MAS AI Risk Management Guidelines: What Financial Institutions Must Do

The short answer: what MAS now expects

As of October 2026, the MAS AI guidelines in Singapore are final. On 7 October 2026 the Monetary Authority of Singapore issued its Guidelines on Artificial Intelligence Risk Management, setting supervisory expectations for how financial institutions govern and control their use of AI. They apply to all financial institutions and to all forms of AI, from traditional machine-learning models to generative AI and AI agents.

The Guidelines take effect on 7 October 2027. According to MAS, the oversight and core risk management expectations apply from that date, while the AI life cycle controls and the capabilities and capacity expectations are to be met by 7 October 2028. That gives institutions roughly one year to stand up governance and an AI inventory, and two years to embed controls across every material use case.

The approach is principles-based and proportionate. Institutions must know where they use AI, assess how material each use is, and apply controls in proportion. Where poor performance or unavailability of an AI tool is unlikely to have a material impact, basic policies and procedures may be enough. Institutions also remain accountable for AI supplied by third parties.

What changed and when it takes effect

MAS published a consultation paper on 13 November 2025, with comments closing at the end of January 2026. In its media release on the final Guidelines, MAS said respondents supported the principles-based, risk-proportionate approach and asked for clarity on three points: whether existing governance structures could be used, how to treat AI embedded in other software, and when basic policies would suffice. MAS kept the core expectations and refined the detail.

Three clarifications in the final MAS AI guidelines in Singapore stand out. First, institutions do not need a dedicated AI committee; existing board and management structures can carry the responsibility. Second, AI embedded in third-party software is within scope. Third, MAS has identified agentic AI as an area still developing and plans to consult the industry in 2027 on whether further guidance would help.

The MAS AI guidelines in Singapore also continue a longer line of work. MAS's earlier FEAT principles on fairness, ethics, accountability and transparency set high-level expectations, and the new Guidelines draw on MAS's 2024 thematic review of how banks were using AI. Existing obligations on technology risk, outsourcing, fair dealing and data protection still apply alongside them.

Who the MAS AI guidelines in Singapore apply to

MAS has stated that the Guidelines apply to all financial institutions. That includes banks, insurers, capital markets intermediaries, payment service providers and other regulated entities. How intensively each institution must implement them depends on the size and nature of its activities and how far its AI use could create material risk.

Institutions in global groups may rely on a group AI framework if it meets MAS's expectations, but local senior management remains accountable for making it work in Singapore, with visibility of relevant matters and a route to raise local concerns. Commentary on the Guidelines also notes their relevance to technology vendors and service providers, because institutions will push the expectations down their supply chains through contracts and due diligence.

Fintechs entering the market through MAS's sandbox routes should build these expectations in from the start; see our guide to fintech sandboxes. Our financial services regulation practice advises on how the Guidelines interact with licensing conditions.

Governance: board oversight and accountability

The first pillar is oversight. The board and senior management are expected to oversee AI risk, set clear roles and responsibilities, and define the institution's risk appetite and framework for AI. MAS has confirmed that existing structures, such as the board risk committee and a management risk committee, can carry this, so long as responsibilities are clear.

In practice, boards should expect a defined AI risk appetite statement, a named senior owner for AI risk, a policy setting out how AI use is identified, approved and monitored, and regular reporting that shows the inventory, the materiality ratings and any incidents. Board members should have enough understanding to challenge management on the institution's highest-risk use cases.

These are governance questions that sit alongside directors' wider duties. Our AI governance practice helps boards design frameworks that meet MAS expectations without duplicating existing risk committees.

Inventory and risk materiality assessment

Institutions should identify AI use consistently across the organisation and, where practicable, maintain an accurate inventory of use cases, systems and models. Commentary on the final text emphasises that this includes AI embedded in third-party software and tools staff use without approval, which is often where institutions have the least visibility.

Each use case is then assessed for risk materiality across three dimensions, which MAS first proposed in the consultation:

• Impact: the consequences for the institution, its customers and other stakeholders if the AI performs poorly or fails.
• Complexity: how novel or opaque the technology, data and outputs are, including how explainable the model is.
• Reliance: how far the institution depends on the AI, including its degree of autonomy and the level of human oversight.

The rating drives the controls. A low-impact internal productivity tool might need only an approved-tools list, rules on permitted and prohibited uses, human review of outputs and staff training. A credit-scoring, underwriting, claims or fraud model that affects customers directly will need the full set of life cycle controls.

Life cycle controls, third parties and generative AI

For material use cases, MAS expects controls across the AI life cycle. The consultation listed data management, fairness, transparency and explainability, human oversight, management of third-party AI risks, evaluation and testing, monitoring, and change management, applied according to relevance and proportionate to materiality. MAS's media release on the final text also highlights cybersecurity.

Human oversight that is real

Commentary on the final Guidelines stresses that a person nominally in the loop is not enough. Reviewers need the skills, information, authority and practical ability to question or override outputs, and institutions should guard against automation bias. Escalation routes, defined intervention points and records of significant overrides are useful evidence that oversight works.

