Before you sign for intelligent document processing (IDP) in Singapore, make every shortlisted vendor run your own documents, not their demo set, and score the results field by field. Then check what demos never show: whether the document should be scanned at all, how wrong values that look confident get caught, where documents and NRIC images go under the PDPA, how originals are kept for IRAS, and how clean the writeback and exit are.
This IDP buyer checklist for Singapore is for the team that will live with the system after the vendor’s pre-sales team has gone. It covers the questions, the evidence to ask for, and a fair way to compare vendors. Educational only, not legal or tax advice.
Who this is for, and who should skip it
For: finance operations, accounts payable and receivable, claims, trade and logistics operations, onboarding and KYC teams, and the procurement and IT people helping them shortlist an IDP platform, or deciding whether to build on a cloud OCR service instead.
Skip if: you run a Philippine shared services centre and need the operating design side (see IDP for Philippine shared services); you only want to chat with PDFs, which is a retrieval problem (see the enterprise RAG evaluation checklist); or you have not yet picked which document process to fix first.
Step zero: do not scan what Singapore already sends you as data
The cheapest document to process is the one that arrives as data. Three Singapore facts change how much IDP you need.
- Invoices are moving onto InvoiceNow. IRAS says all GST-registered businesses must submit invoice data to IRAS using InvoiceNow-Ready Solutions, phased in from November 2025 to April 2031 by business type and size. InvoiceNow, introduced by IMDA in 2019, runs on the Peppol standard, so invoices from suppliers on the network reach you as structured data that needs no OCR.
- Individuals can share verified data. With Singpass Myinfo, users consent through Singpass to share personal data drawn from participating government sources. If your onboarding asks people to upload an ID photo just so software can read their name and address, ask whether Myinfo should replace the upload.
- Copying NRICs is restricted. Under PDPC’s Advisory Guidelines for NRIC and other national identification numbers, in force since 1 September 2019, organisations may collect, use or disclose NRIC numbers or copies of NRIC only where the law requires it (or a PDPA exception applies) or where it is necessary to accurately establish or verify identity to a high degree of fidelity. “Scan every NRIC” is a design decision before it is an IDP feature.
| Document stream | Structured route to check first | Where IDP still earns its keep |
|---|---|---|
| Supplier invoices | InvoiceNow via your Access Point | Overseas suppliers, suppliers not yet on the network, statements, delivery orders |
| Customer identity details | Myinfo, with the person’s consent, if your service can use it | Overseas IDs, corporate documents, supporting letters |
| Trade and logistics paperwork | EDI or API feeds from partners who offer them | Bills of lading, packing lists and certificates from partners without feeds |
| Internal forms | Replace the paper or PDF form with a web form | Legacy archives and signed paper you are still handed |
Size your IDP scope on what is left after this step, and expect the invoice share to shrink as more suppliers join InvoiceNow. Our InvoiceNow integration guide covers the build side.
Original element: the 12-point IDP buyer checklist
Use one row per check in every vendor meeting. A check passes only when you have seen the evidence, not when it is promised in a slide.
| # | Check | Ask the vendor | Evidence to demand | Red flag |
|---|---|---|---|---|
| 1 | Scope | Which document classes, layouts and languages does this price cover? | Signed-off list matched to your sample | “We handle any document” |
| 2 | Your test set | Will you run our labelled sample, including a hold-out set you never see? | Hold-out results per field | Demos on their own sample files only |
| 3 | Field-level scoring | How do you report correct, wrong and flagged values per field? | Counts per field, not one headline figure | A single accuracy percentage |
| 4 | Confident errors | What stops a wrong value with a high confidence score reaching our ERP? | Validation rules (PO match, totals, supplier master) and what they caught in the test | Confidence score is the only control |
| 5 | Exception queue | What does the reviewer see, and how are corrections recorded? | Walkthrough on your documents; correction log | Corrections handled by email or spreadsheet |
| 6 | Writeback | How do values reach the system of record, and what happens on retry? | Integration design with duplicate-safe retries | CSV export as the end state |
| 7 | Personal data and NRIC | Which fields hold personal data; can NRIC fields be masked or not stored? | Field-level data map; masking settings | Full ID images kept by default |
| 8 | Hosting and transfers | Where are documents processed, stored and backed up; which subprocessors? | Region and subprocessor list; transfer clauses | “It’s in the cloud” |
| 9 | Training and model change | Are our documents used to train shared models? How are model changes announced? | Contract clause; release notes; re-run of your hold-out | Silent model updates |
| 10 | Records and audit | Is each original kept linked to its extract and correction history? | Retention settings; audit export | Originals deleted after extraction |
| 11 | Pricing units | What is charged: page, document or platform? What do new document classes, retraining and overage cost? | Priced scenario on your volumes | Per-page price with no overage table |
| 12 | Exit | Can we export originals, extracts, labels, templates and corrections in open formats? | Export tested during the pilot | Labels and templates locked in |
How to run a fair bake-off on your own documents
- Pick one document class with a clear destination, for example supplier invoices into accounts payable.
- Pull a real sample from recent traffic: many suppliers, page counts and scan qualities, plus the ugly ones, such as phone photos, stamps over totals, handwritten notes and several invoices in one PDF.
- Label only the fields your process uses, and have two people agree the correct value for the tricky ones. This labelled set is yours, so keep it.
- Split the sample. Vendors get a tuning set; you keep a hold-out set that each vendor runs once, blind.
