Singapore’s financial institutions can no longer treat outsourced AI as somebody else’s problem. The Monetary Authority of Singapore (MAS), the city-state’s central bank and financial regulator, has published guidelines that hold firms answerable for any AI embedded in their services, whether built in-house or sourced from an outside provider.

According to CNA, under the framework, released on 7 October, firms must evaluate and control the risks arising from their AI deployments, including systems that a third party designs, runs or supplies.

MAS explained its expectations in a media release, stating, “Financial institutions should obtain sufficient assurance from third-party providers, assess whether third-party AI is suitable for their intended use, and apply compensating controls where practical constraints or assurance gaps arise.” Where a firm still cannot bring the risk within its tolerance levels, it is expected to weigh restricting, pausing or swapping out the external AI service.

The rules come into force on 7 October 2027. Institutions may adopt them in stages but must achieve full compliance by 7 October 2028.

The framework asks firms to oversee AI risk across the whole organisation as well as for each specific application, and to strengthen their expertise as adoption grows.

In practice, this means cataloguing where AI is used, keeping up-to-date inventories, grading the risk of each application and applying safeguards scaled to that risk at every stage of the AI life cycle. Those safeguards span data governance, testing, human oversight, cybersecurity, monitoring and change management.

MAS stressed that these controls need periodic review as deployment widens and the technology matures.

Source link