Tines 3B: what the shift from automation to governed AI building means in Thailand and Singapore

On 28 July 2026, Tines launched 3B, an AI native platform for building, running and governing enterprise workflows, applications and agents. It is not a feature release. Tines rebuilt the platform rather than adding AI to the existing one, and renamed the original product to Tines Stories, which continues to run.

That distinction matters more than the marketing does. A vendor that rewrites its core product is telling you how it reads the market. Tines is betting the bottleneck in enterprise automation has moved. It is no longer "can we build this?" It is "do we know what is running, who owns it, and what it can touch?"

For the CIOs, IT directors and heads of security we work with in Bangkok and Singapore, that is a familiar problem with an unfamiliar name attached to it.

What actually shipped

The architectural claim underneath is the interesting part. Every workflow step runs in a completely isolated environment, executes, and disappears. Tines argues this makes cross contamination between runs or between users architecturally impossible rather than merely policed. Credentials are held away from both the builder and the model.

Read that as a design stance, not a certification. It is a good stance. It is also the kind of claim your security team should test in your environment rather than accept from a datasheet, and we would say the same about any vendor making it.

The problem Tines is naming

Tines calls it "Wild Code": the sprawl of AI generated software built outside traditional IT processes, lacking the governance, visibility and controls enterprises require. Co-founder and CEO Eoin Hinchy framed it as building no longer being the hard part. The hard part is connecting that software to your systems and knowing what is running, whether you can trust it, and who is responsible for it.

Tines cites an IBM study in which 77% of CxOs said AI adoption is already outpacing their current governance capability. Vendor cited statistics deserve a discount, but this one matches what we see on the ground. In the last twelve months we have walked into Thai and Singaporean organisations where the finance team has a working AI agent nobody in IT has ever seen, running on a personal API key, reading a shared drive.

Nobody did anything wrong. The tooling simply got fast enough that the approval process stopped being the gate.

The commercial signals worth reading

Disclosed alongside the launch. Named customers include Coinbase, SAP, Experian, Reddit, Notion and Mars.

What this means in Singapore

Singapore is the market where the timing is sharpest, because the regulatory scaffolding for agentic AI arrived first.

MAS

The Monetary Authority of Singapore issued a consultation paper on proposed Guidelines on Artificial Intelligence Risk Management on 13 November 2025, closing 31 January 2026. The proposals apply across all regulated financial institutions, banks, insurers, capital markets intermediaries and payment service providers, applied proportionately to size and risk profile. MAS has proposed a 12 month transition period once the guidelines are issued.

Three proposed expectations map almost directly onto what a platform like 3B is selling:

• Board and senior management accountability for AI governance, with a cross functional committee where exposure is material.
• An accurate inventory of all AI use cases, plus a Risk Materiality Assessment covering impact, complexity and reliance.
• Lifecycle controls spanning data management, transparency, explainability, human oversight, third party risk, monitoring and change management.

If you are a financial institution in Singapore, "maintain an accurate inventory of all AI use cases" is not a policy document. It is a systems requirement. You either have a place where every agent and automation is registered and observable, or you will be reconstructing that inventory by interview, once a quarter, badly.

IMDA

The Model AI Governance Framework for Agentic AI launched in January 2026 and was updated to version 1.5 on 20 May 2026, incorporating industry feedback and adding case studies covering multi agent systems, third party agents and automation bias. Its four dimensions read like a build specification: bound the risk, make humans meaningfully accountable, implement technical controls, and continuously monitor and test after deployment.

Third party agents are the clause to watch. The moment an employee builds something that calls an external agent, you have inherited a supply chain you did not procure.

PDPA and data residency

Singapore's PDPA governs the personal data flowing through any of this. Tines contractually hosts customer personal data only in the hosting regions it offers and the customer selects on the order form, and added Australia as a selectable region at sign up in July 2026. For most commercial workloads that is a non issue, since Singapore permits transfers with a valid mechanism rather than mandating local storage. For regulated or government adjacent workloads, raise it in the order form conversation early, not in month three. We handle that conversation as part of the licensing engagement.

Digigen Pte Ltd invoices Tines licensing in SGD with 9% GST. See also our Singapore market hub and Microsoft 365 in Singapore.

What this means in Thailand

Thailand is a different shape of problem, and the common mistake is assuming it is Singapore with a delay. It is not.

PDPA is the binding instrument today

The Personal Data Protection Act B.E. 2562 has been fully enforced since June 2022 and is modelled on GDPR. Section 34 gives individuals the right to object to automated decision making, which carries with it human intervention mechanisms, disclosure of the logic involved and an appeals path. Cross border transfers need a PDPC recognised mechanism. As of 2026 the PDPC has issued no adequacy decisions, so in practice you are working with approved standard contractual clauses, binding corporate rules, or explicit and specific consent.

For an agent that reads customer records and produces a decision, Section 34 is not a footnote. It is the design constraint.

The AI law is coming, and it is not settled

ETDA released a comprehensive draft AI law for public hearing on 2 July 2026. Reported features include a risk based classification system in the European mould, transparency duties for AI generated content, strict liability for AI related damage, and fines in the range of THB 1 million to 5 million. Notably for regional vendors, the draft is described as applying to AI deployment affecting people in Thailand even where the activity is performed abroad, with foreign providers required to appoint a local coordinator or authorised representative.

Treat all of that as draft. Baker McKenzie's reading is that the consolidated Draft AI Principles will supersede the earlier instruments and progress toward enactment over the next two to three years. Anyone telling you Thailand's AI Act is in force today is ahead of the evidence.

The practical answer for Thai enterprises is the same as it would be without the draft law, which is why it is worth doing now: build the inventory, classify use cases by risk, keep the audit trail, and make sure a human is accountable for anything touching a customer decision. If ETDA lands close to the current draft, the work is done. If it lands elsewhere, the work is still done, because PDPA already asked for most of it.

Growth Goats Co., Ltd. invoices Tines licensing in THB with 7% VAT and handles withholding tax. See also our Thailand market hub.

What to pin down before you commit

We are a Tines partner in Thailand and Singapore, which is exactly why these five questions come up in our first conversation rather than after signature. A platform decision that goes wrong is worse for us than a deal that does not close.

A practical way to decide

The larger point

Tines 3B is a good read of where the market is. The interesting shift is not that AI can write workflows. It is that the constraint has moved from build capacity to accountability, and vendors are now competing on control rather than on capability.

Singapore's regulators reached that conclusion first, which is why MAS is asking for AI inventories and IMDA is publishing a build specification dressed as a framework. Thailand is arriving at the same place by a different route, through PDPA enforcement now and a risk based AI law later.

Whichever platform you land on, the requirement is identical: know what is running, know what it can reach, and know who answers for it. That is a governance question with a technology answer, not the other way around.

Frequently asked questions

Talk it through before you commit budget

We run the inventory, classify by consequence, and licence Tines locally in THB or SGD. Enterprise cloud capability, delivered with the compliance depth and invoicing convenience of a local partner.