Quaintitative

The final AIRG, in one place

The MAS AI Risk Management Guidelines (AIRG) for finance

Issued 7 October 2026. What the final AIRG requires, who it applies to, the phased timeline to 2027 and 2028, what changed from the consultation, and how to apply it. Written by the person who developed it.

On 7 October 2026 the Monetary Authority of Singapore issued the final Guidelines on Artificial Intelligence Risk Management for Financial Institutions, the MAS AIRG, after consulting on them in November 2025. They are in force from 7 October 2027, on a phased timeline. I developed the AIRG while leading AI risk supervision at MAS, and now work independently through Quaintitative, so take this as an informed but independent reading, not an official one. This page is the whole thing in one place; each section links to a deeper page where there is more to say.

What are the MAS AI Risk Management Guidelines (AIRG)?

The AIRG set out MAS's supervisory expectations for how financial institutions manage the risks of using AI. They are guidelines, which in MAS practice means supervisory expectations rather than binding legislation, and they are proportionate: a firm tailors its approach to how much, and how riskily, it uses AI. They cover every kind of AI, from traditional machine learning to generative AI including large language models, to agentic AI that acts on its own. For a plain guide to the guidelines themselves, see the AIRG explained.

Who do the AIRG apply to?

The four groups below are among the key ones. The AIRG also apply to the other financial institutions MAS regulates, such as payment service providers, finance companies, and financial market infrastructures such as exchanges and clearing houses, with each firm tailoring its approach to how much, and how riskily, it uses AI. How the AIRG land depends on what the firm does:

What do the AIRG require?

The AIRG are built in four working parts, and most firms with a functioning model risk, third-party risk and technology risk programme are not starting from zero.

  • AI oversight. The board approves and reviews the governance approach and puts AI into the risk appetite; senior management runs the framework within that appetite, escalates material risks, and keeps the board informed.
  • Key AI risk management systems, policies and procedures. Consistent AI identification across the firm, an accurate AI inventory, and a use-case risk materiality assessment that drives proportionate controls.
  • AI life cycle controls. Data management, transparency and explainability, fairness, human oversight, third-party AI, selection, evaluation and testing, technology and cyber, reproducibility, pre-deployment review, post-deployment monitoring, and change management.
  • AI capability and capacity. Competent, well-resourced people with the right conduct and culture, and adequate technology infrastructure.

Application is proportionate. A firm whose AI, if it failed, is unlikely to have a material adverse impact on the firm, its customers or stakeholders can keep to a lighter basic set of controls; everything else runs the full framework, calibrated by materiality. For how these fit together as a working system, see the AIRG in practice.

What changed in the final AIRG?

Five points in the final will actually change what firms do.

  • A phased timeline. Oversight and the core AI risk systems, policies and procedures are expected from 7 October 2027. The life cycle controls and the capability to run them follow by 7 October 2028. Identify and govern your AI before you are judged on how well you control it.
  • Proportionality now turns on impact, not integration. The consultation's "integrated part of business processes" test is gone. The lighter regime applies only where AI failure is unlikely to have a material adverse impact.
  • Third-party AI tightened most. The firm keeps primary accountability for AI it buys; if it cannot bring residual risk within appetite, it is expected to limit, suspend or replace the provider. External assessments must come from independent, competent parties, not self-attestations, and identification now reaches AI embedded in third-party services and the shadow AI staff use without telling anyone.
  • Who runs it is clearer. Identification, inventory and materiality can sit with the business, with a control function keeping independent oversight and the final say. The inventory need only be accurate to the extent possible or practicable.
  • Some expectations eased. The mandatory cross-functional committee is gone, and model selection and the review cadence for basic policies are lighter. MAS took the consultation feedback seriously.

For the detail: what changed, the consultation draft vs final, clause by clause, and MAS's response to feedback.

What is the AIRG implementation timeline?

The AIRG were issued on 7 October 2026 and take effect in two phases:

  • By 7 October 2027: AI oversight (Section 3) and the key AI risk management systems, policies and procedures (Section 4), meaning identification, inventory and risk materiality.
  • By 7 October 2028: the AI life cycle controls (Section 5) and the AI capability and capacity to run them (Section 6).

See the transition timeline for what to do in which year.

Third-party AI: where the final tightened most

This is where most firms' real exposure sits. You keep primary accountability for AI you did not build. You onboard it with contracts and testing in your own context, you assess it through independent certification rather than the vendor's own word, and you manage supply-chain and concentration risk, vendor changes, and contingency. If the residual risk cannot be brought within appetite, you limit, suspend or replace. See the AIRG and third-party AI.

How does the AIRG fit Singapore's wider AI framework?

The AIRG sit on top of frameworks Singapore built up over years, and alongside the main international ones. FEAT set the ethical baseline; Veritas and the Project MindForge AI Risk Management Toolkit turned principles into practice; the AIRG are the supervisory expectations that tie them together.

The AIRG by role

The same framework reads differently from each seat.

How do you apply the AIRG?

The idea underneath did not change. AI risk is mostly an extension of risks you already manage, not a new category. Scale the controls to the risk: go deep where a failure would hurt, stay light where it would not. In practice that means identifying your AI, putting it in an inventory, assessing each use case's materiality, and running the lifecycle controls as a system rather than a checklist. See the AIRG in practice, and governing AI at scale for keeping control as the number of systems grows. The primary sources worth knowing are in the resource list.

Frequently asked questions

When do the MAS AI Risk Management Guidelines take effect?

They were issued on 7 October 2026 and take effect in phases: AI oversight and the core AI risk management systems, policies and procedures from 7 October 2027, and the AI life cycle controls and capability from 7 October 2028.

Who do the AIRG apply to?

Every financial institution regulated by MAS, applied proportionately to how much and how riskily the firm uses AI.

Are the AIRG binding rules?

They are supervisory expectations issued as guidelines, not legislation. MAS supervises firms against them, and applies them proportionately.

Do the AIRG cover generative AI and AI agents?

Yes. They cover traditional AI, generative AI including large language models, and agentic AI that acts on its own.

Does a firm need a separate AI risk appetite?

AI risks should be reflected in the firm's risk appetite, within the existing risk appetite framework. A wholly separate AI risk appetite is not required; the point is that AI risk is explicit and owned, not that it lives in its own document.

What do the AIRG require for third-party or vendor AI?

The firm keeps primary accountability for AI it buys. External assessments must come from independent, competent parties rather than vendor self-attestations, identification must reach embedded and shadow AI, and if residual risk cannot be brought within appetite the firm is expected to limit, suspend or replace the provider.

Go deeper, and work with me

For the fundamentals that sit under the AIRG, start with the primer AI Risk Management from First Principles, or browse the books and primers. I train and advise financial institutions, regulators and boards on the AIRG; see the courses and workshops, or get in touch.