Part of the AI Regulation News hub.
MAS issues final Guidelines on Artificial Intelligence Risk Management, with board oversight and AI inventories expected from October 2027, and third-party and lifecycle controls by October 2028
The final text follows the November 2025 consultation. It is a set of supervisory expectations, written mostly as what a financial institution "should" do, with a one-year runway for governance and a two-year runway for lifecycle controls.
Bottom line: These are final MAS Guidelines, dated 7 October 2026, that set out supervisory expectations for how financial institutions manage AI risk. The text we read is phrased as what an institution "should" do and cites no penalty, so treat it as the supervisor's stated expectations rather than a statute. Nothing in it applies before 7 October 2027.
Who this affects: Boards and senior management, chief risk and compliance officers, model-risk and internal-audit leads, and third-party and procurement teams at MAS-regulated banks, insurers, fund managers, capital markets licensees and payment institutions, plus the counsel who advise them.
Issue date: 7 October 2026 (the date on the Guidelines and the MAS media release). The Guidelines take effect on 7 October 2027. Sections 3 and 4 are expected from that date, and Sections 5 and 6 by 7 October 2028.
What changed: The consultation draft of November 2025 became a final text. MAS says it kept the key expectations and refined them after feedback. Existing governance structures may be used, a dedicated AI committee is not required, and an institution stays accountable for AI it takes from third parties.
Analysis: On our reading, the phasing is the planning point. The identification, inventory and risk-materiality work in Section 4 is due first and feeds every later control, so an institution that has no AI inventory yet has a year to build one before the lifecycle controls arrive. That ordering is our inference from the Guidelines, not a statement by MAS.
Primary sources: Guidelines on Artificial Intelligence Risk Management (PDF, 30 pages) · MAS media release, 7 October 2026 · MAS guidelines page
- Instrument (EN)
- Guidelines on Artificial Intelligence Risk Management (final), 7 October 2026
- Authority
- Monetary Authority of Singapore (MAS)
- Jurisdiction
- Singapore
- Status
- Final; issued 7 October 2026; not yet in effect
- Bindingness
- Supervisory expectations. The text we read uses "should" and cites no penalty. It cites the Financial Services and Markets Act 2022 and the Cybersecurity Act 2018 only for definitions; we did not verify its enforcement footing
- Issue date / next deadline
- Issued 7 October 2026. Effective 7 October 2027. Sections 5 and 6 by 7 October 2028
- Predecessor
- MAS consultation on the draft Guidelines, November 2025 (named in the media release)
- Scope
- All financial institutions and all forms of AI, applied in proportion to size, risk profile and risk materiality, per the MAS media release
- Primary source
- https://www.mas.gov.sg/-/media/mas-media-library/regulation/guidelines/bd/guidelines-on-artificial-intelligence-risk-management-for-financial-institutions/guidelines-on-artificial-intelligence-risk-management.pdf
Who is covered, and how much of it applies?
The MAS media release says the Guidelines "apply to all FIs and all forms of AI technologies" while letting each institution decide how to meet them given the nature and scale of its AI use. The Guidelines themselves say: "The Guidelines apply to all FIs in a proportionate manner, according to their size and risk profile." The AI definition covers machine learning, generative AI and AI agents, and excludes tools whose outputs follow only predefined rules.
Proportionality has a floor. An institution may apply basic AI governance policies if poor performance or loss of the AI tool is unlikely to have a material adverse impact on it, its customers or other stakeholders. The Guidelines list low-stakes examples, such as drafting or proofreading customer emails and summarising meeting notes, and attach a human-review footnote. For those uses the text lists minimum elements: a named senior owner, permitted and prohibited uses, an approved tool list, staff education, compliance checks and periodic review.
For locally incorporated institutions that are under consolidated MAS supervision, or own critical information infrastructure, the Guidelines apply on a group basis. Local senior management stays accountable for making sure any group framework fits Singapore requirements.
What does Section 3 ask of the board?
The board, or a committee it delegates to, is asked to approve and regularly review the overall approach to AI risk, make sure AI risk sits inside the risk appetite framework, set roles for the board and senior management, and keep enough understanding of AI to challenge management. Senior management is asked to implement the frameworks, set an escalation route for AI incidents and threshold breaches, brief the board on material issues, and resource the work.
The release is explicit on structure. Existing governance structures may be used where they give adequate oversight, and the release says "FIs need not establish a dedicated AI committee solely to meet this expectation." The Guidelines allow either a new central function or the existing risk functions, provided the result is consistent and coordinated.
What do identification, inventory and materiality involve?
