The news
On October 7, 2026, the Monetary Authority of Singapore (MAS) issued Guidelines on Artificial Intelligence Risk Management, setting out what it expects of every financial institution it supervises that uses AI. The MAS AI risk management guidelines cover banks, insurers, payment firms and capital markets players, and apply to all forms of AI, including generative AI and AI agents.
The guidelines take effect on October 7, 2027. MAS said firms may meet the expectations in Sections 3 and 4, on board oversight and core risk management systems, from that date, and the more detailed Sections 5 and 6, on AI life cycle controls and capability, by October 7, 2028.
The core of the framework is a three-step routine. Firms should keep an accurate inventory of AI use cases, systems and models; rate each use case's risk materiality on at least three dimensions (impact, complexity and reliance on the AI, including how much autonomy it has); and apply controls proportionate to that rating. A designated control function should set the assessment framework and approve the ratings.
For the riskiest uses, the document is specific. AI use cases assessed as high risk materiality should undergo formal independent validation before deployment, carried out by people independent from the development and deployment teams, and should be re-validated regularly by independent parties. The guidelines also say an independent reviewer or auditor should be able to understand and potentially replicate how an AI system was built and what it produced.
MAS also said firms remain accountable for AI they buy from third parties and should obtain sufficient assurance from providers, add compensating controls where there are gaps, and consider limiting, suspending or replacing unsuitable services. Board and senior management must set roles, risk appetite and frameworks, though MAS said a dedicated AI committee is not mandatory. Ho Hern Shin, MAS deputy managing director, said in the release that AI has significant potential to improve financial services. The final text follows a public consultation launched in November 2025.
The numbers
- Guidelines issued
- October 7, 2026
- Effective date (Sections 3-4)
- October 7, 2027
- Deadline for Sections 5-6
- October 7, 2028
- Minimum risk dimensions
- 3 (impact, complexity, reliance)
- Consultation launched
- November 2025
Why CEOs should care
For CIOs and heads of data at banks with Singapore operations, the first job is the inventory. MAS expects AI use cases, systems and models to be catalogued with attributes such as dependencies, lifecycle status and risk rating; for AI agents that can include which tools and systems the agent can reach. Ask whether your firm can list every model and agent in production today, including AI embedded in vendor software.
For CROs and model risk teams, the independent validation requirement for high-risk uses means more work for the second line and internal audit. Validators must be independent of builders and test areas such as conceptual soundness and data quality. Budget for validator headcount now: the life cycle controls deadline is October 7, 2028, but the inventory and materiality ratings that decide what needs validation apply from October 7, 2027.
For procurement and vendor managers, MAS is explicit that outsourcing an AI capability does not outsource accountability. Contracts with model and software providers should give enough visibility and assurance (MAS mentions certifications or external assessments) to support the firm's own risk rating. Boards should ask management for an AI risk appetite statement and a list of use cases rated high risk.
The bigger picture
MAS has historically published principles first and supervision later; this document moves from its 2018 fairness and ethics principles to detailed control expectations. Global groups may use their group AI frameworks in Singapore, but only if those meet the MAS expectations, so a bank's Singapore requirements can effectively set the bar for its wider AI governance. Whether other supervisors adopt similar independent validation rules is an open question; the MAS text gives them a worked example to compare against.
What’s next
Firms have roughly a year to stand up inventories, materiality ratings and board-level frameworks before October 7, 2027, with life cycle controls such as validation, testing and monitoring due by October 7, 2028. MAS also published a response to consultation feedback alongside the guidelines, which compliance teams should read for how it interpreted specific comments.
What “Fact-checked” means
Fact-checking means testing a story’s facts against the evidence before it is published. This story went through at least two separate checks before this version was published.
- What we checked
- Its names, figures, dates, job titles, quotes and who said what were checked against the story’s sources, including its main source where it could be opened. The headline was checked for accuracy and overstatement.
- How
- A first check reviewed the whole story. If it passed, a second, skeptical check went back to the sources to look for mistakes in the most important facts. If a check flagged the story, it was edited to fix the problems found, and a separate re-check then reviewed the whole story again.
- Who
- The checks are made by our newsroom, as steps kept separate from the writing, under rules set by our editor, Hussein Mukhtar. A story the checks still flag is held for the editor, who decides whether it is fixed, published or dropped.
- If something is wrong
- “Fact-checked” does not mean error-free. If a material error is found after publication, we correct the story and add a note saying what changed. Report an error
