Singapore MAS Guidelines on Artificial Intelligence Risk Management (2026) 5.1-5.2: Plan and implement controls across the entire AI life cycle with clear roles, reviewed regularly for newer technologies, calibrated to risk materiality, with constraints such as limited third-party disclosure mitigated (including by limiting AI use) so that residual risk stays within appetite, and partial deployments governed by explicit policies

What does 5.1-5.2 require?

An FI plans and implements robust controls covering the whole life cycle of each AI use case, system or model, from inception to retirement, assigns clear roles across business and functional units, and reviews the controls regularly for newer AI technologies. Controls may be applied proportionately to the assessed risk materiality of the use case; where practical constraints exist, for instance inadequate disclosure by a third-party AI provider, the FI identifies the resulting risks and puts mitigants in place such as limiting the AI's use, and confirms residual risk remains within appetite. Partial deployments such as pilots or phased rollouts may need adjusted controls, governed by clear policies and procedures covering deviations, for example time and user limits, success criteria, conditions of use, close monitoring of usage and outputs and compliance with the limited scope.