MAS issued final Guidelines on Artificial Intelligence Risk Management on October 7, 2026, closing the loop on Consultation Paper P017-2025 of November 13, 2025. The Guidelines retain the consultation's core structure — board and senior-management oversight, AI use-case identification and inventory, risk-materiality assessment, and lifecycle controls proportionate to that materiality — and apply to all financial institutions, including banks, covering generative AI and AI agents. Institutions are expected to meet the oversight and risk-management-system expectations (Sections 3 and 4) from October 7, 2027, with the lifecycle-control expectations in Sections 5 and 6 due by October 7, 2028.
OFFICIAL TEXT: mas.gov.sg ↗ · FINAL · APPLIES FROM OCT 7, 2027 · MAS
| Document | MAS Guidelines on Artificial Intelligence Risk Management — Guidelines on Artificial Intelligence Risk Management for Financial Institutions |
| Issued by | Monetary Authority of Singapore |
| Type | Guidance |
| Status | Final · applies from Oct 7, 2027 |
| Published | Oct 7, 2026 |
| Effective | Oct 7, 2027 |
| Applies to | All financial institutions regulated by MAS, including full, merchant and wholesale banks and banking financial holding companies, trust businesses, capital markets entities, financial advisers, payment institutions and payment system operators, insurers and brokers, credit card issuers, finance companies and other MAS-regulated entities, applied proportionately to each institution's risk profile and scale of AI use. Covers all forms of AI technology, including generative AI and AI agents |
| Supersedes | MAS Consultation Paper P017-2025 (AI Risk Management Guidelines) |
| Official source | mas.gov.sg ↗ |
| Use cases | AI governance (general) · Model risk management · Generative & agentic AI · Third-party & vendor AI · Fair lending & discrimination · Cybersecurity |
What are the key points of MAS Guidelines on Artificial Intelligence Risk Management?
- Confirms the four focus areas from the consultation: board/senior-management oversight and accountability; AI risk-management systems (identification, inventory, materiality assessment); AI lifecycle controls; and capabilities and capacity commensurate with AI use.
- A dedicated cross-functional AI committee remains expected where an institution's overall AI risk exposure is material.
- Institutions must identify AI use consistently and keep an accurate, up-to-date AI inventory, assessing materiality across at least impact, complexity and reliance.
- Lifecycle controls — data management, fairness, transparency and explainability, human oversight, third-party AI risk, model selection, testing, cybersecurity, reproducibility and auditability, monitoring and change management — apply proportionately to each use case's materiality.
- A response-to-feedback paper accompanies the Guidelines, addressing comments received during the consultation that closed January 31, 2026.
- Phased transition: Sections 3 and 4 (oversight and risk-management systems) apply from October 7, 2027; Sections 5 and 6 (lifecycle controls and capabilities) apply from October 7, 2028 — a 12-month and 24-month runway from issue, respectively.
- Supersedes Consultation Paper P017-2025 as MAS's first AI-specific supervisory guideline for financial institutions.
What did MAS Guidelines on Artificial Intelligence Risk Management change for banks?
This finalises what was MAS's first AI-specific supervisory guideline, converting the November 2025 proposal into issued Guidelines after MAS reviewed consultation feedback. The core expectations are largely unchanged from the draft — board oversight, an AI inventory, materiality-based lifecycle controls, and proportionate application by risk profile — with the main new information being the phased transition dates (Sections 3-4 from October 2027, Sections 5-6 from October 2028) in place of the consultation's single proposed 12-month runway.
Are the MAS AI Risk Management Guidelines final?
Yes. MAS issued the final Guidelines on Artificial Intelligence Risk Management on October 7, 2026, after a consultation (Paper P017-2025) that ran from November 13, 2025 to January 31, 2026.
When do the MAS AI Risk Management Guidelines take effect?
Institutions are expected to meet the board-oversight and AI risk-management-system expectations (Sections 3 and 4) from October 7, 2027. The lifecycle-control and capabilities expectations (Sections 5 and 6) are due by October 7, 2028.
Do the final Guidelines apply to banks and cover generative and agentic AI?
Yes. They apply to all MAS-regulated financial institutions, including banks, applied proportionately to each institution's risk profile and scale of AI use, and cover all forms of AI technology including generative AI and AI agents.
| Date | Document | Status |
|---|---|---|
| Nov 13, 2025 | MAS Consultation Paper P017-2025 (AI Risk Management Guidelines) — Consultation Paper on Guidelines on Artificial Intelligence Risk Management | Superseded |
| Mar 20, 2026 | MAS MindForge AI Risk Management Toolkit — AI Risk Management: Operationalisation Handbook (Project MindForge AI Risk Management Toolkit) | Final |
| Sep 18, 2025 | MAS Circular MAS/TCRS/2025/06 — Cyber Risks Associated with Deepfakes (Information Paper) | In force |
| Dec 5, 2024 | MAS AI Model Risk Management information paper — Artificial Intelligence Model Risk Management: Observations from a Thematic Review (Information Paper) | Final |
| Jul 30, 2024 | MAS Circular MAS/TCRS/2024/05 — Cyber Risks Associated with Generative Artificial Intelligence (Information Paper) | In force |
| Nov 12, 2018 | MAS FEAT Principles — Principles to Promote Fairness, Ethics, Accountability and Transparency (FEAT) in the Use of Artificial Intelligence and Data Analytics in Singapore's Financial Sector | In force |
Follow every document these regulators publish
when one of these regulators moves, the next morning's brief says so · six sourced stories · 7 am ET · free
plus every tracker, bank and agent page update, the morning after · leave any morning