Singapore's AI Risk Management Guidelines (AIRG) are final

Published 7 October 2026.

The Monetary Authority of Singapore issued the final Guidelines on Artificial Intelligence Risk Management for Financial Institutions, the MAS AIRG, on 7 October 2026, after issuing it for consultation in November 2025. The AIRG is in force from 7 October 2027. I developed them while leading AI risk supervision at MAS, but no longer there so this is an independent view. Here is the overview, and the points in the final AIRG that will actually change what firms do.

The AIRG applies to every financial institution MAS regulates, and to every kind of artificial intelligence (AI): traditional AI, generative AI including large language models, and agentic AI (AI agents). They are supervisory expectations, not a rulebook, and they are proportionate. A firm tailors its approach to how much, and how riskily, it uses AI.

The points that matter

• The phased timeline that FIs now face. Oversight and your core AI risk systems, policies and procedures are expected from 7 October 2027. The lifecycle controls and the capability to run them follow by 7 October 2028. Identify and govern your AI before you are judged on how well you control it.
• Proportionality now focuses on impact, not how integrated AI is. The consultation's "integrated part of business processes" test is gone. A firm can keep to basic policies only where its AI, if it failed, is unlikely to have a material adverse impact on the firm, its customers or stakeholders.
• Third-party AI is where the final tightened most, and where most firms' real exposure sits. The firm retains primary accountability for AI it buys. If it cannot bring the residual risk within appetite, it is expected to limit, suspend, or replace the provider. External assessments must come from independent, competent parties, not self-attestations. Identification now reaches AI embedded in third-party services, and the shadow AI staff use without telling anyone.
• Who runs it is clearer. Identification, inventory and materiality assessment can be carried out by the business, with a control function keeping independent oversight and the final say. The inventory need only be accurate to the extent possible or practicable.
• Some expectations eased. The mandatory cross-functional committee is gone. Model selection and the review cadence for basic policies are lighter. MAS took the consultation feedback seriously.

The idea underneath did not change. AI risk is mostly an extension of risks you already manage, not a new category. Scale the controls to the risk. Go deep where a failure would hurt. Stay light where it would not. A firm with a working model risk, third-party risk and technology risk function is not starting from zero.

Read more

For the detail behind each of these:

• The MAS AIRG for finance: the final 2026 guide: the whole thing in one page, with an FAQ.
• What changed from the November 2025 consultation to the final.
• The consultation draft vs the final, clause by clause: the full blackline comparison.
• MAS's response to feedback: what the industry raised, and why MAS changed what it did.
• The transition timeline: what is due by 7 October 2027 and by 2028.
• AIRG and third-party AI: where the final tightened most.
• The AIRG explained, a plain guide to the MAS AIRG.
• The AIRG in practice: identifying your AI, inventory, risk materiality, and lifecycle controls as a working system.
• The AIRG compared to the EU AI Act, NIST and ISO 42001.
• AI risk management in Singapore: the timeline from FEAT to the AIRG.

For the fundamentals that sit under the AIRG, see the primer AI Risk Management from First Principles.

Get the detailed analysis

I am publishing more details on AI risk management in the coming weeks. Subscribe to get them, and future updates on the AIRG.

Subscribe for updates