Singapore MAS Guidelines on Artificial Intelligence Risk Management (2026)
MAS's supervisory expectations for AI risk management in Singapore financial institutions, effective from 7 October 2027: proportionate application with a basic governance route for low-impact use, board and senior management oversight with AI in the risk appetite, a designated control function for AI identification, an AI inventory and a risk materiality assessment on impact, complexity and reliance, life cycle controls covering data management, transparency, fairness, human oversight, third-party AI, selection, evaluation and testing, technology and cyber security, reproducibility, independent pre-deployment validation, monitoring with drift checks and kill switches, change management and decommissioning, and the people and infrastructure capability to support it.
Singapore MAS Guidelines on Artificial Intelligence Risk Management (2026) is a compliance framework from Singapore with 6 domains and 30 controls. The largest domains are Section 5 AI life cycle controls: data, transparency, fairness, human oversight, third-party AI, selection, evaluation and testing, technology and cyber, reproducibility, pre-deployment review, monitoring, change management and retirement (paragraphs 5.1 to 5.26) – Singapore MAS Guidelines on Artificial Intelligence Risk Management (2026) (17 controls), Section 3 AI oversight: board, senior management and local management responsibilities (paragraphs 3.1 to 3.6) – Singapore MAS Guidelines on Artificial Intelligence Risk Management (2026) (4 controls), Section 4 Key systems, policies and procedures: AI identification, inventory and risk materiality assessment (paragraphs 4.1 to 4.13) – Singapore MAS Guidelines on Artificial Intelligence Risk Management (2026) (4 controls). Every control below carries what it requires and what an assessor expects to see.
Framework summaries on this platform are interpretations grounded in the published source, for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.
Framework Domains (6)
Section 1 Introduction: purpose, definitions of AI, model, system and use case, risks, effective dates (paragraphs 1.1 to 1.12) – Singapore MAS Guidelines on Artificial Intelligence Risk Management (2026)
| Code | Title |
|---|---|
| singapore-mas-guidelines-on-artificial-intelligence-risk-management-2026::1.7 | Regularly review the adequacy of AI risk management against the pace of AI developments and address new or accentuated risks |
Section 2 Application: proportionality and basic AI governance for low-impact use (paragraphs 2.1 to 2.5) – Singapore MAS Guidelines on Artificial Intelligence Risk Management (2026)
| Code | Title |
|---|---|
| singapore-mas-guidelines-on-artificial-intelligence-risk-management-2026::2.1-2.2 | Apply the Guidelines proportionately: establish oversight frameworks, policies and procedures with AI identification, risk materiality assessment and an inventory (Sections 3 and 4), and apply life cycle controls, capabilities and infrastructure (Sections 5 and 6) calibrated to relevance and risk materiality |
| singapore-mas-guidelines-on-artificial-intelligence-risk-management-2026::2.3-2.5 | Low-impact AI use may rely on basic AI governance: assess potential impact on the FI and on customers, and keep at minimum senior management accountability, permitted and prohibited uses with human oversight, an approved tool list and approval process, staff education, compliance checks and periodic review of continued eligibility |
Section 3 AI oversight: board, senior management and local management responsibilities (paragraphs 3.1 to 3.6) – Singapore MAS Guidelines on Artificial Intelligence Risk Management (2026)
| Code | Title |
|---|---|
| singapore-mas-guidelines-on-artificial-intelligence-risk-management-2026::3.1-3.3 | Board and senior management ensure existing risk frameworks identify, assess and address AI risk, maintain oversight and risk culture, keep AI use compatible with regulatory requirements, and ensure consistent standards, clear accountability and coordination across functions |
| singapore-mas-guidelines-on-artificial-intelligence-risk-management-2026::3.4 | The board or its delegated committee approves and regularly reviews the AI governance approach, addresses AI risk explicitly in the risk appetite framework, sets roles for board and senior management, maintains adequate AI understanding, and keeps the approach, appetite, roles, capabilities and culture under regular review |
| singapore-mas-guidelines-on-artificial-intelligence-risk-management-2026::3.5 | Senior management implements and regularly reviews the AI risk frameworks, institutes life cycle strategies and controls, sets roles across business lines and control functions, runs an escalation process for material AI risks and incidents, updates the board promptly, and ensures competent personnel and adequate resources |
