MAS Sets New AI Risk Guidelines for Financial Institutions

The MAS guidelines aim to provide a structured approach for financial institutions to manage AI risks while allowing for tailored implementation. Firms can adapt their risk management strategies based on the scale and specific risk profile of their AI use. This approach also permits institutions to leverage existing governance structures, removing the requirement to establish new, dedicated AI committees. The intent appears to be integration rather than the creation of entirely separate compliance frameworks.

A key expectation is that institutions maintain inventories of their AI use and apply controls across various domains. These include data governance, cybersecurity, testing, human oversight, monitoring, and change management. This broad scope indicates a comprehensive view of AI risks, covering the entire operational lifecycle from initial data handling to system deployment and subsequent modifications.

The guidelines place significant emphasis on accountability for AI systems, particularly when third-party providers are involved. Institutions remain responsible for the AI services they deliver, even if those systems are developed, operated, or provided by external parties. They are expected to obtain sufficient assurance from providers, assess the suitability of third-party AI for its intended use, and implement compensating controls where assurance gaps or practical constraints arise. This clarifies that outsourcing AI functions does not transfer the ultimate risk management obligation.

Looking forward, MAS has identified the growing use of agentic AI systems, which can operate autonomously. In 2027, the regulator intends to consult the financial sector on what additional guidance for these systems would be useful. This proactive stance acknowledges the rapid evolution of AI capabilities and suggests an ongoing regulatory effort to address emerging risks, ensuring the framework remains relevant as AI technology advances.