operating system.  

He highlighted that the implication of these new AI capabilities was such that the human layer had become more important than only technical engineering capability. 

Explaining what the human layer meant in practice, Chang said while the coding agents would keep changing, “the quality of what these agents generate depends on how good our prompts are and how good our context is”. 

That meant that the human layer, which included deciding what to build, how to build, and what requirements to meet, remained consequential. 

To manage these aspects, GovTech ensured that its central platform and tools provided public officers with a common and safe foundation to build on. 

For example, GovTech has built a custom plugin within their command line interface (CLI).  

The CLI allows developers to harvest relevant context across different GovTech’s environments and improve the quality of AI-generated outputs, Chang noted. 

Another tool is an AI-powered code review agent that automatically flags bugs, security vulnerabilities, and compliance issues as part of the software development lifecycle. 

These tools represented a new layer of governance sitting between human developers and AI-generated code.  

Chang said that code classification, in this context, was key to enabling these tools to work as intended. 

GovTech is also working with research labs to explore formal verification, which is a mathematical method to prove that the code behaves exactly as intended and is considered the next frontier of code assurance. 

People writing the code are changing 

Governing the code was complicated by another shift happening in parallel, which was the rise of “citizen developers”, non-technical public officers building tools using low- or no-code platforms.

“It has opened up a Pandora's box," said Chang. “Now we have people handling technology [and] they might not know what they're dabbling with.” 

Enabling these officers to build safely within proper classification and governance frameworks is now the agency’s priority.  

Even among technical developers, roles were blurring.  

Chang described a data scientist on his team who recently built an application entirely on his own, with no product manager and no developer.  

“It’s not about the number of people or the sizes [of teams]... It’s about what roles of the people are doing,” he said, underlining the impact of AI on the smaller, cross-functional team structures today. 

Moving from AI add-on to AI-native 

Beyond the individual tools or projects, Chang said that Singapore is working towards an AI-native government. 

AI is not an add-on to existing processes, but the foundation of how the government’s digital services are designed and delivered, he explained. 

Japan’s Digital Agency’s Consultant to the Minister for Digital Transformation, Takashi Asanuma, had also previously shared with GovInsider about the country’s AI-first government ambitions. 

"This is not just talk; we are talking about this from the highest level of government,” Chang emphasised. 

The formation of Singapore's National AI Council, Chang noted, signaled this commitment at the policy level. “I think that’s what is going to happen globally as well,” he noted. 

For now, this is still work in progress.  

The objective was to improve the whole-of-government infrastructure to support secure AI-assisted development at scale, train junior engineers so that they could thrive alongside AI agents, and invite private sector partners to co-create solutions on central platforms. 

You can read other articles covering GovTech Singapore here in our digital government directory.