Guides · 2026-10-13
MAS AIRG Readiness: Singapore AI Risk Guidelines for Banks
On 7 October 2026, the Monetary Authority of Singapore published binding AI Risk Guidelines (AIRG) for financial institutions — the era of voluntary AI principles is over. Core governance requirements take effect on 7 October 2027; detailed lifecycle and third-party AI controls follow on 7 October 2028. If your institution uses AI anywhere — or your vendors do — this is a dated, supervisory deadline, not a best-practice suggestion. This is an informational explainer, not legal advice.
What the AIRG requires, in plain terms
The guidelines' core governance package (Sections 3–4, effective 7 October 2027) asks institutions for three things: a comprehensive AI inventory — including AI embedded in third-party products — board-level AI governance, and materiality assessments that rank AI use cases by their risk significance. The second wave (Sections 5–6, effective 7 October 2028) adds detailed model-lifecycle controls and third-party AI controls: how models are built, validated, deployed, monitored — and how vendor AI is governed contractually and operationally.
The doctrine that changes everything: vendors can't shield you
The headline doctrine of the AIRG: a third-party vendor's AI is still your AI risk. If your core banking platform, CRM, fraud-screening tool or productivity suite ships embedded AI features, those features fall inside your inventory and governance scope. The institutions that struggle in 2027 won't be the ones with in-house models — they'll be the ones who never asked their vendors "does this product contain AI?" systematically. Start with the embedded-AI discovery pass, not the model register.
A practical 12-month preparation sequence
- Stand up the AI inventory register. Every AI system in use or development: owner, use case, model/vendor, data used, risk tier. This register is the foundation everything else hangs off.
- Run the embedded-AI discovery pass. Walk every vendor product through one question: does it contain AI? Record the answer and where it was documented (release notes, vendor statement, feature flags).
- Assess materiality per system. Rank each registered system by decision impact on customers, data scale, financial exposure, and human oversight. High-materiality systems get board visibility first.
- Record board-level governance. Name the oversight structure — committee, accountable member, reporting lines — and capture policy attestations and responsibility assignments as dated records.
- Review vendor contracts for AI clauses. For each vendor in the register, record whether AI-risk clauses are present, in negotiation, absent, or unreviewed — ahead of the 2028 third-party controls.
- Build the evidence pack. Inventory, assessments, attestations, vendor register and checklist in one supervisor-shaped artifact — records of what you attest, generated from the real register, not assembled in a panic.
What supervisors ask for
Supervisory reviews run on evidence, not intentions: the inventory register, the governance attestation records, the materiality assessment outcomes, and the vendor register with contractual status. An auto-generated pack drawn from live registers beats a slide deck every time — because the questions supervisors ask are exactly the fields a good register already holds.
Bottom line
The 2027 deadline is a governance deadline: inventory, board oversight, materiality. The 2028 deadline is an engineering deadline: lifecycle and vendor controls. Institutions that treat 2026–2027 as paperwork time and 2027–2028 as implementation time arrive at both dates calm. Institutions that wait arrive at a supervisory conversation with nothing to show. DisclosureGuard's MAS AIRG Readiness module implements this sequence — AI inventory builder, embedded-AI discovery, deterministic materiality assessments, vendor register, readiness checklist, and an exportable evidence pack — but the governance work itself is yours. Confirm your obligations with legal counsel.
Frequently asked questions
What is the MAS AI Risk Guidelines deadline?
Singapore MAS published the binding AI Risk Guidelines (AIRG) on 7 October 2026. Core governance requirements (Sections 3–4: AI inventory, board-level governance, materiality assessments) take effect on 7 October 2027; detailed lifecycle and third-party AI controls (Sections 5–6) take effect on 7 October 2028. Verify against the current official AIRG text.
Does the MAS AIRG apply to AI in vendor products we didn't build?
Yes — that is the guidelines' headline doctrine. The AIRG inventory duty covers AI embedded in third-party products, and third-party vendors cannot shield institutions from AI risk. Vendor products must be reviewed for embedded AI and recorded in the register.
What does a MAS AIRG AI inventory need to contain?
A comprehensive register of AI systems in use or development, including embedded third-party AI: per system, the owner, use case, model/vendor, data used, and risk tier — plus materiality assessment outcomes and contractual AI-clause status for vendors.
What is an AI materiality assessment under the AIRG?
An assessment that ranks each AI use case by its risk significance — factors include customer decision impact, data scale, financial exposure, regulatory use, third-party opacity, and human oversight. It determines which systems get priority governance attention ahead of the 2027 effective date.
Is DisclosureGuard's AIRG module legal advice?
No. It is a checklist and guidance product: it keeps deterministic records of what your institution attests (inventory, assessments, vendor register, checklist) and generates a supervisor-shaped evidence pack. It never claims compliance on your behalf — confirm your AIRG obligations with legal counsel.
Informational explainer, not legal advice. Check a specific asset against the current rules with a free DisclosureGuard scan.