MAS proposes new guidelines on AI risk management

The Monetary Authority of Singapore (MAS) has released a consultation paper proposing a comprehensive set of Guidelines on AI Risk Management (AIRG) to provide financial institutions (FIs) with clear direction on the responsible deployment and governance of AI within the financial sector. These proposed guidelines, intended to apply to all FIs, articulate MAS’s supervisory expectations concerning board and senior management oversight of AI, the design of key risk management systems, the establishment of effective policies and procedures, the implementation of robust AI lifecycle controls, and the requisite capabilities and capacity for AI utilization.

The AIRG represents a logical and crucial progression from MAS’s earlier work, particularly the foundational Fairness, Ethics, Accountability, and Transparency (FEAT) Principles. The current consultation paper, however, distinguishes itself by emphasizing the necessity of treating AI as a distinct, powerful source of risk that FIs must manage separately from general IT governance frameworks. A pivotal feature of the guidelines is the principle of risk-based and proportionate application, wherein supervisory expectations are scaled commensurate with an FI’s size, the complexity of its operations, and the overall scale of its AI use. This proportional approach underscores the delicate balance MAS seeks to maintain between instituting clear guardrails to mitigate emerging risks and avoiding the unintended consequence of stifling innovation.

The guidelines establish clear expectations across several key pillars of responsible AI management. The first emphasizes Governance and Oversight, placing a clear mandate on Boards and Senior Management to assume central responsibility. This includes ensuring that AI deployment aligns with the firm’s defined risk appetite and requires rigorous challenge of major AI decisions. The second pillar concerns the AI Risk Management System itself, mandating that FIs systematically identify all areas of AI use and maintain accurate, comprehensive AI inventories to ensure full and continuous visibility across the enterprise. Thirdly, MAS requires the implementation of robust controls across the entire AI lifecycle, from data input through to deployment. This encompasses critical areas such as data management, ensuring fairness, transparency, and explainability, establishing necessary human oversight mechanisms, and effectively managing third-party risks associated with vendor-supplied AI models. Finally, FIs are expected to demonstrate that they possess sufficient internal capacity and capabilities, both in terms of enabling technology and adequately skilled personnel, to manage AI responsibly and effectively.

While the guidelines are designed to enhance risk resilience, the increase in compliance requirements inherently introduces potential costs and operational challenges. Firstly, the requirement for FIs to maintain detailed AI inventory checks and conduct regular, sophisticated materiality assessments will impose an operational burden on all institutions, regardless of size. Secondly, meeting the demand for model explainability poses a significant fundamental technical challenge, particularly for complex, opaque machine learning systems. Addressing this will necessitate substantial investment in specialized AI governance tools and expertise. Thirdly, there is a risk that the increased cost and complexity associated with meeting these compliance standards may inadvertently slow down innovative AI projects that could otherwise yield greater operational efficiency for FIs.

It is important to note that this is currently a consultation paper, with the consultation period scheduled to remain open until January 2026. Following the finalization of the guidelines, FIs will be afforded a twelve-month transition period to adjust their systems and practices accordingly, allowing MAS time to refine and issue the final regulatory framework.

In the global context, while other regulators, such as those developing the European Union’s AI Act or the varied regulatory guidance emerging in the US, have approached AI regulation with differing scopes and levels of prescriptiveness, MAS has deliberately crafted a bespoke regulatory framework focused specifically on the financial sector. This sectoral focus aims to strike a carefully considered, fairly neutral stance that prioritizes the prudent balancing of innovation with risk management, aligning with Singapore’s ambition to be a leading responsible financial hub.