MAS Guidelines on AI Risk Management: key expectations and timeline
The Monetary Authority of Singapore issued its Guidelines on Artificial Intelligence Risk Management on 7 October 2026. They apply to all MAS-regulated financial institutions and all forms of AI, in a risk-proportionate way. Expectations on board oversight, AI inventories and materiality assessment apply from 7 October 2027; life-cycle controls, capability and infrastructure expectations from 7 October 2028.
The guidelines followed a November 2025 consultation and are among the most detailed supervisory statements on AI in finance. They are useful well beyond Singapore as a practical benchmark.
What do the MAS guidelines expect?
- Board and senior management oversight with clear roles, risk appetite and frameworks.
- Identification of AI use, an AI inventory and a materiality assessment for each use.
- Life-cycle controls: data governance, transparency and explainability, fairness, human oversight, testing, cybersecurity, pre-deployment review, monitoring and change management.
- Formal independent validation before deployment for use cases of high materiality.
- Third-party AI managed under the same expectations, including concentration on key providers; if risk cannot be brought within appetite, limit, suspend or replace the service.
How do the MAS guidelines compare with SR 26-2?
| Topic | MAS Guidelines (Oct 2026) | SR 26-2 (Apr 2026) |
|---|---|---|
| Scope | All AI, including generative and agentic | Models and non-generative AI; excludes generative and agentic |
| Approach | Risk-proportionate | Risk-based by materiality |
| Inventory | Expected | Common industry practice |
| Third parties | Explicit, including concentration | Vendor models validated and monitored |
Primary sources (reviewed 17 Oct 2026)
- Monetary Authority of Singapore: Guidelines on Artificial Intelligence Risk Management (7 October 2026)
- Financial Stability Board: Sound Practices for Responsible Adoption of Artificial Intelligence, final report (15 October 2026)
- Federal Reserve, OCC and FDIC: SR 26-2, Revised Guidance on Model Risk Management (17 April 2026)
This page explains supervisory guidance in plain language. It is not legal advice; confirm how each text applies to your institution and jurisdiction.
Frequently asked questions
Do the MAS guidelines apply outside Singapore?
Legally only to MAS-regulated institutions, but group frameworks may be leveraged if they meet MAS expectations, and many regional institutions use them as a benchmark.
Put these controls to work this month
Start on the cloud risk management software within 24 hours, or ask for training or advice tailored to your institution.