| singapore-mas-guidelines-on-artificial-intelligence-risk-management-2026::3.6 | Local senior management stays accountable for Singapore considerations when group frameworks are adopted, with visibility, input, timely reports, escalation paths for local issues and the ability to demonstrate oversight to MAS |
Section 4 Key systems, policies and procedures: AI identification, inventory and risk materiality assessment (paragraphs 4.1 to 4.13) – Singapore MAS Guidelines on Artificial Intelligence Risk Management (2026)
| Code | Title |
|---|---|
| singapore-mas-guidelines-on-artificial-intelligence-risk-management-2026::4.1 | The AI risk management framework includes systems, policies and procedures for identifying, inventorising and assessing the risk materiality of AI, applied consistently, with controls proportionate to assessed materiality |
| singapore-mas-guidelines-on-artificial-intelligence-risk-management-2026::4.10-4.13 | Establish and apply consistently a risk materiality assessment methodology for every AI use case covering inherent and residual materiality against risk appetite before deployment, the dimensions of impact, complexity and reliance, regular review, and a designated control function that sets the framework and arbitrates or approves ratings |
| singapore-mas-guidelines-on-artificial-intelligence-risk-management-2026::4.2-4.4 | Identify AI use consistently across all business and functional areas with clear definitions, criteria and processes, covering AI embedded in material third-party services; designate a control function as independent overseer and final arbiter; keep residual risk from unidentified AI within appetite with mitigants for shadow AI and undisclosed embedded AI |
| singapore-mas-guidelines-on-artificial-intelligence-risk-management-2026::4.5-4.9 | Maintain an accurate AI inventory of use cases, systems and models with update policies, linkages to other inventories, key attributes (purpose, approved scope, model type, data, dependencies, life cycle status, materiality rating, review status, roles, documentation links), a regularly reviewed design, and a designated control function with independent oversight |
Section 5 AI life cycle controls: data, transparency, fairness, human oversight, third-party AI, selection, evaluation and testing, technology and cyber, reproducibility, pre-deployment review, monitoring, change management and retirement (paragraphs 5.1 to 5.26) – Singapore MAS Guidelines on Artificial Intelligence Risk Management (2026)
| Code | Title |
|---|---|
| singapore-mas-guidelines-on-artificial-intelligence-risk-management-2026::5.1-5.2 | Plan and implement controls across the entire AI life cycle with clear roles, reviewed regularly for newer technologies, calibrated to risk materiality, with constraints such as limited third-party disclosure mitigated (including by limiting AI use) so that residual risk stays within appetite, and partial deployments governed by explicit policies |
| singapore-mas-guidelines-on-artificial-intelligence-risk-management-2026::5.10-5.11 | Third-party AI: onboarding, development and deployment controls adequate to materiality, contractual visibility over AI introduction and changes, testing in the FI's own context with compensatory testing for disclosure gaps and documented suitability; the FI retains accountability and weighs transparency, supply chain, concentration, change notification, contingency, legal terms, staff capability and complexity, limiting, suspending or replacing the service where residual risk exceeds appetite |
| singapore-mas-guidelines-on-artificial-intelligence-risk-management-2026::5.12-5.13 | Select AI systems, models and features against the objectives and risks of the use case, documenting the trade-offs between performance, complexity, fairness and explainability in proportion to materiality, with domain expert or user review, and weigh the heightened risks of newer, less understood systems against the FI's ability to mitigate them |
| singapore-mas-guidelines-on-artificial-intelligence-risk-management-2026::5.14-5.15 | Evaluate and test each system or model before deployment to reliability and safety levels proportionate to materiality: identify key risks and set measurable thresholds, define and agree evaluation measures, use testing approaches such as out-of-sample and out-of-time testing, sensitivity, stability, sub-population, stress and adversarial testing, error analysis and benchmarking on representative data, mitigate overfitting, and put guardrails in place for identified limitations, covering the failure modes of Generative AI and agents |
| singapore-mas-guidelines-on-artificial-intelligence-risk-management-2026::5.16 | Technology and cybersecurity controls for AI systems commensurate with materiality under MAS technology risk requirements: secured environments with hardened configurations, segmentation, input validation, API authentication, encryption and data loss prevention; tightly controlled role-based and multi-factor access with privileged access management and separation of duties; and governance, data exposure restriction and monitoring of third-party components such as plugins and APIs |
