AI Governance / Regulation / Data Quality
Singapore's MAS sets AI risk management expectations for financial institutions, phased from 2027
The guidelines cover machine learning, generative AI and AI agents, and require AI inventories, risk materiality assessments and senior management accountability, according to a contributed IAPP analysis.
The Monetary Authority of Singapore (MAS) issued its Guidelines on Artificial Intelligence Risk Management for Financial Institutions on 7 October, according to a contributed analysis by Hogan Lovells partner Charmian Aw published by the IAPP. The guidelines set out supervisory expectations for governing, developing, deploying and monitoring AI.
The definition of AI is broad. It covers machine learning, foundation models, large language models, generative AI and AI agents, while deterministic rule-based automation generally falls outside scope. Low-impact use cases may follow simplified procedures. Institutions must still keep an AI inventory, define permitted and prohibited uses and carry out periodic reviews. Accountability rests with senior management, and outsourcing to vendors does not reduce the institution’s responsibility.
Governance and oversight requirements apply from 7 October 2027. Life cycle and capability requirements follow from 7 October 2028. These cover data management, explainability, human oversight, testing, cybersecurity, monitoring and decommissioning.
Editor’s note: This article relies on a contributed opinion piece by a law firm partner published by the IAPP, not on the MAS document itself.
Why it matters
The MAS guidelines set supervisory expectations for AI inventories, risk materiality assessments and decommissioning, which the analysis says should not leave retired systems holding data that ought to have been deleted. Firms with operations in Singapore should check that their AI inventory covers generative AI and agents, not only traditional models. They should also confirm that vendor contracts say whether providers, and their upstream model providers, may retain or use customer data to train models. Data management is listed among the life cycle expectations, so data owners should review the quality of data feeding AI systems.
Status: Published. Governance requirements apply from 7 October 2027, life cycle ones from 2028
Key dates
- MAS AI guidelines: governance and oversight requirements take effect
- MAS AI guidelines: life cycle and capability requirements take effect
Sources
Was this useful?
Thanks. What was the problem?
Thank you — this helps us choose what to cover. If you spotted an error, please tell us what it is.
Prepared with AI assistance and reviewed by the editor before publication. Spotted an error? Tell us — see our editorial policy and methodology.
Governance areas
Who should care
- AI governance lead
- Legal & compliance
- DPO
- CDO