Singapore MAS Guidelines on Artificial Intelligence Risk Management (2026) 4.5-4.9: Maintain an accurate AI inventory of use cases, systems and models with update policies, linkages to other inventories, key attributes (purpose, approved scope, model type, data, dependencies, life cycle status, materiality rating, review status, roles, documentation links), a regularly reviewed design, and a designated control function with independent oversight

What does 4.5-4.9 require?

An inventory of AI use cases, systems and models, kept accurate and as complete as is practicable, underpins governance, oversight and risk management through the life cycle; policies and procedures govern its upkeep, including how often it is refreshed for new, changed or retired entries. The FI may extend an existing register or build a dedicated one, but either way the AI inventory is linked to the FI's other inventories (shared data asset identifiers tying to data inventories, shared vendor identifiers tying to outsourcing registers) so that cross-referencing supports oversight. Entries carry enough detail to govern and manage risk: typically purpose and description, approved scope such as jurisdictions, model type, data used, dependencies, life cycle status, the materiality rating assigned, model review status, key roles such as owner and developer, and links to the core documentation; any difference in attributes between entries is set out in policy and must not blunt oversight. The inventory's design is reviewed regularly so that it captures what newer technologies require (for AI agents: identifiers, the tools and systems the agent can reach, its components and the guardrails imposed) and what third-party AI requires. A designated control function owns the inventory policies and procedures and keeps enough independent oversight to vouch for accuracy and completeness, while business units handle day-to-day maintenance and review.