Singapore · Financial institutions
MAS AI Risk Management Guidelines: What They Require and How to Prepare (2026)
A plain-English guide for banks, insurers and other MAS-regulated firms: who the guidelines cover, the 2027 and 2028 dates, what MAS expects, and a 90-day plan to get ready.
Short answer
What are the MAS AI Risk Management Guidelines?
The MAS Guidelines on Artificial Intelligence Risk Management apply to all financial institutions regulated by the Monetary Authority of Singapore, in proportion to their size and risk profile. They were issued on 7 October 2026 and take effect on 7 October 2027. MAS expects board oversight, an AI inventory, a risk materiality assessment for each AI use case, and life cycle controls that match that materiality.
Status as at November 2026
- Status
- Final guidelines, issued by MAS on 7 October 2026
- Takes effect
- 7 October 2027: oversight, AI identification, AI inventory and risk materiality (Sections 3 and 4)
- Later deadline
- 7 October 2028: AI life cycle controls and AI capability and capacity (Sections 5 and 6)
- Applies to
- All MAS-regulated financial institutions, proportionately; on a group basis for some locally incorporated FIs
Source: MAS, Guidelines on Artificial Intelligence Risk Management (paragraph 1.8; checked November 2026).
Scope
Who do the MAS AI Risk Management Guidelines apply to?
- All financial institutions as defined in the Financial Services and Markets Act 2022: banks, insurers and reinsurers, capital markets services licensees, financial advisers, payment institutions, insurance brokers, trust companies and the other licence types listed on the MAS page (paragraph 1.1).
- Proportionately: implementation should match the size and nature of your activities and how far your AI use could create material risk (paragraphs 1.6 and 2.1).
- On a group basis for locally incorporated FIs under MAS consolidated supervision or that own critical information infrastructure (paragraph 1.2).
- Every kind of AI, including generative AI and AI agents. Rule-based tools, fixed formulae and robotic process automation without learning are not AI for these guidelines (paragraphs 1.3 and 1.5).
- A global group's AI framework can be used if it meets the guidelines, but local senior management stays accountable for Singapore (paragraphs 1.5 and 3.6).
If you are not MAS-regulated, the guidelines do not bind you directly. They are still a useful benchmark for a mature AI inventory and risk process, for example for Malaysian firms and for vendors to Singapore financial institutions.
Requirements
What does MAS expect? Expectations, practice and the template that covers each
The guidelines group MAS's supervisory expectations into oversight, key systems and policies (identification, inventory, risk materiality), life cycle controls, and capability and capacity. Controls scale with the risk materiality of each AI use case.
| MAS expectation | What it means in practice | AI Governance Kit document |
|---|---|---|
| Board and senior management oversightSection 3 | What it means in practiceThe board, or a committee it delegates, approves the AI governance approach and puts AI risk into the risk appetite framework. Senior management runs it day to day, sets roles across business lines, escalates AI incidents and keeps the board informed. | AI Governance Kit document
|
| AI identificationParagraphs 4.2–4.4 | What it means in practiceOne definition and process to find AI across every business unit, including AI inside services from material third-party providers. A designated control function decides what counts as AI. Residual risk from AI you cannot see, such as shadow AI, must stay within risk appetite. | AI Governance Kit document
|
| AI inventoryParagraphs 4.5–4.9 | What it means in practiceAn accurate inventory of AI use cases, systems or models, updated at a set frequency and linked to your data and third-party registers. Attributes may include purpose, approved scope, model type, data used, dependencies, life cycle status, risk materiality rating, review status and owners. | AI Governance Kit document
|
| AI risk materiality assessmentParagraphs 4.10–4.13 | What it means in practiceA methodology applied to every AI use case, covering at least impact, complexity and reliance. Assess both inherent and residual materiality; residual materiality must be within risk appetite before deployment. A control function approves the rating. | AI Governance Kit document
|
| AI life cycle controlsSection 5 | What it means in practiceControls from inception to retirement, scaled to materiality: data management, transparency and explainability, fairness, human oversight, third-party AI, selection, evaluation and testing, cybersecurity, pre-deployment review, monitoring, change management and decommissioning. High-risk use cases need tested contingency plans. | AI Governance Kit document
|
| Monitoring and re-validationParagraphs 5.23–5.24 | What it means in practiceOngoing monitoring of all deployed AI, including third-party AI, and re-validation set by materiality. High-materiality use cases are re-validated regularly by independent parties; alerts, breaches and significant changes trigger a review. | AI Governance Kit document
|
| AI incidents and escalationParagraph 3.5 | What it means in practiceAn internal escalation process for AI incidents and breaches of risk thresholds, with timely action and updates to the board on material AI risk issues. | AI Governance Kit document
|
| Capability and capacitySection 6 | What it means in practiceCompetent people for developing, deploying and using AI, with training and resources proportionate to the risk, and technology infrastructure adequate for the AI in use. | AI Governance Kit document
|
| Basic AI governance (low-impact use only)Paragraphs 2.3–2.5 | What it means in practiceWhere poor performance or outage of your AI tools is unlikely to have a material adverse impact, a shorter set of policies is enough (listed below the table). | AI Governance Kit document
|
Versioned IDs are free documents you can preview now; documents marked (member) are in the full kit. The kit supports your evidence; it does not make you compliant on its own, and MAS does not name or approve any template or provider.