| singapore-mas-guidelines-on-artificial-intelligence-risk-management-2026::5.17 | Document the AI development process for reproducibility and auditability, in proportion to materiality and in enough detail for an independent reviewer to understand and potentially replicate the implementation and testing, covering data sources and checks, selection rationale, training procedures with code versions, environments and hyperparameters, evaluation measures and results, explainability and fairness analyses, and assumptions, limitations and mitigants |
| singapore-mas-guidelines-on-artificial-intelligence-risk-management-2026::5.18-5.21 | Pre-deployment reviews by parties not involved in development, under clear policies with assigned roles and scope and independence proportionate to materiality; formal independent validation by competent, objective validators for high-materiality use cases covering conceptual soundness, data, implementation integrity, evaluation results, explainability and fairness, and assumptions; documented peer review for others; findings, limitations, remediation and conditions reported to the approval body, which ensures they are actioned |
| singapore-mas-guidelines-on-artificial-intelligence-risk-management-2026::5.22 | Technology and cybersecurity reviews before deployment covering technical implementation, system and network security, resilience, recoverability and operational readiness: secure design and least-privilege access review of architecture, APIs, plugins and third-party services with go-live checklists confirming encryption, data loss prevention, firewalls, access restrictions and logging; vulnerability assessment, penetration testing and red teaming, adversarial testing and safeguards such as input validation, throttling and anomaly detection |
| singapore-mas-guidelines-on-artificial-intelligence-risk-management-2026::5.23 | Ongoing monitoring of all deployed AI including third-party AI, proportionate to materiality: defined metrics and tiered thresholds for robustness, stability, data quality and fairness with data, concept and model drift checks and monitoring of reasoning, actions and tools in AI workflows; incident and issue reporting, escalation and resolution including retraining, redevelopment or decommissioning, kill switches for high-materiality AI and user feedback channels; accountable roles; records of monitoring and remediation with controlled, logged access to models, data, pipelines and configuration and enhanced logging for Generative AI and agents; and training for monitors and users |
| singapore-mas-guidelines-on-artificial-intelligence-risk-management-2026::5.24 | Re-validate or review AI in the portfolio as informed by materiality, with regular independent re-validation of high-materiality use cases and reviews triggered by findings on interconnected AI, monitoring alerts or breaches, significant change to the AI or its environment, or new external risks |
| singapore-mas-guidelines-on-artificial-intelligence-risk-management-2026::5.25 | Change management for deployed AI: a framework to judge the significance of changes by nature and materiality, with reviews and re-approval before significant changes and compensating controls where high-materiality changes occur without prior review; change control with human oversight and version control over code, data, parameters, hyperparameters and artefacts supporting traceability and rollback; and enhanced controls for automatically updating AI with strict justification, defined update scope, extra data quality checks and stricter performance monitoring |
| singapore-mas-guidelines-on-artificial-intelligence-risk-management-2026::5.26 | Controls for retiring or decommissioning AI that is no longer needed or exceeds risk tolerance, covering dependencies, data retention, secure removal from production and stakeholder notification |
| singapore-mas-guidelines-on-artificial-intelligence-risk-management-2026::5.3 | For high-risk AI use cases, develop, review and test contingency plans with fallback options such as alternative systems or manual processes, and tested activation protocols for any kill switch |
| singapore-mas-guidelines-on-artificial-intelligence-risk-management-2026::5.4 | Data management controls for AI covering fitness for purpose, representativeness including stressed conditions, data quality monitoring for anomalies, drift and bias, classification, security including sanitisation of decommissioned data and artefacts and encryption, privacy including consent, and auditability and lineage |
| singapore-mas-guidelines-on-artificial-intelligence-risk-management-2026::5.5-5.6 | Controls for transparency and explainability proportionate to the use case and its materiality, with greater attention for credit, insurance, advisory and fund management uses to input features, key drivers, informing customers, consequences and redress, tailored to the audience |
