Learn the AIRG and MindForge, step by step

What the AIRG is. The MAS AI Risk Management Guidelines set out MAS's supervisory expectations for AI risk management in financial institutions. They were issued in October 2026 and come into force in October 2027. They cover traditional machine learning, generative AI and agents, across the AI lifecycle, and they build on the FEAT principles: fairness, ethics, accountability and transparency. They are risk-based and proportionate, so the depth of control depends on how material the use is.

What MindForge is. The Project MindForge AI Risk Management Toolkit is the Singapore industry's set of practices for meeting the AIRG. It is organised into four pillars and seventeen areas. The AIRG sets the expectations; MindForge shows common ways to meet them. This page pairs the two for each area.

Your role. The second and third line do not build the AI. You provide independent oversight, effective challenge and validation, monitoring, and the vendor checkpoint. Read each module as a reviewer: how do you tell whether the first line has done this, and done it properly.

Related on this site: the AIRG explained, the final AIRG, AI risk management from first principles, AI risk management in Singapore, the complete guide, and the MindForge toolkit.

What the AIRG expects. The documents that define the firm's AI approach: a consistent, enterprise-wide way to identify AI, clear ownership, and the policies that carry the oversight and lifecycle controls. Identification across every business and function comes first, because a control only applies to AI the firm has defined and found.

What MindForge does. It sets out a short set of AI principles, often based on FEAT. It defines one enterprise-wide definition of AI that both technical and non-technical staff can use, written to catch newer cases such as AI embedded in purchased software. It builds an identification framework that applies the definition consistently: checks built into the software development lifecycle and existing risk reviews, checks at third-party onboarding, a named authority to decide borderline cases, and a record of those decisions. All of this is written into a dedicated AI policy or added to existing policies such as the model risk policy, and reviewed on a set schedule.

What good looks like, and what to ask for. One AI definition with worked examples of what is and is not AI. An identification framework with a named owner for borderline cases. A review date that has been met. Ask to see the borderline decisions and the reasons recorded for them.

Related on this site: governance documents, in full, the AIRG explained, and why AI governance frameworks fail.

What the AIRG expects. Existing risk frameworks and functions identify, assess and manage the risks AI brings, with clear roles, indicators and escalation. AI risk belongs inside model, operational, technology, third-party and reputational risk, and material AI risk is reflected in the risk appetite.

What MindForge does. It captures AI in the enterprise risk taxonomy in one of three ways, which can be combined: update each existing risk category for AI, expand model or technology risk to hold AI risks, or add a dedicated AI risk category. The test is clear accountability and no gaps. Existing controls such as access management and incident management still apply and are strengthened where they fall short. The firm sets a small number of AI key risk indicators with named owners, such as the share of use cases missing from the inventory, production systems running without approval, drift and data-quality measures, and total exposure. AI incidents are logged by severity, with attention to how long they take to resolve, and escalation runs against thresholds set by the risk appetite.

What good looks like, and what to ask for. AI risk shown in the taxonomy the board already sees. Controls strengthened rather than duplicated. A short list of key risk indicators with named owners. Ask who owns each indicator, and for an example of a threshold being breached and what happened next.

Related on this site: the organisation-wide risk framework, in full, three lines of defence for AI, building an AI risk function, and AI risk management for risk and compliance.

Start from the AIRG. The AIRG holds third-party AI to the same standard as AI built in-house: identified, rated for materiality, inventoried and controlled, with onboarding and deployment controls, and compensatory testing to cover what the vendor will not disclose. Buying the AI does not move the accountability to the vendor.

The AI Card is an extension, not a new thing. MindForge describes this as strengthening what a firm already does, not a new function. Firms already run procurement, vendor assessment and third-party risk management. An AI Card is a model or system card: a defined disclosure request, with the depth set by the use case's materiality and how it is deployed. It has the same purpose as a due-diligence questionnaire, applied to the AI-specific points.

What MindForge adds. Review the disclosure against your expectations. Where information is withheld, decide on the basis of indemnities, credible external attestation, or your own testing, rather than rejecting the vendor outright. Run compensatory testing on your own data and metrics, more where disclosure is thin or the use is material, with fairness testing part of onboarding. Watch for AI added to an existing product through vendor updates, and contract for change notification. Set contract terms for liability, data retention, change notice and audit rights.

What good looks like, and what to ask for. Bought AI on the same inventory and materiality scale as internal AI. Disclosure requested in proportion to materiality. Your own testing where it matters. Contracts carrying the AI-specific terms. Ask for a case where a vendor withheld information and how the firm decided. In the course, this is done live against a real vendor system.

Related on this site: third-party AI risk, in full, third-party onboarding, governing third-party AI, and supervising third-party AI.

What the AIRG expects. Rate each AI use on its materiality, at least across impact, complexity and reliance, applied consistently, with the depth of controls following the rating. Material systems get an independent review before deployment. The rating is how proportionality works in practice.

What MindForge does. It sets enterprise-wide tiers, commonly low, medium and high, on criteria that fit the firm: impact (financial, reputational, regulatory, effect on customers, use of personal data), complexity or novelty, and how far the AI replaces human judgement. It assesses inherent risk early, from the basic features of the use case, then residual risk after controls are in place, tested in conditions close to real use, repeating until the residual risk is acceptable. Controls scale with the tier, from sample-based review for a minor use to review of every output for a material one. A review before deployment is carried out by someone not involved in building it, and its depth and independence increase with materiality.

What good looks like, and what to challenge. Tiers applied the same way across the firm, based on what a system does rather than who sees it. An inherent assessment early and a residual assessment before go-live. Controls whose intensity matches the tier. Challenge the rating first, especially a high-impact use such as credit decisioning that has been rated low.

