The Monetary Authority of Singapore (MAS) has issued a new guidance document for regulated financial institutions (FIs) in the country.
‘Guidelines on Artificial Intelligence (AI) Risk Management’ sets out supervisory expectations for FIs to manage risks arising from AI use, while allowing them to tailor their approaches according to their risk profiles, including the scale and nature of their AI use.
MAS expects FIs to manage AI risks at both the enterprise and individual use case levels, and build the capabilities needed for responsible AI use as adoption grows.
The key expectations set out in the guidelines are:
- Strengthen oversight of AI risks with clear accountabilities. FIs should ensure that their board and senior management provide effective oversight of AI risks, including by setting clear roles and responsibilities, risk appetite, and risk management frameworks, policies, and procedures. Existing governance structures may be used where they provide adequate oversight and cross-functional coordination, and FIs need not establish a dedicated AI committee solely to meet this expectation.
- Identify, assess, and manage AI risks across the AI life cycle. FIs should identify their AI use, maintain inventories at an appropriate level of granularity, assess the risk materiality of AI use cases, and apply proportionate controls across the AI life cycle. These include data governance, testing, human oversight, cyber security, monitoring, and change management. FIs should review these controls regularly as their AI use expands and the technologies evolve, such as the greater use of agentic AI systems that can operate autonomously and access tools. In 2027 MAS intends to further consult the financial sector on what additional guidance on agentic AI would be useful.
- Manage the risks from third-party AI use. FIs remain accountable for AI used in the services they deliver, including AI developed, operated, or provided by third parties. FIs should obtain sufficient assurance from third-party providers, assess whether third-party AI is suitable for their intended use, and apply compensating controls where practical constraints or assurance gaps arise. If the risks cannot be brought within the FI’s risk appetite, it should consider limiting, suspending, or replacing the use of the third-party AI service.
- Apply the guidelines in a risk-proportionate manner. FIs may put in place basic policies and procedures to govern their AI use if poor performance or unavailability of their AI services or tools is unlikely to have a material impact on the FI, its customers, or other stakeholders, including other FIs. The extent and sophistication of the controls should depend on FIs’ risk exposure.
The guidelines will come into effect on seven October 2027, but FIs can implement them in phases through to 7th October 2028.