Basic AI governance: the minimum for low-impact AI use
Drafting customer emails, summarising internal documents, generating charts and internal search chatbots are MAS's examples of AI use that generally qualifies (paragraph 2.4). Basic governance should at least include:
- A named senior manager accountable for AI oversight.
- Permitted and prohibited uses of AI, including when human review of AI output is mandatory.
- An approved list of AI tools and a process to request new ones.
- Staff education on your AI policies.
- Regular compliance checks.
- Periodic and trigger-based review of whether your AI use still qualifies as low impact.
Source: paragraph 2.5. Our AI acceptable use policy template covers permitted and prohibited uses, the approved tool list and the request process.
Malaysia and Singapore
How do the MAS guidelines relate to BNM RMiT?
They are different instruments. BNM RMiT is Bank Negara Malaysia's Risk Management in Technology policy for Malaysian financial institutions, covering technology governance, cyber, resilience, cloud and third-party risk. The MAS guidelines are specific to AI and apply to Singapore financial institutions.
For a group supervised in both markets, the practical answer is one set of AI governance records, not two: one AI inventory, one risk materiality method and one review cycle, with the evidence mapped to each regulator. MAS itself expects the AI inventory to link to your other inventories, such as data and third-party or outsourcing registers (paragraph 4.6).
Have your compliance team or counsel confirm how each regulator's requirements apply to your entities.
Preparation
A 90-day plan to prepare for the MAS AI guidelines
Sections 3 and 4 take effect on 7 October 2027. This plan gets the oversight, inventory and risk materiality work in place well before then, and leaves time for the 2028 life cycle controls.
Days 1–30
Own it and find the AI
- Name the senior manager accountable for AI and the control function that will rule on AI identification, the inventory and risk materiality.
- Adopt one written definition of AI, using the MAS definition and its exclusions for rule-based tools.
- Run discovery: staff survey, expense and SaaS data, and AI features inside services from material third-party providers.
- Record everything found in an AI register from day one.
Days 31–60
Rate every use case
- Write a risk materiality method covering impact, complexity and reliance, rating both inherent and residual risk.
- Rate each use case in the register and agree the ratings with the control function.
- Separate low-impact uses (drafting, summarising, internal search) that qualify for basic governance.
- Publish the acceptable use policy, approved AI tool list and request process; collect staff acknowledgements.
Days 61–90
Board approval and the 2028 roadmap
- Take the AI governance approach and AI risk appetite statements to the board or its delegated committee.
- Set the escalation path for AI incidents and the inventory update frequency.
- Run a gap analysis of high-materiality use cases against the Section 5 life cycle controls.
- Plan the remaining life cycle and capability work to finish before 7 October 2028.
Start with the free AI system register (AGK-TPL-01 v1.0) and the AI governance guide for Malaysia and Singapore.
Free AI Governance Lite pack
The documents an organisation starting out needs to govern AI tools in its first 90 days. Word and Excel, ready to edit.
