On 7 October 2026 the Monetary Authority of Singapore (MAS) published its final Guidelines on Artificial Intelligence Risk Management for financial institutions. They follow a consultation that ran from November 2025. The guidelines apply to all financial institutions and all forms of AI. They are written as supervisory expectations, not as a statute with a fixed checklist. That choice matters, and on balance it is the right one.
What MAS actually requires
MAS says the guidelines take effect on 7 October 2027. According to the MAS announcement as republished by The Asian Banker, institutions may phase their implementation. Sections 3 and 4 apply from 7 October 2027, and Sections 5 and 6 by 7 October 2028.
The substance is a set of connected duties:
- Boards and senior management must oversee AI risk. Firms can use their existing governance structures, and a dedicated AI committee is not required.
- Firms must keep an inventory of their AI use and assess the materiality of each use case.
- Controls must be proportionate and cover the AI lifecycle: data governance, testing, human oversight, cybersecurity, monitoring and change management.
- Where the poor performance or unavailability of an AI system is unlikely to have a material impact, basic policies can suffice.
- Firms remain accountable for AI used in the services they deliver, including AI developed, operated or provided by third parties.
The strongest case for tougher rules
The argument for something harder than guidelines is serious. Banks and insurers make decisions that determine who gets credit, who gets paid and how fraud is policed. Models can fail quietly. Many firms buy their AI from a small number of vendors, so one defect can spread across the sector at once. A regulator that sets only expectations, a sceptic would say, leaves too much to firms' own judgment about what counts as "material".
That concern is legitimate. But the final text answers it better than a rigid rulebook would.
Why materiality is the right organising principle
A materiality test puts scrutiny where harm can occur. A credit-decisioning model and an internal tool that drafts meeting notes do not carry the same risk. Treating them alike would burn compliance resources on trivial systems and slow the adoption of useful ones. By letting firms apply basic policies to low-impact uses, MAS avoids the failure that blanket AI laws are most prone to: a flat obligation that is too heavy for small cases and still too vague for dangerous ones.
The inventory requirement is the quiet backbone of this approach. A firm cannot rank AI uses by materiality if it does not know what it is running. That is also useful for supervisors. They can ask to see the list and test whether the ranking is credible, which is a sharper tool than a prohibition list.
Dropping a mandatory AI committee is a smaller but telling decision. Committees are easy to create and easy to hollow out. By requiring accountability from boards and senior management, and letting firms reuse existing structures, MAS targets responsibility rather than organisational charts. A small fintech and a global bank can both comply without inventing a body that exists only to satisfy the rule.
The consultation was heeded
According to Blockhead's report, respondents backed the principles-based approach. They asked whether existing governance is sufficient, how to treat AI embedded in other software, and when basic policies are enough. MAS kept its core expectations and adjusted the detail. The staggered timeline reflects the same listening: roughly a year before the first sections bite, and two years for the rest.
Where the risk remains
The hardest provision is vendor accountability. Holding firms responsible for third-party AI is sensible: a bank cannot outsource its duty to customers. The guidance says firms should obtain sufficient assurance from providers, use compensating controls where gaps exist, and consider limiting, suspending or replacing a service that exceeds their risk appetite. The risk is practical. Foundation-model providers rarely open their training data or testing records to individual customers. If every firm demands bespoke assurance, smaller institutions will have little bargaining power, and the cost could favour the largest players. MAS should publish supervisory examples of what counts as "sufficient assurance" from a vendor that will not disclose its internals, so that firms are not left guessing.
Agentic AI is the other open question. The guidelines highlight the need to review controls as autonomous, tool-using systems spread. MAS says it intends to consult the sector in 2027 on what additional guidance would be useful. Waiting is defensible. Writing detailed rules for a fast-moving technology before supervisors have seen it deployed would risk locking in the wrong controls. But the consultation should be evidence-led, drawing on real incident data from firms already running agents, not hypotheticals.
What other regulators should take from this
The wider policy debate on AI often swings between moratoria and sweeping horizontal laws. Civil-liberties groups such as the EFF, in a September 2026 statement on California's AI executive order, argue that real safety means addressing concrete, immediate harms, and that regulation should be careful, precise and practical. MAS's approach fits that test. It is sector-specific, tied to demonstrable use cases, and built on a regulator that already knows its industry.
The lesson is not that guidelines are always enough. It is that a supervisor with existing authority can set clear expectations, scale them to risk, give firms years to adapt, and leave room to revisit the hardest questions. The next test is whether MAS keeps that discipline when it writes the agentic AI guidance.