Introduction
The Monetary Authority of Singapore (“MAS”) has issued its Guidelines on Artificial Intelligence (“AI”) Risk Management (the “Guidelines”) on 7 October 2026, setting out supervisory expectations for financial institutions (“FIs”), on the responsible adoption of AI. They expressly cover Generative AI and AI agents (paras 1.1, 1.5), are framed as what FIs “should” do, and apply in proportion to each FI’s size, activities and AI risk (paras 1.6, 2.1). Rule-based tools and fixed-logic automation are outside the definition of AI (para 1.3, fn 6).
Timeline: Sections 3 to 4 (oversight, identification, inventory and risk materiality) apply from 7 October 2027. Sections 5 to 6 (life cycle controls, capability and capacity) may be met by 7 October 2028 (para 1.8).
Key Expectations
MAS’ expectations are organised in four areas.
| Area | What MAS expects |
|---|---|
| Oversight (Section 3) |
The board (or a delegated committee) approves the AI governance approach, puts AI risk within the risk appetite framework and understands AI well enough to challenge (para 3.4). Senior management implements it, assigns roles, sets escalation for AI incidents and resources training (para 3.5). Local management stays accountable where a group framework is used (para 3.6). |
| Identify, inventory and assess (Section 4) |
Identify AI use across the FI, including AI embedded in third-party services and shadow AI, with a designated control function as final arbiter (paras 4.2–4.4). Inventory use cases, systems and models with purpose, scope, data, dependencies, owners and risk rating (paras 4.5–4.9). Rate risk materiality before deployment, inherent and residual, on impact, complexity and reliance (paras 4.10–4.13). |
| Life cycle controls (Section 5) |
Controls scaled to risk materiality (para 5.2) across data, transparency, fairness, human oversight, third-party AI, selection, testing, security, review, monitoring, change and retirement. The FI keeps primary accountability for third-party AI (para 5.11). High-risk use cases need formal independent validation before deployment (para 5.19) and contingency plans (para 5.3). |
| Capability and capacity (Section 6) |
Competent personnel with training and resources proportionate to risk, reviewed regularly, and technology infrastructure that is secure, resilient and scalable (paras 6.1–6.3). |
Proportionate Approach for Low-Impact AI Use
Where poor performance or unavailability of an AI tool is unlikely to materially harm the FI, its customers or stakeholders, an FI may apply basic AI governance instead of the full framework (paras 2.2–2.3). MAS’ examples include drafting customer emails, summarising documents or meeting notes, initial document review, generating formulas or charts, and internal policy chatbots, with humans reviewing outputs (para 2.4, fn 13). Basic governance should minimally include (para 2.5):
- a senior manager designated as accountable for AI oversight;
- permitted and prohibited uses, such as no confidential or client information in public AI tools, and when human review of outputs is mandatory;
- an approved AI tool list and a process to request approval of new tools;
- staff education, regular compliance checks, and periodic and trigger-based review that the use still qualifies.
Immediate Gap Analysis
The table below is an indicative view of where fund managers typically stand today against the Guidelines. It should be validated against each client’s actual policies, registers and vendors.
| Area | Typical gap today | Immediate action | Due by |
|---|---|---|---|
| Accountability and oversight (paras 2.5(a), 3.4–3.5) |
No named senior manager for AI; AI risk absent from risk appetite and board reporting. | Designate the accountable senior manager and control function; add an AI risk statement to the risk appetite; make AI a standing item in board and compliance reports. | 7 Oct 2027 |
| Identification and inventory (paras 4.2–4.9) |
No AI register; AI features in administration, portfolio, CRM or productivity tools and staff use of public tools are not tracked. | Survey staff and vendors; build an inventory with the para 4.7 attributes; link it to the outsourcing and vendor registers. | 7 Oct 2027 |
| Use policy and training (para 2.5(b)–(e)) |
IT or compliance policies are silent on AI; client data may be entered into public AI tools. | Issue an AI use policy covering permitted and prohibited uses, an approved tool list and mandatory human review; brief all staff. | Now |
| Risk materiality (paras 4.10–4.13) |
No method to rate AI use cases; all uses treated alike. | Adopt an impact, complexity and reliance rating; classify each inventory item and flag higher-risk uses such as investment decisions, investor communications and AML screening. | 7 Oct 2027 |
| Third-party AI (paras 5.10–5.11) |
Outsourcing reviews and contracts do not address vendor AI, updates, audit rights or data use. | Add AI questions to vendor due diligence; review contracts for change notification, audit rights and data protection; start with administrators, custodians and trading or CRM vendors. | 7 Oct 2028 |
| Controls for higher-risk AI (para 5.3, Section 5) |
No testing thresholds, independent validation, monitoring or fallback for AI that influences decisions. | For any high-rated use, define testing, independent validation, monitoring and contingency plans before reliance; limit the use until in place. | 7 Oct 2028 |
| Capability (paras 3.4(d), 6.1–6.2) |
Limited AI understanding at board and senior management level. | Brief the board and senior management on AI risks; schedule periodic refreshers. | 7 Oct 2027 |
Summary
In brief, MAS has not set a one-size-fits-all rulebook for AI. It expects FIs to know where AI is used, rate its risk and apply controls in proportion, with clear board and senior management accountability and no hand-off of responsibility to vendors. With effective dates of October 2027 and October 2028, fund managers have time to build this in stages, beginning with an AI inventory and an AI use policy.
How We Can Help
As a compliance solutions advisor and funds specialist, we provide specialized solutions in accordance with MAS observations and recommendations to help your institution meet these regulatory requirements, including AI use policies, AI inventories, risk materiality assessments and third-party AI due diligence. Feel free to reach out to us for non-obligatory discussion.
