# Singapore's MAS issues final AI risk management guidelines for all financial institutions

On 7 October 2026 the Monetary Authority of Singapore issued Guidelines on Artificial Intelligence Risk Management, covering board oversight, AI inventories, risk materiality and life cycle controls. They take effect on 7 October 2027, with life cycle and capability sections due by 7 October 2028.

URL: https://airiskalmanac.com/news/news-2026-10-07-mas-ai-risk-management-guidelines/
Author: AI Risk Almanac | Publisher: AI Risk Almanac
Updated: 2026-11-03

---

**The Monetary Authority of Singapore (MAS) issued final Guidelines on Artificial Intelligence Risk Management on 7 October 2026.** They apply to all financial institutions it regulates and to all forms of AI, scaled to each institution's AI use and risk. The guidelines take effect on 7 October 2027, and institutions may phase in the more detailed sections by 7 October 2028.

## What happened

MAS consulted on the guidelines in November 2025 and said it kept the key expectations while refining them in response to feedback. The final text sets out expectations in four areas:

- **AI oversight.** Boards and senior management should provide "effective oversight of AI risks," including roles, risk appetite and frameworks. MAS says existing governance structures may be used and a dedicated AI committee is not required.
- **Risk management systems.** Institutions should identify where they use AI, keep an inventory, and assess the risk materiality of each use case.
- **Life cycle controls.** Proportionate controls should cover data management, transparency and explainability, fairness, human oversight, third-party AI, evaluation and testing, cybersecurity, monitoring, change management and decommissioning.
- **Capability and capacity.** Staff competence, training and the supporting technology infrastructure.

Institutions "remain accountable for AI used in the services they deliver," including AI from third parties, and, for third-party AI whose residual risk cannot be kept within risk appetite, should consider limiting or suspending the service or replacing the provider. Where poor performance or unavailability of an AI tool would not have a material impact, basic policies may suffice; MAS gives drafting or proofreading emails to customers and summarizing documents for internal reference as examples. Sections 3 and 4 apply from 7 October 2027 and sections 5 and 6 by 7 October 2028. MAS said it intends to consult in 2027 on whether additional guidance on agentic AI would be useful.

## Why it matters

The guidelines turn AI governance in Singapore's financial sector into supervisory expectations set by the regulator itself. Their structure (oversight, inventory, materiality, life cycle controls, third-party accountability) gives institutions, and the assurance providers and insurers that work with them, a regulator-defined account of what sound AI risk management looks like. In the region, they sit alongside Australia's CPS 230, which captures AI as operational risk without naming it. See [What Is AI Assurance?](/learn/what-is-ai-assurance/), [What Is AI Insurance?](/learn/what-is-ai-insurance/) and [The Standards Landscape Explained](/learn/the-standards-landscape-explained/).

## What is not yet clear

How MAS will supervise against the guidelines during the phase-in, and what any agentic AI guidance will add, remain to be seen. The [timeline](/landscape/the-timeline/) tracks the 2027 and 2028 dates.

## Primary sources

- MAS sets out supervisory expectations on responsible AI adoption by financial institutions: https://www.mas.gov.sg/news/media-releases/2026/mas-sets-out-supervisory-expectations-on-responsible-ai-adoption-by-financial-institutions
- Guidelines on Artificial Intelligence Risk Management: https://www.mas.gov.sg/-/media/mas-media-library/regulation/guidelines/bd/guidelines-on-artificial-intelligence-risk-management-for-financial-institutions/guidelines-on-artificial-intelligence-risk-management.pdf