Knowledge Highlights 9 February 2026
MAS publishes AI risk management guidelines setting out supervisory expectations on responsible AI adoption
To support responsible adoption of AI in the Singapore financial sector, the Monetary Authority of Singapore (“MAS”) has issued the Guidelines on Artificial Intelligence Risk Management (“Guidelines”), setting out high-level expectations that all financial institutions (“FIs”) should adhere to as they deploy AI, including generative AI and newer developments such as AI agents.
Sections 3 and 4 of the Guidelines set out the requirements for an FI to establish frameworks, policies, and procedures to oversee its use of AI, including clear identification of AI use cases, robust risk materiality assessments, and an adequate AI inventory. Sections 5 and 6 require an FI to apply relevant life cycle controls and establish adequate capabilities and technology infrastructure for the use of AI.
The Guidelines, which were published on 7 October 2026, take effect on 7 October 2027. FIs may meet the expectations set out in sections 3 and 4 from 7 October 2027, and sections 5 and 6 by 7 October 2028.
The Guidelines are to be implemented in a manner commensurate with the size and nature of an FI’s activities, and the extent to which its use of AI could lead to material risks. An FI which is part of a global group may take guidance from or leverage their group’s AI risk management frameworks, provided those frameworks meet the expectations set out in the Guidelines. FIs are expected to regularly review the adequacy of their AI risk management efforts given the pace of AI developments.
MAS conducted a public consultation and sought comments on a draft version of the Guidelines in November 2025. MAS reported that the respondents expressed strong support for the principles-based and risk-proportionate approach.
In 2027, MAS intends to further consult the financial sector on what additional guidance on agentic AI would be useful.
The key expectations under the Guidelines are set out below.
Expectations FIs should meet from 7 October 2027
Strengthen oversight of AI risks with clear accountabilities
The Guidelines provide that the board and senior management of an FI should ensure that existing risk management frameworks, policies, and practices across the organisation adequately identify, assess, and address risks posed by AI. Board and senior management should maintain effective oversight of risks from AI use, foster the appropriate risk culture for the use of AI, and ensure that the FI’s use of AI would not conflict with its ability to meet regulatory requirements or other supervisory expectations. Further, the board and senior management should ensure consistent standards, clear accountability, and robust coordination across the FI to manage risks from AI use.
Risk management framework for identification, inventorisation, and risk materiality assessment
Systems, policies, and procedures should be established to ensure the consistent identification of AI use across all relevant business and functional areas of the FI. An FI should maintain an accurate inventory at an appropriate level of granularity of AI use cases, systems, or models across the FI as far as possible or practicable. This is to support governance and oversight, as well as risk management, throughout the AI lifecycle. An assessment methodology should be established to evaluate the risk materiality of an AI use case based on the nature of its business and the risks arising from the systems and models used.
An FI should assign clear roles and responsibilities for the identification, inventorisation, and risk materiality assessment of AI.
Expectations FIs should meet by 7 October 2028
AI life cycle controls
Under the Guidelines, an FI should implement robust controls covering the entire life cycle of an AI use case, system, or model, and assign clear roles and responsibilities for such controls across different business and functional units. The controls may be implemented in a proportionate manner that is appropriate to the assessed risk materiality of the AI use case. If an AI use case is assessed as high risk, there should be contingency plans outlining fallback options, such as alternative systems or manual processes, to ensure business continuity in the event of AI failure or unexpected behaviour. Controls covering the entire life cycle of an AI use case include data management, human oversight, selection and testing, management of cybersecurity risks, monitoring, and change management. AI life cycle controls should be regularly reviewed to take into account the use of newer AI technologies.
Third-party AI management
An FI retains primary accountability for its use of third-party AI, including the possible impact on its stakeholders and on the FI’s ability to comply with relevant regulatory requirements.
An FI should ensure that contractual agreements with third-party providers allow the FI to have a risk-appropriate degree of visibility over the introduction of AI and subsequent updates or changes, so as to facilitate the application of relevant controls. AI developed by third parties should be subject to appropriate reviews by the FI, including testing the provided AI services in the context of the FI’s use cases (including using the FI’s own data). The FI should maintain sufficient documentation on how it has tested the third-party AI and deemed it suitable for use.
The FI should ensure that the residual risk materiality of the use case which uses or depends on third-party AI is within the FI’s risk appetite. Where this cannot be achieved, the FI should consider limiting or suspending the third-party AI service or replacing the provider.
MAS’ expectations and requirements on managing the risks from outsourcing and use of third-party services would apply to the use of third-party AI.
AI capability and capacity
An FI should determine and ensure the necessary competence and proper conduct of personnel involved in developing, deploying, and using AI. This includes recruiting the necessary talent and providing appropriate training and support to equip employees with the skills, knowledge, and culture for the appropriate use of AI, as well as effective AI risk management.
An FI should also ensure that its technology infrastructure is adequate for the AI use cases, systems, or models that it wants to implement, in view of the technology risks that the AI systems and models are subject to, including system availability, resilience, safety, and cybersecurity risks.
Reference materials
The following materials are available on the MAS website www.mas.gov.sg:
