Most teams did not choose their first AI. It arrived inside software they already paid for: a summarise button in the email client, a drafting assistant in the document editor, a “smart” feature in the customer system that nobody remembers switching on.
Because nobody bought it as AI, nobody owns it. Last week a regulator in this region wrote down who does.
What MAS issued
On 7 October the Monetary Authority of Singapore issued its Guidelines on Artificial Intelligence Risk Management. They apply to every financial institution it supervises, and to every form of AI the firm uses, including generative AI and agents.
They follow a consultation that opened in November 2025. MAS kept its main expectations and refined the detail in response to feedback. The guidelines take effect on 7 October 2027, and firms may phase them in, with the later sections due by 7 October 2028.
So nothing changes tomorrow for a bank in Singapore. What changed last week is that the expectations are now written down, with dates attached.
The line that matters beyond banking
The release sets out four expectations. Three are what you would expect from a regulator: senior oversight, controls across the life of an AI system, and effort proportionate to the risk. The fourth is the one worth reading twice.
Financial institutions, MAS says, remain accountable for AI used in their services. That includes AI “developed, operated, or provided by third parties”. They should get enough assurance from the provider, judge whether the AI suits the job it is doing, and add their own controls where the provider’s assurance falls short.
If the risk still cannot be kept within the firm’s appetite, MAS says the firm should consider limiting, suspending or replacing the service. In plain terms: the fact that a supplier built it does not move the responsibility to the supplier.
During the consultation, respondents asked MAS directly how to handle risks from embedded AI, meaning AI built into products they already use. The final guidelines did not let them off. The buyer answers for it.
What MAS did not ask for
Two details in the release are as useful as the expectations themselves, because they cut against the instinct to build something large.
Firms may use their existing governance structures if those give adequate oversight. A dedicated AI committee is not required just for this. And where poor performance or an outage of a given AI would not have a material impact on the firm or its customers, basic policies and procedures are enough.
That is a regulator saying, in effect: do not stand up a programme. Find out what you have, decide which parts could hurt someone, and put your effort there.
The guidelines also expect firms to identify their AI use and keep an inventory of it. That sounds dull. It is the step most organisations have skipped, because so much of their AI came in through a software update rather than a purchase decision.
If you do not work in finance
These guidelines bind financial institutions in Singapore and nobody else. A marketing team in Phnom Penh or an operations department in Manila has no obligation under them.
They are still one of the clearest statements in the region of a sensible baseline, written by a regulator that spent nearly a year listening to objections. And the problem they describe is not a banking problem. Every department now runs software from a handful of vendors, and many of those vendors have added AI features in the past year or two.
Take a team that uses a customer support platform. Last year the vendor added a feature that drafts replies to customers. Somebody on the team turned it on because it saved time, and the drafts now go out with light edits. Ask who decided that was acceptable, who checks whether the drafts are accurate, and who would answer to a customer if one were wrong. In most teams, the honest answer to all three is nobody in particular.
Multiply that by every product the team uses and the gap becomes clear. None of that is negligence. It is what happens when a capability arrives without a decision attached. The MAS guidelines are, at heart, a request to attach the decision.
What to do this month
Make the list. Write down the software your team pays for, then mark which of it now contains AI features, switched on or not. An afternoon with the vendor release notes is usually enough. This is the inventory MAS asks for, at the scale of one department.
Put a name against each item. For every AI feature in use, name the person on your side who answers for what it produces. Not the vendor’s account manager, and not IT by default. Someone in the team that relies on the output.
Sort by consequence. Most of the list will be low stakes: a meeting summary, a suggested subject line. A few items will touch customers, money or decisions about people. Those are where your checking time should go, and the rest can live with a basic rule.
Ask your suppliers one question. For the features that matter, ask the vendor what assurance they can give about how the AI behaves and what changes when they update it. Their answer, or the lack of one, tells you how much of your own checking you need.
The guidelines run to many pages and most of them are for compliance teams. The idea at the centre fits on a card: if your team uses it, your team answers for it, whoever built it. That holds in a bank in Singapore, and it holds in your department.
Ms Ho Hern Shin, Deputy Managing Director at MAS, framed the aim as letting firms “innovate with confidence, while maintaining the trust of customers”. Knowing what AI you already run, and who owns it, is where that confidence starts.