The Monetary Authority of Singapore on 7 October issued its Guidelines on Artificial Intelligence Risk Management, eleven months after consulting on a draft in November 2025. The final text keeps the scope MAS proposed, every financial institution and every form of AI, and spends its changes on telling smaller and simpler users how little they can get away with. The more consequential decision is the timetable: governance expectations apply from 7 October 2027, while the controls that govern how models are built, tested and monitored have until 7 October 2028.
The scope covers every institution and every type of AI
MAS says the guidelines apply to all financial institutions and all forms of AI technology. The guidelines document defines AI as machine-based systems or models that derive outputs through learned premises such as the data or inputs they receive. It applies on a group basis for locally incorporated institutions under MAS consolidated supervision or that own critical information infrastructure. The 2018 FEAT principles on fairness, ethics, accountability and transparency continue to apply alongside it.
That breadth means a fraud model at a bank, a large language model drafting client letters at an insurer and an AI feature embedded in a vendor’s software all fall in scope. Respondents to the consultation asked specifically about embedded AI. MAS’s answer runs through its third-party section: the institution remains accountable for AI in the services it delivers, including AI developed, operated or provided by someone else.
Proportionality is written in, with a floor for low-impact use
The final guidelines allow an institution to rely on basic policies and procedures if poor performance or unavailability of its AI is unlikely to have a material impact on the firm, its customers or other stakeholders, including other financial institutions. Beyond that floor, the extent and sophistication of controls should depend on risk exposure.
MAS also answered the governance question directly. Boards and senior management must oversee AI risk through clear roles, risk appetite and frameworks, but existing governance structures may be used where they provide adequate oversight and cross-functional coordination. A dedicated AI committee is not required solely to meet the expectation. Firms that set up AI committees during the consultation period can keep them; firms that did not need not start.
Realising these benefits sustainably requires financial institutions to understand and manage the risks that come with increasingly capable AI systems.
Ho Hern Shin, Deputy Managing Director, MAS, 7 October 2026
Inventories come first, life cycle controls a year later
The guidelines have four substantive sections: AI oversight (Section 3), AI risk management systems, policies and procedures (Section 4), AI life cycle controls (Section 5) and AI capability and capacity (Section 6). Institutions must meet Sections 3 and 4 from 7 October 2027 and Sections 5 and 6 by 7 October 2028.
In practice, the first deadline is about knowing what AI the firm runs. Section 4 asks each institution to establish and maintain an accurate inventory of AI use cases, systems or models across the firm (paragraph 4.5), linked to its other inventories, and to apply a consistent methodology for assessing the risk materiality of each use case, with a control function designated to set and arbitrate that framework. The life cycle controls in Section 5, covering data governance, testing, human oversight, cybersecurity, monitoring and change management, follow a year later. Because the inventory and materiality work sits in the 2027 tranche, that is the date compliance teams should plan against.
Third-party AI has a clear exit expectation
For AI supplied by vendors, MAS expects institutions to obtain sufficient assurance from providers, assess whether the AI suits its intended use and apply compensating controls where there are assurance gaps. If the risks cannot be brought within the firm’s risk appetite, it should consider limiting, suspending or replacing the service.
That exit expectation will shape procurement. Contracts for AI services will need audit and information rights strong enough to give the assurance MAS describes, and a realistic replacement plan. Singapore institutions now have a regulatory reason to insist on those terms with their AI vendors, including the largest model providers.
Agentic AI is the next round
The media release says MAS intends to consult in 2027 on what additional guidance on agentic AI would be useful, referring to systems that can operate autonomously and access tools. MAS also notes that the Financial Stability Board consulted on its own sound practices for AI adoption after MAS’s November 2025 draft. Singapore’s guidelines are already final, so any divergence with the FSB’s final text will need to be reconciled in later MAS updates.
What to watch
- 7 October 2027: Sections 3 and 4 (oversight; risk management systems, policies and procedures) apply.
- 7 October 2028: Sections 5 and 6 (life cycle controls; capability and capacity) apply.
- 2027: MAS consultation on additional guidance for agentic AI.
- The FSB’s final sound practices on AI adoption and how they compare with MAS’s text.
Primary sources
- MAS, MAS sets out supervisory expectations on responsible AI adoption by financial institutions, 7 October 2026
- MAS, Guidelines on Artificial Intelligence Risk Management, 7 October 2026
Photo (cropped): Jacklee., CC BY-SA 3.0 via Wikimedia Commons
