Singapore MAS Guidelines on Artificial Intelligence Risk Management (2026) 5.10-5.11: Third-party AI: onboarding, development and deployment controls adequate to materiality, contractual visibility over AI introduction and changes, testing in the FI's own context with compensatory testing for disclosure gaps and documented suitability; the FI retains accountability and weighs transparency, supply chain, concentration, change notification, contingency, legal terms, staff capability and complexity, limiting, suspending or replacing the service where residual risk exceeds appetite

What does 5.10-5.11 require?

Third-party AI is held to controls that match the materiality of the use case, at onboarding, during any modification or fine-tuning by the FI, and at deployment, with MAS outsourcing and third-party requirements applying in full. Contracts must give the FI a risk-appropriate view of when AI is introduced and when it is updated or changed, so that controls can follow. Vendor AI is reviewed properly: tested in the FI's own use cases on the FI's own data, with extra compensatory testing to fill gaps left by thin vendor disclosure, and the testing and the suitability judgement are documented. The choice to use third-party AI belongs to the FI, which keeps primary accountability for the consequences to stakeholders and for its own compliance. Before onboarding, and to a depth matching materiality, the FI weighs: how far vendor disclosures and documentation show that life cycle controls (data, model, technology and cyber, fairness, explainability) were applied, supplementing weak transparency with independent certifications or assessments rather than self-attestation and with compensating controls such as more testing or closer human oversight; whether the key third-party and open-source models, datasets and dependencies have had supply chain checks on provenance, training data integrity and known vulnerabilities; whether reliance on particular providers, directly or indirectly, creates concentration; whether the FI will be told of post-deployment updates and can judge their effect; whether robust contingency plans cover failure, misbehaviour or withdrawal of vendor support, above all for high-materiality uses; whether the legal terms impose clear duties on the provider, such as performance guarantees, data protection, audit rights, notice when AI is added or changed, or the FI's consent before AI is incorporated; whether staff in procurement, development, deployment and use know enough; and whether an unfamiliar, complex service such as a vendor-supplied AI agent demands deeper assessment. The residual materiality of a use case built on third-party AI must sit within appetite; if it cannot, the FI restricts or suspends the service or changes provider.