- Lite Quick Start and Control Checklist AGK-001 · Word
- AI Governance Framework and Document Architecture AGK-000 · Word
- AI Acceptable Use Policy AGK-POL-02 · Word
- AI Data Handling Standard AGK-STD-A02 · Word
- AI Discovery and Shadow AI Procedure AGK-PRC-07 · Word
- AI Adoption Roadmap and Use-Case Prioritisation Guide AGK-GDL-C02 · Word
- AI System Register AGK-TPL-01 · ExcelPreview AI System Register
- AI Use Case Intake Form AGK-TPL-03 · Word
- AI Incident, Nonconformity and CAPA Log AGK-TPL-06 · ExcelPreview AI Incident, Nonconformity and CAPA Log
- AI Acceptable Use Acknowledgement AGK-TPL-07 · Word
- Pengakuan Penggunaan AI (Bahasa Melayu) AGK-TPL-07-BM · Word
- AI Use-Case Prioritisation and Benefits Tracker AGK-TPL-12 · ExcelPreview AI Use-Case Prioritisation and Benefits Tracker
Template release v1.0 · ZIP · 990 KB
Download AI System Register and the Lite pack
Templates for governance purposes, not legal advice.
Governance Setup Sprint
Want the inventory and risk process set up with you?
We run a governance setup sprint with your risk and technology teams: accountable owners, AI policy, the AI register populated from discovery, and a risk materiality method your control function can approve. Your compliance team and counsel stay in charge of interpretation.
Book an online meetingMAS AI Risk Management Guidelines FAQ
Do the MAS AI Risk Management Guidelines apply to us?
They apply if you are a financial institution regulated by MAS: banks, insurers, capital markets services licensees, financial advisers, payment institutions, insurance brokers and the other licence types MAS lists. They apply proportionately to your size and risk profile. If you are not MAS-regulated, they do not bind you, but they are a useful benchmark.
When do the MAS AI Risk Management Guidelines apply?
MAS issued the final guidelines on 7 October 2026 and they take effect on 7 October 2027. From that date, financial institutions may meet the oversight, identification, inventory and risk materiality expectations in Sections 3 and 4. The life cycle controls and capability expectations in Sections 5 and 6 are due by 7 October 2028.
What is AI risk materiality?
AI risk materiality is how much harm an AI use case could cause, rated with a consistent method. MAS expects the rating to cover at least impact on the institution and its customers, complexity of the technology and data, and reliance on the AI, including its autonomy. Higher materiality means stricter controls and more scrutiny.
Do we need an AI inventory?
Yes. MAS expects an accurate inventory of AI use cases, systems or models across the institution, updated at a set frequency and linked to your data and third-party registers. It should record attributes such as purpose, data used, dependencies, life cycle status, risk materiality rating and owners. A control function oversees its accuracy.
How do the MAS guidelines compare with BNM RMiT?
They do different jobs. BNM RMiT is Bank Negara Malaysia's technology risk policy for Malaysian financial institutions; the MAS guidelines set AI-specific expectations for Singapore financial institutions. A group regulated in both markets can keep one AI inventory and one risk materiality method, then map that evidence to each regulator.
Do the guidelines cover generative AI and AI agents?
Yes. The guidelines apply to all forms of AI, including generative AI and newer developments such as AI agents. MAS notes that agents with access to tools can amplify risk, and suggests recording agent-specific attributes in the inventory, such as the tools and systems an agent can reach and its guardrails.
What if we only use AI for low-risk tasks like drafting emails?
If poor performance or outage of your AI tools is unlikely to have a material adverse impact, MAS allows basic AI governance: an accountable senior manager, permitted and prohibited uses, an approved tool list, staff education, compliance checks and periodic review. Drafting emails and summarising internal notes are among MAS's examples.
Can we use our group's global AI framework?
Yes, if the group framework meets the expectations in the guidelines. Local senior management remains accountable for making sure it addresses Singapore requirements, needs timely reports on Singapore operations and must be able to show MAS how it discharges its oversight, even when relying on the group framework.
Sources: MAS guidelines page and the guidelines (PDF, 7 October 2026), checked November 2026. Part of the AI governance guide for Malaysia and Singapore; see also the template library.
