By Joanne Waters & Wai Yue Loh
|Published 22 October 2026
On 6 October 2026, the Maritime and Port Authority of Singapore (Amendment) Bill was introduced into Parliament for First Reading. It is the most wide-ranging update to the MPA Act since it was enacted in 1996. For those operating in or around the Port of Singapore, it is likely to bring the port regulator much closer to their systems, their vessels,and their technology. In this article we look at the headline changes and what they mean in practice.
The MPA Act governs port regulation, pilotage, wreck removal, and the licensing of port services. The MPA's stated rationale for revising the Act is that maritime operations look very different today from 1996, with greater digitalisation, the emergence of remote and autonomous operations, and increasingly complex port activity.
The Bill (No. 24/2026) is due for Second Reading in November 2026 and will come into force on a date to be set by the Minister. As is often the case, much of the detail is left to regulations to be promulgated after the amendments to the Act take effect.
The most significant change for owners is a new sectoral cybersecurity regime, which sits alongside the Cybersecurity Act 2018. MPA will be able to designate a computer system onboard or ashore as "Important Information Infrastructure". It may do so where the system is identified as being necessary for an essential transport service and where its compromise would substantially affect that service, the operation of the port or Singapore's reputation as a maritime centre.
What is perhaps surprising is the breadth of whose systems can potentially be subject to such designation. A "maritime entity" includes the owner of any vessel in, or intending to enter, Singapore's territorial waters. The regime also expressly applies to systems located or hosted outside Singapore, and designations will not be published.
Once a system is designated, the duties fall on its "operator": the person with effective control over it. That may well be a manager or IT provider rather than the registered owner. The operator must report prescribed cyber incidents, carry out an annual risk assessment, and a five-yearly audit, take part in MPA exercises, and comply with MPA directions and standards. The fines are relatively modest (generally up to S$20,000 plus daily fines), but the operational burden is not.
This raises a number of questions. Which fleet management or ship-shore systems will MPA regard as necessary for an essential service? Where does responsibility sit under a ship management agreement? And how will the requirement to give MPA 90 days' notice of a change of ownership or operator fit with the timetable of a vessel sale?
The Bill also lays the groundwork for remote and autonomous shipping. The definition of "master" will include a person in charge of a vessel whether or not they are on board, and "pilot" will extend to remote pilotage. MPA will be able to make regulations setting the conditions under which vessels may be operated remotely or autonomously, and to regulate remote operations centres. A new category of "maritime device" brings underwater drones, hull-cleaning robots, and similar equipment within port regulation.
Whilst the IMO's MASS Code remains voluntary for now, Singapore is putting a domestic legal framework in place ahead of it. We expect the conditions set out in the regulations to become an important reference point for operators trialling autonomy in the region and, in due course, in questions of fault and seaworthiness.
It is worth noting that, despite references in MPA's announcement, the Bill does not regulate artificial intelligence as such. AI-enabled systems will be caught only where they constitute a maritime device form part of a computer system that is designated under the new cybersecurity powers discussed above.
If you are an owner or manager trading to Singapore, now is a good time to map which of your systems connect to Singapore port infrastructure and to identify who "operates" them. You should also review your management, IT, and sale contracts so that responsibility and cost are clearly allocated, and check that your P&I and wreck removal cover will respond if MPA acts without notice.
If you are developing or deploying remote or autonomous technology, it will be worth engaging with MPA early and keeping a close eye on the regulations that follow the adoption of the Bill.
We will be following the Second Reading in November and will update clients as the detail emerges. If you would like to discuss how the Bill may affect you, please get in touch.
This article is for general information only and does not constitute legal advice, whether on Singapore law or otherwise.
