Background

The Monetary Authority of Singapore (“MAS”) issued the Guidelines on Artificial Intelligence (“AI”) Risk Management on 7 October 2026, with a phased adherence timeline: AI Oversight, Key AI Risk Management Systems, Policies and Procedures by 7 October 2027, while AI Life Cycle Controls and AI Capability & Capacity by 7 October 2028. The Guidelines apply to all financial institutions (FIs) and all forms of AI technologies, including generative AI and AI agents, while allowing firms to tailor their approaches according to their risk profiles.

Key Areas MAS’ Expectations

1. Board and Senior Management Oversight

MAS places ultimate accountability for AI risk management at the board and senior management level. The board is responsible for approving and regularly reviewing the overall governance approach for AI risk management, ensuring AI risks are explicitly addressed within the risk appetite framework, and maintaining adequate understanding of AI to provide effective oversight and challenge.

• AI Identification, Inventorisation, and Risk Materiality Assessment

MAS expects financial institutions to establish a risk materiality assessment framework which is built on three dimensions: Impact (consequences of failure on the FI and its customers), Complexity (nature of AI technology, novelty, explainability), and Reliance (level of dependence on AI outputs, including autonomy and human involvement). The assessment should consider both inherent risk before controls and residual risk after controls are applied, ensuring residual risk remains within the FI‘s risk appetite before deployment.

• AI Life Cycle Controls

This is the most operationally intensive area of the Guidelines. MAS expects proportionate controls across the entire AI lifecycle, covering:

1. Data Management: Ensuring data is fit for purpose, representative, of high quality, and subject to robust governance including classification, security, privacy, and auditability
2. Transparency and Explainability: The degree required should reflect the context and risk materiality of the use case. AI used for credit decisioning or insurance underwriting requires higher levels than AI used for internal low-risk tasks.
3. Fairness: Financial institutions should define what constitutes “fair” outcomes and implement controls to identify and mitigate harmful biases, calibrated to the use case context.
4. Human Oversight: Appropriate human oversight mechanisms should be in place, with attention to automation bias and decision fatigue as AI use increases in speed and scale.
5. Third-Party AI Management: The FI retains primary accountability for AI used in services it delivers, including AI developed or provided by third parties. FIs must obtain sufficient assurance from providers, assess suitability for intended use, and apply compensating controls where assurance gaps exist. If risks cannot be brought within the FI’s risk appetite, it should consider limiting, suspending, or replacing the third-party AI service.
6. Evaluation and Testing: Pre-deployment testing proportionate to risk materiality, including performance thresholds, testing under stressed conditions, and mitigation of overfitting.
7. Pre-Deployment Reviews: High-risk AI use cases should undergo formal independent validation by parties independent from development teams.
8. Post-Deployment Monitoring and Change Management: Continuous monitoring for data drift, concept drift, and model performance degradation, with robust change control mechanisms including version control and rollback capabilities.
9. AI Capability and Capacity

MAS expects financial institutions to ensure necessary competence of personnel involved in developing, deploying, and using AI, with adequate resources allocated proportionate to the risk profile of AI use cases. Technology infrastructure must be adequate for the AI systems implemented, addressing system availability, resilience, safety, and cybersecurity risks.

What’s Next?

Immediate Priorities (Pre-October 2027)

1. Conduct a Comprehensive AI Inventory and Gap Analysis
2. Develop or Refine the AI Risk Materiality Assessment Framework
3. Align Board and Senior Management Governance
4. Address Third-Party AI Risks

Medium-Term Priorities (By October 2028)

1. Implement Life Cycle Controls Proportionately
2. Build Monitoring and Change Management Capabilities
3. Invest in AI Risk Management Capabilities

How Can We Help?

We support Financial Institutions in meeting expectations through: 

• AI governance framework development 
• AI inventory and risk scoring setup 
• Lifecycle controls (testing, explainability, fairness, drift monitoring) 
• Readiness review and implementation roadmap planning 

Contact us today to strengthen your AI risk controls and implementation of readiness under the AI Risk Management framework. Find out more here.