The Monetary Authority of Singapore (MAS) has issued its finalised Guidelines on AI Risk Management for financial institutions.

Following a public consultation in November 2025, the framework sets out expectations for firms to manage risks across the AI lifecycle and address risks associated with third-party providers.

Under the guidelines, institutions can tailor their approach based on the scale and risk profile of their AI use.

Firms may also use existing governance structures to oversee these risks and do not need to establish dedicated AI committees.

MAS expects financial institutions to maintain inventories of their AI use and apply controls covering areas such as data governance, cybersecurity, testing, human oversight, monitoring and change management.

Institutions remain accountable for AI used in the services they deliver, including systems developed, operated or provided by third parties.

They should obtain sufficient assurance from providers and assess whether third-party AI is suitable for its intended use. Firms should also apply compensating controls where assurance gaps or practical constraints arise.

Where risks cannot be brought within an institution’s risk appetite, MAS said firms should consider limiting, suspending or replacing the third-party AI service.

Implementation will take place in phases. Sections 3 and 4 will take effect on 7 October 2027, while Sections 5 and 6 will apply from 7 October 2028.

MAS also highlighted the growing use of agentic AI systems that can operate autonomously and access tools.

In 2027, the regulator intends to consult the financial sector on what additional guidance for agentic AI would be useful.

Source link