Singapore MAS AI risk guidelines set phased 2027 and 2028 dates

Singapore’s financial institutions have a new AI governance timetable. On 7 October 2026, the Monetary Authority of Singapore issued AI risk-management guidelines covering all financial institutions and forms of AI, with proportionate application. Sections 3 and 4 apply from 7 October 2027; Sections 5 and 6 are to be implemented by 7 October 2028. These are future implementation dates, as confirmed in MAS’s guidelines, paragraph 1.8.

The MAS announcement places responsibility with boards and senior management, requires attention to individual AI uses as well as organisation-wide risks, and addresses third-party systems. Existing committees can provide oversight where they achieve adequate coordination. The announcement also says firms should consider restricting, suspending or replacing third-party AI where its risks cannot be brought within their appetite.

The guidelines, paragraphs 2.3–2.5 permit basic governance arrangements for uses unlikely to cause material adverse impact. Even this lighter approach includes clear accountability, permitted uses, approved tools, staff education, checks and reassessment. The scale of the governance exercise therefore depends on how the technology is used and what could go wrong.

For businesses, the useful next step is a documented gap assessment. Start with one consequential workflow, such as a customer-facing recommendation or fraud-screening process. Identify the model and supplier, the person authorised to approve changes, evidence of testing, escalation triggers and an alternative way to operate if the system fails. This is practical editorial guidance, rather than a regulator-prescribed checklist.

For governments and institutional purchasers elsewhere, the comparative question is how to obtain continuing evidence of control from a supplier whose models change. Singapore’s framework provides a dated reference point; a cross-border group still needs a separate assessment of the rules governing each entity and activity. Readers can contribute examples of assurance gaps using public or anonymised material. Commercial secrets and customer records are unnecessary.