MAS Sets October 2027 Deadline for AI Risk Management Guidelines

The Monetary Authority of Singapore (MAS) issued its Guidelines on Artificial Intelligence Risk Management on October 7, 2026, setting supervisory expectations that every financial institution must meet from October 7, 2027.

The MAS AI risk management guidelines apply to all financial institutions and all forms of AI. Each firm decides how to meet them based on the nature and scale of its AI use and the risk involved. That puts banks, insurers, asset managers and payment firms licensed in Singapore on the same 12-month clock.

For compliance and risk teams, the guidelines turn AI oversight into something supervisors can examine. Firms are expected to know where AI is used, rate how much each use matters and show that the board and senior management own the result. Boards that already receive model reports will find AI added to that reporting line.

What the MAS AI risk management guidelines cover

MAS built the guidelines around four elements. They cover oversight and accountability, lifecycle risk management, third-party AI and risk-proportionate application.

On oversight, boards and senior management are expected to oversee AI risks, set roles, define risk appetite and put frameworks in place. MAS said firms can use their existing governance structures. A dedicated AI committee is not required.

On lifecycle management, firms should keep an inventory of their AI use and assess the materiality of each use case. They should then apply controls in proportion to that assessment. The controls named by MAS cover data governance, testing, human oversight, cybersecurity, monitoring and change management.

The inventory step will be familiar to teams that already maintain a model inventory under model risk management programs. The difference is breadth. The guidelines reach AI embedded in vendor products and business tools, which sit outside many model inventories today.

Third-party and generative AI under MAS guidelines

Firms remain accountable for AI used in their services, including AI supplied by third parties. MAS expects them to obtain sufficient assurance from providers and to check that the AI is suitable for its intended use. Where practical limits or assurance gaps remain, firms should apply compensating controls.

If the risks cannot be brought within the firm’s risk appetite, the firm should consider limiting, suspending or replacing the service. That is a procurement and exit-planning expectation as much as a model validation one.

It also changes the scope of third-party risk management. A vendor’s AI feature now needs an entry in the third-party inventory, a materiality rating and evidence of assurance. The third-party risk management template pack covers the inventory and due diligence fields most teams will need to extend.

The guidelines apply to all forms of AI technologies. The November 2025 consultation paper named generative AI and AI agents specifically. MAS said it plans to consult the industry in 2027 on additional guidance for agentic AI, so firms using autonomous agents should expect a further layer of expectations.

Proportionality and how MAS will supervise

The fourth element is proportionality. Firms whose AI performance issues or outages are unlikely to have a material impact may use basic policies and procedures. Control sophistication should match risk exposure.

The guidelines set supervisory expectations rather than prescriptive rules. They build on MAS’s 2024 thematic review of AI use at key banks and on its discussions with firms. In practice, supervisors will test firms against the expectations during their regular engagement. MAS said it will work with industry to advance sound AI risk management under the guidelines in a practical way.

Proportionality does not remove the work for smaller firms. A firm with limited AI use still needs to show that it has found its AI use, judged its materiality and recorded why basic controls are enough. That judgment becomes the evidence a supervisor will ask to see.

From consultation to final MAS AI risk management guidelines

MAS published the consultation paper on November 13, 2025. It closed on January 31, 2026. The paper proposed that firms assess risk materiality across three dimensions: impact, complexity and reliance. It also proposed a 12-month transition after issuance.

The final text keeps the key expectations. MAS said respondents supported the principles-based, risk-proportionate approach. They asked for clarity on how firms can use existing governance structures, how to treat AI risks embedded in other systems and when basic policies and procedures are enough. MAS addressed those points in the final version, as set out in its response to feedback.

The transition period is now phased. Firms should meet the expectations in Sections 3 and 4 of the guidelines from October 7, 2027. They have until October 7, 2028 to meet the expectations in Sections 5 and 6. The consultation had proposed a single 12-month period, so the second phase is an additional 12 months for part of the text.

The consultation paper acknowledged that the maturity of AI risk management practices varies among firms. That variation is the stated basis for the transition period.

What the guidelines mean for compliance teams

Four workstreams follow from the text. The first is a firm-wide AI inventory that includes vendor-supplied AI. The second is a materiality method that ranks each use case and links it to a control set. The third is board and senior management reporting on AI risk. The fourth is a review of vendor contracts and assurance evidence for third-party AI.

Board reporting is the least developed of the four at many firms. The AI governance and board report template pack and the board compliance reporting template pack set out the structure of such a report. Firms already working to the UK Financial Conduct Authority’s AI observations will recognize some of the same themes.

Ho Hern Shin, Deputy Managing Director at MAS, said AI has significant potential to improve financial services. She added that realizing the benefits sustainably requires firms to understand and manage the risks.

MAS noted that the Financial Stability Board has consulted on sound practices for financial institutions’ responsible AI adoption. Groups with operations in several jurisdictions will want to map the Singapore expectations against those practices and against home-country rules.

What comes next for AI risk management at MAS

Three dates matter. MAS plans an industry consultation on agentic AI in 2027. The expectations in Sections 3 and 4 apply from October 7, 2027. The remaining expectations in Sections 5 and 6 apply by October 7, 2028.