Singapore's AI Risk Management Guidelines (AIRG)

The AI Risk Management Guidelines, known as the AIRG, are the Monetary Authority of Singapore's guidelines on how financial institutions should manage the risks of using artificial intelligence (AI). MAS issued the final guidelines on 7 October 2026, following the November 2025 consultation, and they are in force from 7 October 2027. They apply to all financial institutions, and cover AI use cases, systems and models. I developed the AIRG while leading AI risk supervision at the MAS.

What the AIRG covers

The guidelines are risk-proportionate and technology-neutral, so they are meant to hold across machine learning, generative AI and agents. They are best read as one system rather than a checklist, and are organised around a few core areas.

• Scope. AI use cases, systems and models, across all financial institutions.
• Oversight. Board and senior management roles and responsibilities, and making sure AI risk management across the organisation is adequate.
• Key systems, policies and procedures. Identifying where AI is used, assessing the risk materiality of each use, and maintaining an AI inventory.
• AI lifecycle controls. Controls applied across the AI lifecycle: data management, transparency and explainability, fairness, human oversight, third-party AI, AI selection, evaluation and testing, technology and cybersecurity, reproducibility and auditability, reviews and monitoring, and change management.
• AI capability and capacity. The AI capabilities and technology infrastructure a firm needs to manage AI risk.

Whether the AIRG applies to you, and how much

How much of the AIRG applies depends on how much is at stake. A firm applies the full guidelines where its AI, if it performed poorly or became unavailable, could have a material adverse impact on the firm, its customers or other stakeholders: it establishes oversight, identifies and inventories its AI, assesses risk materiality, and applies the lifecycle controls in proportion to that materiality, with adequate capability and capacity behind them. Where that impact is unlikely, the firm institutes basic AI governance policies commensurate with its level of AI use.

How materiality is assessed

Not every AI use warrants the same controls. Materiality is assessed on impact, complexity and reliance, and the depth of the lifecycle controls follows that assessment. This is why the guidelines stay proportionate rather than applying a fixed set of controls equally to everything.

How the AIRG relates to FEAT and the 2024 model risk paper

Singapore already had the FEAT principles on fairness, ethics, accountability and transparency, and the industry-developed Veritas methodology for assessing FEAT. These set principles but were not a full AI risk management framework, and they predate generative AI. In December 2024, MAS published an Information Paper on AI Model Risk Management, setting out observations from a thematic review of banks. I led that thematic review. The AIRG builds on both, and turns them into operational expectations across machine learning, generative AI and agents.

How it compares to the EU AI Act, NIST and ISO 42001

The AIRG sits alongside other frameworks that address the same risks in different forms. The EU AI Act is a binding, tiered law. The US NIST AI Risk Management Framework is voluntary. ISO/IEC 42001 is a certifiable standard for an AI management system. The AIRG is a financial-sector regulator's risk-proportionate guidance. The underlying areas, such as inventory, materiality, oversight and lifecycle controls, are largely common across these, so work done for one carries over substantially to the others. For a fuller side-by-side, see how the AIRG compares to the EU AI Act, NIST and ISO 42001.

Where the AIRG stands now

MAS issued the final guidelines on 7 October 2026. They take effect on 7 October 2027: oversight and the core AI risk systems, policies and procedures are expected from then, and the lifecycle controls and capability follow by 7 October 2028. For what changed from the November 2025 consultation and what it means, see the AIRG is final.

In depth: what changed, the transition timeline, and third-party AI under the AIRG.

Frequently asked questions

What is the AIRG?

The AI Risk Management Guidelines (AIRG) are the Monetary Authority of Singapore's guidelines on how financial institutions should manage the risks of using AI. MAS issued the final guidelines on 7 October 2026, in force from 7 October 2027. They apply to all financial institutions and cover AI use cases, systems and models.

Who wrote the AIRG?

The AIRG are the MAS'. Gary Ang developed them while leading AI risk supervision at the Monetary Authority of Singapore, building on the 2024 Information Paper on AI Model Risk Management, which he also led.

Who does the AIRG apply to, and how much?

They apply to all financial institutions in Singapore. How much applies is proportionate: where AI could have a material adverse impact on the firm, its customers or stakeholders, a firm establishes oversight, inventories its AI, assesses materiality and applies the lifecycle controls in proportion to it; where that impact is unlikely, basic policies suffice.

When does the AIRG take effect?

The final guidelines were issued on 7 October 2026 and take effect on 7 October 2027. Oversight and the core AI risk systems, policies and procedures are expected from 7 October 2027; the lifecycle controls and the capability to run them follow by 7 October 2028.

How is AI risk materiality assessed under the AIRG?

On three dimensions: impact, complexity and reliance. The depth of the lifecycle controls follows that assessment, so controls stay proportionate rather than applied equally to everything.

How does the AIRG compare to the EU AI Act, NIST and ISO 42001?

The EU AI Act is a binding, tiered law; the NIST AI Risk Management Framework is voluntary; ISO/IEC 42001 is a certifiable management-system standard; the AIRG is a financial-sector regulator's risk-proportionate guidance. The underlying areas - inventory, materiality, oversight, lifecycle controls - are largely common, so work on one maps onto the others.

Does a firm need a separate AI risk appetite, or can it sit within the existing risk appetite framework?

It can sit within the existing one. The AIRG (section 3.4) makes the board responsible for ensuring that risks from AI use are explicitly addressed within the firm's existing risk appetite framework, with qualitative statements and quantitative measures as appropriate. There is no requirement for a separate AI risk appetite; the final guidelines even removed the draft's 'where material' qualifier, so AI-use risks must be addressed in the appetite framework, but within the one you already have. The catch is that it has to be explicit: you cannot simply assume your existing appetite covers AI, you state, inside that framework, the AI-use risks the firm will and will not accept.

For everything on the AIRG and AI risk management in Singapore's financial sector in one place, see the complete guide.

For the fundamentals in one read, see the primer AI Risk Management from First Principles.

Help implementing the AIRG

I train and advise financial institutions on the AIRG, as well as AI risk management and governance in general. See the courses and workshops, or get in touch.