Section 4 asks for systems to identify AI use across the business, including AI embedded in services from material third-party providers, with a designated control function that decides whether a given use counts as AI. It asks for an accurate inventory of AI use cases, systems or models, with a stated update frequency and links to other inventories such as outsourcing registers.
The Guidelines list possible inventory attributes: purpose, approved scope of use, model type, data used, dependencies, lifecycle status, risk materiality rating, review status, owners and documentation links. For AI agents, a footnote suggests agent identifiers and the tools the agent can reach.
Each use case then gets a risk materiality assessment covering impact, complexity and reliance, looking at inherent and residual risk. The residual risk is to be inside risk appetite before deployment. A control function approves the rating.
What changes for third-party AI?
This is the part with the clearest allocation of blame. The Guidelines say: "The decision to onboard and use third-party AI is ultimately a decision of the FI, and the FI retains primary accountability for its use of third-party AI". The media release adds that if the risks cannot be brought within risk appetite, the institution should consider limiting, suspending or replacing the service.
Section 5 sets out factors to weigh, including provider transparency, supply chain checks, concentration risk, change notification, contingency plans, contract terms such as audit rights and notice when AI is introduced or updated, staff capability and complexity. It also asks for testing of third-party AI on the institution's own use cases and own data, with compensating tests where the provider discloses too little. A footnote says MAS outsourcing and third-party service expectations also apply.
What is the timetable, and what is still to come?
The Guidelines say they "take effect on 7 October 2027". Institutions "may meet" the Section 3 and 4 expectations from that date and the Section 5 and 6 expectations by 7 October 2028. Section 5 covers lifecycle controls from data management through change management and decommissioning. Section 6 covers staff capability and technology infrastructure.
On agentic AI, the release says: "In 2027, MAS intends to further consult the financial sector on what additional guidance on agentic AI would be useful." That is an intention to consult, not a draft rule. The Guidelines say they will be updated or added to as needed.
What we did not verify
What we opened: the 30-page Guidelines PDF on the MAS site, read in full as extracted text, and the MAS media release of 7 October 2026. We also opened the MAS guidelines page to locate the PDF. Quotations were matched against that text.
What we did not open: the MAS response to feedback paper that the release mentions, the November 2025 consultation draft, the MAS outsourcing and technology risk guidelines the text cites, and any MAS statement on how supervisors will assess compliance. We did not compare the final text line by line with the draft.
What we refuse to claim: that the Guidelines carry legal sanctions or that any institution is compliant; how MAS will treat a missed phase date; or that the sequencing advice in our analysis reflects MAS intent. The statement that the dates are staggered comes from the Guidelines; the planning inference is ours.
Informational analysis for working professionals, not legal advice. Confirm how any rule applies to your situation with qualified counsel.
A Singapore institution has until October 2027 to show board-level ownership of AI risk and a working way to find AI, list it and rate it, and until October 2028 for lifecycle controls and capability. The third-party clause is the one to test now. If a vendor will not disclose enough to support a rating, the Guidelines expect compensating controls or a decision to limit the use.
Source File
Open the PDF and confirm the title and the date 7 October 2026 on page 1. Read paragraph 1.8 for the effective date and phasing, Section 2 for proportionality, Section 4 for the inventory and materiality expectations, and paragraphs 5.10 and 5.11 for third-party AI. Then open the MAS media release and compare its paragraph 5.
The decision to onboard and use third-party AI is ultimately a decision of the FI, and the FI retains primary accountability for its use of third-party AI ยท MAS, Guidelines on Artificial Intelligence Risk Management, 7 October 2026, para 5.11
FAQ
Are the MAS AI risk management Guidelines legally binding?
They are issued as MAS supervisory expectations. The text we read says institutions "should" do things and cites no penalty. We did not verify what enforcement route MAS would use.
When do the Guidelines take effect?
On 7 October 2027. Institutions may meet the expectations in Sections 3 and 4 from that date and the expectations in Sections 5 and 6 by 7 October 2028.
Does an institution need a dedicated AI committee?
The MAS media release says it need not establish one solely to meet the oversight expectation, and existing governance structures may be used where they give adequate oversight and cross-functional coordination.
Is the institution still accountable for AI it buys from a vendor?
On the Guidelines, yes. Paragraph 5.11 says the institution retains primary accountability for its use of third-party AI, and the release says it should consider limiting, suspending or replacing a service whose risks it cannot bring within risk appetite.
Related briefings
Sponsored Training
Practical AI training for regulated professionals, built around verification, documentation and a defensible process. See the courses.