AIRG: what changed from the consultation to the final

Published 7 October 2026.

MAS issued the final AIRG on 7 October 2026, after the November 2025 consultation. I developed the AIRG while leading AI risk supervision at MAS. Most of it is unchanged. Here is what changed.

• Proportionality now focuses on impact, not how integrated AI is. The consultation's "integrated part of business processes" test, its flowchart and its Annex are gone. Every firm applies the full framework unless its AI, if it performed poorly or became unavailable, is unlikely to have a material adverse impact on the firm, its customers or other stakeholders.
• Risk is assessed at the use-case level. Materiality is judged per AI use case, taking in the systems and models under it, rather than model by model. Complexity now also covers how explainable the outputs are and, for bought AI, how much the firm can see into the technology and the data.
• Third-party AI got firmer. You keep primary accountability for AI you buy. Contracts need to give you a risk-appropriate view of when a vendor introduces or changes AI; external assessments must come from independent, competent parties rather than vendor self-attestation; and you are expected to limit, suspend or replace a provider when the residual risk sits outside your appetite. Identification now reaches AI embedded in material vendors' services, and the shadow AI staff use without telling anyone. See AIRG and third-party AI.
• Who runs it is clearer. Identification, inventory and materiality assessment can be carried out by the business, with a control function keeping independent oversight and the final say. The inventory need only be accurate to the extent possible or practicable.
• It applies on a group basis, with local accountability. For a locally incorporated firm under consolidated supervision, or a firm that is part of a global group, a group AI risk framework can be used only if it meets the Guidelines, and local senior management stays accountable to MAS.
• Guardrails have to be tested. For generative AI and agents, the guardrails put around them must be tested for effectiveness, not just listed.
• Some expectations eased. The mandatory cross-functional committee is gone, model selection is lighter, and the review cadence for firms on basic policies is lighter.
• Others tightened or were refined. The board must now approve and review the strategic direction for AI use, and all risks from AI use, not only the material ones, go into the risk appetite framework. On the lifecycle, change significance is judged on a risk basis with compensating controls where a vendor can update a model without prior review, re-validation frequency follows materiality, and the portfolio-wide aggregate risk review was dropped.
• The timeline that FIs now face. In force 7 October 2027, phased: oversight, identification, inventory and materiality from 2027; lifecycle controls and capability by 2028. See the AIRG transition timeline.

The underlying structure did not change: oversight, identify and inventory your AI, rate its materiality, apply lifecycle controls in proportion, and build the capability to run them. If you prepared to the consultation, you are adjusting, not starting again.

Read more

For the overview, see the AIRG is final and the AIRG explained. For the full comparison, paragraph by paragraph, see the consultation draft vs final. For why MAS made those changes, see the response to feedback. I am publishing more details on AI risk management in the coming weeks. Subscribe to get them, and future updates on the AIRG.

Subscribe for updates