Related on this site: use-case risk and materiality, in full, supervising inventory and materiality, inventory and materiality for the second line, and inventory and materiality compared.

What the AIRG expects. An accurate, up-to-date inventory of AI use cases, so risk can be aggregated across the firm and controls applied consistently. It is a required outcome: the firm must be able to show it knows where its AI is. The AIRG does not prescribe the tool.

What MindForge does. It treats the inventory as a record of core attributes, and is flexible about the tool: extend an existing asset inventory, link several registers, or build a dedicated system. It sets six minimum attributes per use case: purpose and scope; type of AI; data used; risks and mitigations, including the materiality rating; status and governance, including the owner, lifecycle status and approvals; and third-party information, including vendor disclosures such as AI Cards. Every use case is recorded, including low-risk ones, so the firm-wide picture is complete. Three roles keep it current: the use-case owner maintains their entries, an AI-specific reviewer checks accuracy, and an inventory owner, usually a control function, is accountable for the inventory overall. Reviews after deployment also check the inventory, flagging where a live system no longer matches its record.

What good looks like, and what to ask for. One firm-wide view of the AI in use, the six attributes recorded before deployment, the three roles named and filled, and an owner for the schema. Ask how the firm finds AI that no one registered.

Related on this site: the AI inventory, in full, supervising inventory and materiality, and inventory and materiality for the second line.

The shift. Most AI risk management was built for narrow, predictive models. Generative AI adds open-ended outputs, new failure modes such as hallucination and prompt injection, and heavy reliance on third-party models. Agentic AI adds systems that take actions and chain steps with less human involvement at each step. Capability and risk rise together.

What it means for your seat. The controls do not change in principle, but they stretch. Materiality has to account for autonomy and reach. Testing has to cover behaviour, not just accuracy. Monitoring has to run against systems that change after deployment. The second and third line need enough understanding of these systems to ask the right questions.

Related on this site: governing agentic AI, agentic AI risks, agentic AI risk management, and the five S's of AI.

Materiality for generative AI. The same rating applies, but impact and reliance are often higher: outputs go to customers, staff act on them, and the content is open-ended. Rate the use case on what it can affect, not on how simple it looks to use.

Guardrails and metrics. Common controls include input and output filtering, retrieval from approved sources, limits on what the system can do, human review scaled to materiality, and logging. Each control needs a measure that shows whether it is working, for example the rate of blocked unsafe outputs, citation accuracy, or the share of outputs reviewed. A guardrail with no measure is an assumption.

What to ask for. The list of controls on the use case, the measure for each, and recent results. For a material use, evidence that outputs are reviewed and that failures are caught and fixed.

Related on this site: guardrails and metrics, making AI safe in practice, and use-case risk and materiality.

The challenge role. The second line does not run the model. Its job is to ask for evidence and to judge whether a control is real or only described. Ask how the use case was rated and why, what was tested and against what, what the monitoring shows, and what happens when a threshold is breached.

Data issues. Many AI problems are data problems: unclear provenance, sensitive data used without justification, training data that no longer matches live data, and leakage between the two. Ask where the data came from, what is sensitive, and how training and operational data are kept separate.

Reading test results. Testing on a fixed dataset does not guarantee live performance. Ask whether testing reflected real conditions, whether it covered adversarial cases and fairness, and whether results are rechecked after deployment.

Related on this site: where AI risk hides from the second line, challenge, not build, questions to ask your first line, testing and review, and assessing controls before deployment.

The core points. Provenance and rights for training and retrieval data. Protection of sensitive and personal data, including what is sent to a third-party model. Accuracy and freshness of retrieval sources. Separation of training data from live input. Retention limits and deletion.

What to ask for. Where each dataset came from and on what basis it is used. What controls stop sensitive data leaving the firm through a model or a prompt. How retrieval sources are kept accurate. These sit on top of the firm's existing data governance, not beside it.

Related on this site: data management, and data ethics.

What is different. An agent plans and acts across steps, calls tools, and can change the world, not just produce text. The risk is no longer a single output but a sequence of actions, so control has to happen while the system runs, not only before it ships.

Controls. Clear limits on what the agent can do and access. Human oversight scaled to the impact, including approval before high-impact actions. A way to stop the system, a kill switch, that someone owns and has tested. Key risk indicators for agent behaviour, such as actions outside scope, failed tool calls, or escalations. Logging detailed enough to reconstruct what happened.

What to ask for. The agent's permitted actions and limits, the points where a human must approve, who owns the kill switch and when it was last tested, and the indicators monitored while it runs.

Related on this site: governing agentic AI, runtime governance for agentic AI, agentic AI risk management, and AI oversight and accountability.

Where things stand. The AIRG was issued in October 2026 and comes into force in October 2027, with a phased approach. It builds on the 2024 information paper on AI model risk management and the FEAT principles, and it sits alongside international frameworks such as the EU AI Act, the NIST AI Risk Management Framework and ISO 42001.

Keeping up. Track changes to the guidelines and to MindForge, map them to the firm's policies and controls, and adjust the risk appetite as autonomy and reach grow. Watch supervisory signals, not just the text. Build the governance so new use-case types can be added without starting over.

What to ask for. A named owner for regulatory change, a record of how the latest change was mapped to policies and controls, and a view of how the firm's framework handles agentic AI.

Related on this site: the final AIRG, what changed from the draft, the transition timeline, AI risk management in Singapore, and the AIRG compared with the EU AI Act, NIST and ISO 42001.