The Monetary Authority of Singapore has finalised AI risk-management guidelines that give financial institutions a year to establish governance and core risk systems, followed by a further year for lifecycle controls and organisational capabilities. The framework covers all institutions under MAS supervision and all forms of AI, with controls scaled to their potential impact.[1][2]
Implementation timetable
| Measure | Value | Context |
|---|---|---|
| Guidelines issued | 7 October 2026 | Finalised after the consultation opened in November 2025.Source 1Source 3 |
| Sections 3–4 | 7 October 2027 | Governance and key AI risk-management systems, policies and procedures.Source 1 |
| Sections 5–6 | 7 October 2028 | Lifecycle controls and the capabilities needed to manage AI use.Source 1 |
| Coverage | All financial institutions and all AI use | Controls are expected to be proportionate to the risk and materiality.Source 1Source 2 |
| Further work | Agentic-AI consultation in 2027 | MAS has signalled separate attention to systems with greater autonomy.Source 1 |
Start with ownership and an inventory of actual uses
The enterprise layer assigns board and senior-management oversight, risk appetite and responsibility for AI. Each use case then needs a materiality assessment connecting the model’s purpose to the decisions, customers or operations it can affect. A low-impact internal tool can justify basic policies, while a system influencing credit, trading or customer access may require deeper testing and intervention controls.[1][2]
MAS expressly allows firms to use existing governance structures where oversight and coordination are adequate; a dedicated AI committee is not compulsory. That gives firms an opportunity to integrate the work into their present risk arrangements while making the accountable owners and escalation routes clear.[1]
Controls follow the model into operation
AI lifecycle control map
| Stage | Control question | Examples of evidence |
|---|---|---|
| Design and data | Is the use case justified and is the data appropriate? | Purpose, data lineage, quality checks, privacy and bias considerations.Source 2 |
| Development and testing | Does performance remain reliable under relevant conditions? | Benchmarking, scenario tests, limitations and independent challenge.Source 2 |
| Deployment | Who can approve, override or stop the system? | Human-in-the-loop design, access controls and intervention procedures.Source 2 |
| Operation | Are outputs, drift and incidents monitored? | Thresholds, logs, complaints, error analysis and change controls.Source 2 |
| Retirement or material change | Can the firm remove or replace the model safely? | Exit plans, record retention and validation of the replacement.Source 2 |
Human oversight should match the decision being controlled. Depending on the use case, intervention can take the form of review before a decision, sampling afterwards, an override or a stop mechanism. The useful evidence is how the selected intervention works under the conditions that create material risk.[2]
Vendor assurance needs an operational response
The institution remains accountable for AI supplied by third parties. MAS expects assurance about suitability and control effectiveness, supported by sufficient in-house skills to challenge the provider. Where information is incomplete, firms should consider compensating controls; if the resulting risk remains outside their appetite, MAS says they should consider limiting, suspending or replacing the service.[1][2]
The implementation sequence is therefore ownership and inventory, materiality assessment, and then evidence that development, deployment, monitoring and vendor controls work. MAS intends a further consultation on agentic AI in 2027 as systems gain greater autonomy and tool access.[1][2]
Sources & further reading
- MAS sets supervisory expectations for responsible AI adoption Monetary Authority of Singapore · 7 Oct 2026 · Accessed 16 Oct 2026
- Guidelines on Artificial Intelligence Risk Management for Financial Institutions Monetary Authority of Singapore · 7 Oct 2026 · Accessed 16 Oct 2026
- Consultation and response on AI risk-management guidelines Monetary Authority of Singapore · 7 Oct 2026 · Accessed 16 Oct 2026