Singapore’s Monetary Authority of Singapore (MAS) expects financial institutions to manage risks from their AI use, including systems supplied by outside providers. The core message for banks and insurers is that outsourcing the technology does not outsource accountability. MAS issued the guidelines on October 7, 2026, with requirements taking effect in stages.
13
19
12
Accountability extends to third-party AI
A financial institution remains accountable for AI used in services it delivers, whether the system is developed in-house or provided by a third party. That responsibility matters when AI contributes to unintended outcomes: reporting on the guidelines specifically identifies data leaks and inaccurate information as examples.
19
38
The guidelines apply to financial institutions and all forms of AI, according to MAS’s published overview. They set supervisory expectations for managing AI risk rather than describing a single control that fits every deployment. Institutions can tailor their approach to the scale and nature of their AI use and its risk profile.
14
13
Governance, inventories and lifecycle controls
The expectations span oversight, risk-management systems, policies and procedures, AI lifecycle controls, and the capabilities needed to use AI. The available summaries identify board and senior-management oversight, identification and materiality assessment of AI use, and inventories maintained at an appropriate level of detail.
12
1
Controls described in the sources include data governance, testing, human oversight, cybersecurity and monitoring. A report on the final guidelines also lists change management. These are lifecycle concerns: institutions should consider how AI is managed and monitored, not only whether it passed an initial review.
1
20
26
MAS does not require firms to create a separate AI committee solely to meet these expectations, according to summaries of the guidelines. Existing governance arrangements can be used, provided they support oversight of AI risks.
26
29
Proportionate controls, not one-size-fits-all rules
MAS allows institutions to scale their approach to the scale and risk profile of their AI use. That supports a risk-based model: governance should reflect the use case, rather than treating every AI application as equally consequential.
13
26
The sources confirm that institutions should assess AI use and maintain inventories, but do not establish the exact inventory fields or a specific threshold for when basic policies are sufficient. They also do not verify detailed requirements for individual examples such as drafting emails, summarising meeting notes, or designing marketing materials.
1
26
Similarly, the available source extracts mention model transparency as a factor institutions should assess, but do not provide enough detail to state the precise transparency or explainability tests, contingency-plan requirements, incident-reporting thresholds, or risk-assessment criteria for particular decisions such as credit and insurance underwriting.
19
Implementation dates: October 2027 and October 2028
The guidelines were issued on October 7, 2026. The sources describe a phased implementation, with oversight and risk-management-system expectations taking effect on October 7, 2027, followed by lifecycle-control and capability requirements on October 7, 2028. The later date is October 7—not October 8.
5
12
The consultation on the proposed guidelines began on November 13, 2025, and the final publication included MAS’s response to feedback. The available extracts establish that consultation history, but do not provide enough detail to summarize how MAS resolved each specific question raised.
3
8
Agentic AI: further guidance is reported for 2027
A report on the final guidelines says MAS plans further guidance on agentic AI in 2027. The source material here does not establish a consultation timetable or provide enough detail to attribute specific new requirements to that future guidance.
21
For institutions preparing now, the clearest supported takeaway is to identify their AI use, ensure appropriate oversight, retain accountability for vendor-provided systems, and plan for the phased deadlines—while checking the final MAS documents for requirements beyond what the available summaries verify.
12
14