The Monetary Authority of Singapore issued final AI Risk Management Guidelines covering every financial institution it supervises and all forms of AI technology. Sections 3 and 4 take effect on 7 October 2027. Sections 5 and 6 follow by 7 October 2028. The phased timetable gives firms one to two years to implement the supervisory expectations.
The final framework followed a public consultation launched in November 2025. MAS said respondents supported its principles-based, risk-proportionate approach while seeking clarity on existing governance structures, embedded AI and when basic policies would suffice. The regulator retained its central expectations and refined the text in response. The Business Times independently reported the issuance, scope and implementation timetable.
BOARDS MUST MAP AND CONTROL AI RISKS
Boards and senior management are expected to provide effective oversight by defining accountabilities, risk appetite and appropriate frameworks, policies and procedures. Firms may use existing governance structures when they provide adequate oversight and cross-functional coordination. MAS said institutions do not need to establish a dedicated AI committee solely to meet this expectation.
Institutions are expected to identify their AI use, maintain inventories at an appropriate level of detail and assess each use case’s risk materiality. Proportionate controls should cover data governance, testing, human oversight, cybersecurity, monitoring and change management across the AI life cycle. MAS said firms should review those controls as adoption expands and increasingly autonomous agentic systems gain access to tools.
THIRD-PARTY SYSTEMS REMAIN FIRMS’ RESPONSIBILITY
Financial institutions remain accountable for AI used in services they deliver, including systems developed, operated or supplied by third parties. They should obtain sufficient assurance from providers, test suitability for the intended use and apply compensating controls where assurance gaps remain. If risks cannot be brought within appetite, MAS said firms should consider limiting, suspending or replacing the third-party service.
MAS framed the guidelines as risk-proportionate supervisory expectations rather than a uniform technology prescription. Basic policies and procedures may suffice where AI failure or unavailability is unlikely to have a material effect on a firm, its customers or other institutions. Firms now have until October 2027 to prepare for the first phase, while the next policy milestone will be MAS’s planned 2027 consultation on whether agentic AI needs additional guidance.