MAS Guidelines on Artificial Intelligence Risk Management

Applies To

Overview

The MAS Guidelines on Artificial Intelligence Risk Management establish a structured approach for financial institutions to govern AI systems from initial development through decommissioning. Regulated firms must maintain a comprehensive inventory of AI systems, assign risk tiers to each, and apply proportionate controls based on that classification. Board and senior management are expected to take clear ownership of AI risk, integrating it into existing enterprise risk management frameworks rather than treating it as a standalone technical concern. Third-party AI vendors and model providers must be subject to adequate assurance processes, meaning firms cannot rely on a vendor's word alone that their AI behaves as intended. MAS expects core governance structures and inventories to be in place by 2027, with more advanced lifecycle management capabilities, including monitoring and validation processes, operational by 2028. Non-compliance may result in supervisory engagement, remediation requirements, or regulatory action consistent with MAS's broader supervisory toolkit.

Key Requirements

• •Establish and maintain a complete inventory of all AI systems in use, categorized by risk level, with governance structures operational by 2027.
• •Assign board and senior management accountability for AI risk, with clear ownership documented within enterprise risk governance frameworks.
• •Apply risk-based lifecycle controls covering design, validation, deployment, monitoring, and decommissioning of AI systems, with full lifecycle capabilities expected by 2028.
• •Conduct third-party assurance on externally sourced AI models and vendors, going beyond contractual representations to obtain independent evidence of model behavior and controls.
• •Integrate AI risk monitoring into ongoing risk management processes, with mechanisms to detect model drift, unexpected outputs, or changes in system behavior.
• •Align AI risk management practices with existing enterprise risk frameworks, rather than treating AI governance as a separate compliance exercise.
• •Implement controls spanning data quality, model testing, human oversight, cybersecurity, and change management across the AI lifecycle, not just at deployment.

What Your Organization Must Do

• →Audit all AI systems currently in use across the organization and build a formal inventory that captures system purpose, risk classification, and accountable owner before the 2027 governance deadline.
• →Assign named senior management and board-level sponsors for AI risk, and update governance charters and risk committee terms of reference to reflect this accountability.
• →Develop or update an AI risk classification methodology that maps each system to a risk tier and triggers proportionate controls based on that tier.
• →Review all third-party AI vendor contracts and request independent assurance documentation, such as model validation reports or audit findings, rather than relying solely on vendor representations.
• →Design and implement ongoing monitoring processes that can detect changes in AI model outputs or behavior, and establish escalation paths when anomalies are identified.
• →Engage your enterprise risk management team early to embed AI risk into existing frameworks, committees, and reporting cycles ahead of the 2028 lifecycle capability deadline.
• →Extend existing cybersecurity, model risk, and change management policies to explicitly cover AI-specific considerations, such as data quality and human oversight points, rather than treating AI governance as a standalone workstream.

Playbook Guidance

Step-by-step implementation guidance for compliance teams.

Frequently Asked Questions

Does MAS AIRM apply to third-party AI vendors used by Singapore financial institutions?

Yes. Financial institutions that procure AI from third-party vendors remain responsible for compliance under the guidelines. Firms should review vendor contracts now to ensure audit rights, model documentation, and risk management obligations are contractually enforceable before the guidelines are finalized.

Are agentic AI systems explicitly covered under the MAS AI risk management guidelines?

Yes: MAS said in a written parliamentary reply on 5 August 2026 that the Guidelines apply to all AI use cases, including agentic AI. Agentic systems face the same oversight, lifecycle controls, and records as other AI.

What is the current status of the MAS AIRM guidelines and when do they take effect?

The Guidelines are still proposed, and MAS said in August 2026 they will be finalised soon. MAS proposed a 12-month transition from issue for firms to implement them.

How do MAS AIRM expectations compare to the existing FEAT principles for financial institutions?

The FEAT principles address fairness, ethics, accountability, and transparency in AI use, while MAS AIRM introduces broader supervisory requirements covering lifecycle controls, model governance workflows, and audit trail obligations. FEAT serves as a useful baseline for board accountability structures, but AIRM is expected to impose more operationally detailed compliance requirements.

What level of board involvement is required under the MAS AI risk management framework?

Board and senior management must maintain documented oversight of all AI systems in use, including agentic AI deployments. This means assigning named accountability at the board level and ensuring that AI governance is embedded into existing senior management responsibility structures before the guidelines are finalized.

What model governance documentation will MAS expect financial institutions to produce under AIRM?

MAS expects defined approval workflows for AI models, particularly for high-risk or autonomous use cases, along with audit trails covering development, validation, deployment, monitoring, and decommissioning. Records must be available for MAS examination, meaning logging and documentation infrastructure should be in place well before any supervisory review.