Fairness, transparency and explainability

Where AI affects customers or prospective customers, commentary on the final text indicates that institutions should test for harmful bias, including whether outcomes systematically disadvantage particular groups, record the steps taken to address it, and give customers a way to raise questions or seek redress. Explanations should fit the context, the audience and the level of risk; the MAS AI guidelines in Singapore do not demand the same technical detail for every use. Institutions should decide what customers and other stakeholders need to know about the role AI played in an outcome, particularly in advice, recommendations and decisions to decline.

Monitoring, change management and fallback

AI performance drifts as data, market conditions and models change, so monitoring is expected throughout the life of a use case, with intensity matched to materiality. Performance thresholds, incident escalation, change control and periodic review should be documented. For higher-risk uses, institutions should have a tested fallback, such as an alternative system, a manual process or a quick way to switch the AI off, and should test it before they need it.

Capabilities and capacity

The final pillar asks whether the institution has the people, skills and technology to use AI safely. That includes reviewers who understand the models they oversee, risk and audit staff able to challenge them, and infrastructure that supports logging, testing and monitoring. Under the MAS AI guidelines in Singapore, these expectations fall within the second-phase deadline of October 2028, but hiring and training take time and should start in 2027.

Third-party AI

Institutions remain accountable for AI used in their services even where a vendor develops or operates it. MAS expects them to obtain sufficient assurance, assess suitability and apply compensating controls where there are gaps. If the risks fall outside appetite, the institution should consider limiting, suspending or replacing the service. Contracts should therefore give visibility of AI features and updates, data protection commitments, audit and information rights, and exit options. Our technology transactions team negotiates these terms.

Generative AI and agents

Generative AI can amplify existing risks and add new ones around confidentiality, intellectual property and reliance on outside providers. For AI agents, institutions should be clear about what the agent can access, which actions it can take, the safeguards around it and how unauthorised behaviour can be stopped. Our article on the agentic AI governance framework covers the wider Singapore guidance, and our note on AI and personal data covers PDPA overlaps.

An implementation plan for 2027 and 2028

1. Brief the board and appoint an owner. Present the Guidelines, the timeline and a first view of the institution's AI footprint. Assign senior accountability and agree where oversight will sit.
2. Set risk appetite and policy. Approve an AI risk appetite statement and a policy covering identification, approval, materiality assessment, controls, incidents and retirement of AI.
3. Build the inventory. Combine procurement, IT and business-line data; include embedded vendor AI and unapproved tools; record owners and purposes.
4. Rate materiality. Score each use case for impact, complexity and reliance; document the rationale and the controls that follow.
5. Embed life cycle controls. Prioritise high-materiality uses: data governance, fairness testing, explainability, human oversight, validation, monitoring thresholds, change control and tested fallbacks.
6. Re-paper third parties. Update due diligence and contracts for AI disclosure, change notification, audit rights, data protection and exit.
7. Build capability and test. Train staff and reviewers, secure the technical infrastructure and run internal audit or independent review before the 2028 milestone.

Illustrative scenario: a mid-sized insurer

The following scenario is illustrative only and does not describe any real client or matter.

A mid-sized general insurer uses an in-house model to triage motor claims, a vendor chatbot for customer queries, a generative AI assistant for staff drafting, and a fraud detection tool supplied by a global platform.

Its inventory exercise reveals two further uses it had not tracked: an AI feature in its HR recruitment software and a pricing analytics add-on in its actuarial platform. Applying the three materiality dimensions, it rates claims triage, fraud detection and pricing as high, the chatbot as medium, and the drafting assistant and HR feature as lower, subject to controls on personal data.

For the high-rated uses, it documents fairness testing, sets human review thresholds for declined or flagged claims, agrees monitoring metrics and builds a manual fallback. It renegotiates the fraud vendor contract for notice of model changes and audit access. The board receives a quarterly AI risk report. By October 2027 it can evidence governance and inventory; by October 2028, controls across the material uses.

Risks and common mistakes

Cross-border groups and the next steps

Many Singapore institutions are part of groups that also answer to UK, EU, UAE or Chinese regulators, each with its own approach to AI. A single group framework can often satisfy MAS, provided Singapore management has real visibility and the materiality assessment reflects local customers and products. TRW & Co advises across that network and works alongside Singapore-qualified counsel where Singapore court or tribunal representation is required.

For institutions starting now, the priorities are a board briefing, an inventory that captures vendor AI, and a materiality method agreed before the 2027 milestone. To discuss a gap analysis against the MAS AI guidelines in Singapore, please contact our team, or see our fintech regulatory advice practice.

Frequently asked questions

Sources and official materials

1. MAS: Guidelines on Artificial Intelligence Risk Management — Official guidelines page
2. MAS: Guidelines on AI Risk Management (PDF) — Full text of the Guidelines
3. MAS media release: supervisory expectations on responsible AI adoption — Issue date, effective dates and key expectations
4. MAS: Consultation paper on Guidelines on AI Risk Management — November 2025 consultation

General information only, current as at 20 October 2026. It is not legal advice and does not create a lawyer–client relationship. Singapore law and regulatory practice change; check current official sources and take advice on the facts of your matter.