| singapore-mas-guidelines-on-artificial-intelligence-risk-management-2026::5.7-5.8 | Define fair outcomes and control for harmful bias and discriminatory outcomes across the life cycle, with fairness assessments that define protected attributes and proxies, measure systematic disadvantage with appropriate metrics, and document results and mitigation |
| singapore-mas-guidelines-on-artificial-intelligence-risk-management-2026::5.9 | Human oversight controls proportionate to materiality, accounting for automation bias and decision fatigue, covering roles and escalation, capable and empowered personnel, design that enables oversight and escalates outputs on predefined conditions, and documentation and review of oversight decisions, interventions, incidents and near misses |
Section 6 AI capability and capacity: personnel and technology infrastructure (paragraphs 6.1 to 6.3) – Singapore MAS Guidelines on Artificial Intelligence Risk Management (2026)
| Code | Title |
|---|---|
| singapore-mas-guidelines-on-artificial-intelligence-risk-management-2026::6.1-6.2 | Ensure the competence and conduct of personnel developing, deploying and using AI through recruitment, training and support, allocate human, technological and financial resources proportionate to risk, and regularly review capabilities, capacity and the training programmes for newer AI technologies |
| singapore-mas-guidelines-on-artificial-intelligence-risk-management-2026::6.3 | Ensure technology infrastructure (processing units, network, memory, secure data pipelines) is adequate for the performance, scalability and resilience needs of each AI use case, system or model, under MAS technology risk guidelines and relevant industry frameworks |
What is Singapore MAS Guidelines on Artificial Intelligence Risk Management (2026) and who does it apply to?
Singapore MAS Guidelines on Artificial Intelligence Risk Management (2026) is a compliance framework from Singapore with 6 domains and 30 controls. MAS's supervisory expectations for AI risk management in Singapore financial institutions, effective from 7 October 2027: proportionate application with a basic governance route for low-impact use, board and senior management oversight with AI in the risk appetite, a designated control function for AI identification, an AI inventory and a risk materiality assessment on impact, complexity and reliance, life cycle controls covering data management, transparency, fairness, human oversight, third-party AI, selection, evaluation and testing, technology and cyber security, reproducibility, independent pre-deployment validation, monitoring with drift checks and kill switches, change management and decommissioning, and the people and infrastructure capability to support it. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.
What does Singapore MAS Guidelines on Artificial Intelligence Risk Management (2026) actually require?
Singapore MAS Guidelines on Artificial Intelligence Risk Management (2026) has 30 controls organised across 6 domains. The largest domains are Section 5 AI life cycle controls: data, transparency, fairness, human oversight, third-party AI, selection, evaluation and testing, technology and cyber, reproducibility, pre-deployment review, monitoring, change management and retirement (paragraphs 5.1 to 5.26) – Singapore MAS Guidelines on Artificial Intelligence Risk Management (2026) (17 controls), Section 3 AI oversight: board, senior management and local management responsibilities (paragraphs 3.1 to 3.6) – Singapore MAS Guidelines on Artificial Intelligence Risk Management (2026) (4 controls), Section 4 Key systems, policies and procedures: AI identification, inventory and risk materiality assessment (paragraphs 4.1 to 4.13) – Singapore MAS Guidelines on Artificial Intelligence Risk Management (2026) (4 controls). Each control defines specific requirements that organisations must implement to achieve compliance.
If I already comply with another framework, how much of Singapore MAS Guidelines on Artificial Intelligence Risk Management (2026) do I already cover?
Singapore MAS Guidelines on Artificial Intelligence Risk Management (2026) does not currently have cross-framework mappings in our system. Check back as we continuously expand our mapping database.
How do I implement Singapore MAS Guidelines on Artificial Intelligence Risk Management (2026)?
Start your Singapore MAS Guidelines on Artificial Intelligence Risk Management (2026) compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about Singapore MAS Guidelines on Artificial Intelligence Risk Management (2026) requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 30 controls and track your progress.
Start Your Compliance Journey
Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 1,248 frameworks.
Get Started Free →Free forever, no credit card required