Singapore MAS Guidelines on Artificial Intelligence Risk Management (2026) 5.22: Technology and cybersecurity reviews before deployment covering technical implementation, system and network security, resilience, recoverability and operational readiness: secure design and least-privilege access review of architecture, APIs, plugins and third-party services with go-live checklists confirming encryption, data loss prevention, firewalls, access restrictions and logging; vulnerability assessment, penetration testing and red teaming, adversarial testing and safeguards such as input validation, throttling and anomaly detection

What does 5.22 require?

Deployment into production is preceded by technology and cyber reviews that confirm the AI can be released in a controlled and secure way, covering technical implementation, system and network security, resilience, recoverability and operational readiness. Two strands: the architecture, including APIs, plugins and third-party services, is reviewed for secure design, separation of environments and access on a least-privilege basis, and a go-live checklist confirms that the critical controls (encryption, data loss prevention, firewalls, access restrictions, logging) are running and correctly set; and the system is probed through vulnerability assessment, penetration testing and red teaming, tested against adversarial techniques such as manipulation, evasion and poisoning, and protected with measures such as input validation, throttling and anomaly detection.