On 7 October 2026, the Monetary Authority of Singapore (the “Authority”) issued its Guidelines on Artificial Intelligence Risk Management (the “Guidelines”) for financial institutions (“FIs”). The Guidelines apply from 7 October 2027, with lifecycle controls and capability expectations following by 7 October 2028 where applicable.

Implementation requires an FI to define what AI may do and how far the FI may rely on the results. Testing that shows a tool retrieves the right policy does not show that the tool can give customers complete and accurate answers. Approval for internal assistance therefore does not establish suitability for direct customer communication.

Whether basic governance is sufficient depends on all the FI’s AI uses. Where an FI cannot rely on basic governance alone, the FI applies the oversight and risk management expectations, with controls calibrated to the risk materiality of each use case. Low-impact uses can receive lighter testing and review.

For AI use cases assessed as having high inherent risk materiality, the Guidelines call for formal independent validation before deployment, including where deployment is a pilot. Controls that reduce residual risk do not remove that requirement.

Our article examines these decisions, the conditions for relying on group assessments and provider reviews, and when group support may constitute outsourcing. It also identifies six records an FI can prepare to support implementation.

For the full article, click here.