- Score every field three ways: correct and passed, wrong but passed as confident, or sent to review. The middle bucket is the one that costs money later.
- Time your own reviewers clearing the exceptions in each vendor’s queue.
- Re-run the hold-out after any vendor change during the pilot, and keep it as your regression test after go-live.
A headline accuracy figure hides all of this. Accuracy can be counted per character, per field or per document, and one wrong digit in an invoice total is a tiny character error but a wrong payment. Ask for the confident-error count on your hold-out instead.
PDPA checks that belong in the contract
Most IDP vendors process documents on your behalf, which makes them data intermediaries. PDPC’s Advisory Guidelines on Key Concepts explain that a data intermediary working under a written contract carries the protection, retention limitation and breach notification obligations, while you keep the same obligations as if you processed the data yourself. The vendor must tell you about a breach without undue delay; you must notify PDPC no later than three calendar days after determining that a breach is notifiable. Write both clocks into the contract.
The same guidelines keep the Transfer Limitation Obligation with you even when a Singapore-based vendor moves documents overseas as part of its processing. That is why check 8 asks for every processing and backup region, not just the sales office address.
For NRIC data, the NRIC guidelines expect a greater level of security, and say organisations should not keep NRIC numbers or copies “just in case” once they are no longer needed. They even suggest scanning physical NRICs into software systems to capture the number and store it securely. Done well, IDP helps: extract the number, mask or drop the image, and set a retention rule. Done badly, it builds a searchable archive of ID photos.
If the extractor is a large language model reading the page, two more risks appear: hidden text in a document can try to instruct it, and prompt logs can hold personal data. See our prompt injection checklist and guide to LLM logging under the PDPA.
Records: keep the original, the extract and the correction together
IRAS requires companies to keep source documents, accounting records and bank statements for at least five years from the relevant Year of Assessment, and says source documents such as receipts and invoices may be kept in physical or electronic form. In practice, the original image, the values extracted from it and the record of who corrected what should stay linked and retrievable for that period, in the IDP platform or your document store. Check the vendor’s default retention before go-live.
That pulls against the PDPA’s retention limitation, and both can be met: keep the financial source document for as long as the law requires, and purge personal data, such as ID copies, as soon as its purpose is served.
Worked example: accounts payable at a Singapore freight forwarder
Illustrative scenario, not a client case. A forwarder’s AP team keys invoices from local hauliers and overseas agents, plus delivery orders, into its ERP. Here is how the checklist changes the purchase:
- Step zero: local hauliers already on InvoiceNow are routed through the Access Point and never touch OCR. IDP scope shrinks to overseas agent invoices in mixed currencies and delivery orders.
- Bake-off: two platforms and a build option on a cloud OCR service run the same blind hold-out. One platform passes more documents straight through but lets wrong currency codes through as confident; the other flags more for review but makes fewer confident errors.
- Choice: the second platform, plus validation rules: invoice currency must match the purchase order, line items must add up to the total, and the supplier must exist in the vendor master.
- Contract: processing and backups in named regions, a subprocessor list, no training on the forwarder’s documents without written consent, both breach clocks, five-year retention of originals, and an export tested during the pilot.
The model was not the deciding factor. The hold-out set and the contract terms were.
Decision framework: buy, build or not yet
- Buy a platform when you have many document classes and changing layouts, and the vendor passes checks 2 to 6 on your hold-out.
- Build on a cloud OCR or extraction service when you have few document classes, strict hosting needs and engineers who can own the queue and writeback. The writeback is usually the hard part anyway.
- Not yet when the documents could arrive as data, volumes are low, or nobody owns the exceptions.
- Walk away when a vendor will not run your hold-out, or will not commit in writing on hosting, training and exit.
Common mistakes
- Buying on the demo. Vendor sample files are clean; yours are not.
- Asking for an accuracy percentage. Ask for confident errors per field on your hold-out.
- Scanning what could be data. InvoiceNow and Myinfo remove whole streams from scope.
- Keeping every ID image forever. Extract what you are allowed to keep, and set a retention rule.
- Leaving the labelled set with the vendor. It is your regression test and your exit insurance.
FAQ
Is IDP just OCR?
No. OCR turns an image into text. IDP adds classification, field extraction, validation, a review queue and writeback into your systems. Most buying mistakes come from scoring the OCR and ignoring the rest.
Does InvoiceNow make invoice IDP pointless?
Not yet. IRAS phases the requirement in through April 2031, overseas entities are exempt, and suppliers outside the network still send PDFs. Plan for a shrinking invoice workload, and keep pricing flexible.
Can we store the NRIC images our IDP captures?
Only where collecting them is allowed under PDPC’s NRIC guidelines, with stronger security, and only for as long as the purpose needs. PDPC’s NRIC FAQs add that physical NRICs can be retained only if required by law.
We are MAS-regulated. Anything extra?
Bring your technology risk team in early, because an IDP vendor is a third party touching customer records. Our MAS TRM questions for vendors is a useful starting list.
What to do next
Pull a real sample this week, label the fields that matter, and send the 12-point checklist to every vendor before the next demo. For scoring shortlisted bids, our RFP scoring matrix and vendor lock-in exit metrics help. If you want help designing the queue, validation and writeback, see our document intelligence services in Singapore, AI automation in Singapore, private AI deployment for strict hosting, or our custom software team. You can also contact us to walk through your document flows.