新加坡《人工智能风险管理指引》

MonetaryAuthorityofSingaporeGuidelines

7October2026

GuidelinesonArtificial

IntelligenceRisk

Management

7OCTOBER2026|2

Contents

1.Introduction3

2.ApplicationoftheGuidelines8

3.AIOversight10

4.KeyAIRiskManagementSystems,PoliciesandProcedures13

5.AILifeCycleControls17

6.AICapability&Capacity30

GuidelinesonArtificialIntelligenceRiskManagement

7OCTOBER2026|3

1.Introduction

1.1.TheGuidelinesonArtificialIntelligence(Al)RiskManagement(the“Guidelines")setoutMAS'

supervisoryexpectationsrelatingtoAlriskmanagementinfinancialinstitutions(Fls)²,andseekto

supporttheirresponsibleadoptionofAI.TheseGuidelinessetoutMAS'supervisoryexpectationsinthe

areasofoversight,keyAlriskmanagementsystems,policies,procedures,Allifecyclecontrols,and

capabilitiesandcapacityfortheuseofAI.AnoverviewofthekeysectionscoveredintheseGuidelines

issetoutbelow.

1.Introduction

AIUseCases,Systems&Models

2.ApplicationoftheGuidelines

AllFls;Risk-proportionateApplication

3.AIOversight

BSMRoles&Responsibilities;Org.WideOversightandCoordination

4.KeyAlRiskManagementSystems,Policies&Procedures

AlIdentificationAIRiskMaterialityAssessmentAlInventory

5.AILifeCycleControls

·HumanOversight·DataManagement·Reviews&Monitoring

·Third-PartyAl·Tech.&Cybersecurity·ChangeManagement

Transparency&Explainability·Selection·Reproducibility&Auditability

6.AICapability&Capacity

AICapabilitiesAITech.Infra.

Figure1:OverviewoftheGuidelines

1.2.TheGuidelinescomplementexistinglegislationandguidelinesissuedbytheMAS.Theyshouldberead

inconjunctionwithrelevantguidelines,informationpapersandcircularsthatMASmayissuefromtime

totime.Forinstance,existingprinciplesonFairness,Ethics,AccountabilityandTransparency(FEAT)²

continuetoapplyforguidingtheuseofAlinthefinancialsector.Flsshouldalsotakeintoaccount

applicableindustrystandardswhereappropriate³.TheGuidelinesapplyonagroupbasisforlocally

¹AsdefinedinSection2oftheFinancialServicesandMarketsAct2022.

2.sg/publications/monographs-or-information-paper/2018/feat

3Flsmayalsorefertokeyinitiativesatthenationallevel,suchastheCyberSecurityAgencyofSingapore'sGuidelinesand

CompanionGuideonSecuringAISystems,theInfocommMediaDevelopmentAuthority'sModel(IMDA)AIGovernance

Framework,aswellasthevariousinitiativesundertheAIVerifyFoundationtoinformtheiruseofAI.

GuidelinesonArtificialIntelligenceRiskManagement

7OCTOBER2026|4

incorporatedFIs,thatare(i)subjecttoconsolidatedsupervisionbyMAS4or(ii)anownerofacritical

informationinfrastructure5.

1.3.ForthepurposeoftheseGuidelines,AIreferstomachine-basedsystemsormodelsthatderiveoutputs

throughlearnedpremisessuchasthedataorinputsitreceives.Theoutputscanincludeestimates,

predictions,content,summaries,recommendations,ordecisionsthatmayinfluencephysicalorvirtual

environments.DifferentAIvaryintheirlevelsofautonomyandadaptivenessafterdeployment6.

Calculatorsortoolswhoseoutputsaresolelybasedonpredefinedprogramminglogicorruleswould

notberegardedasAIforthepurposeoftheseGuidelines.

1.4.Inaddition,thefollowingdefinitions7areused:

(a)Amodelisamethodorapproachwhichconvertsassumptionsandinputdataintooutputssuch

asestimates,decisions,orrecommendations.

(b)Asystemcomprisesoneormoremodelsandothermachine-basedcomponents.

(c)Ausecasereferstoaspecificreal-worldcontextthatthemodelorsystemisappliedto.

1.5.TheGuidelinesestablishasetofhigh-levelexpectationsthatallFIsshouldadheretoastheydeployAI,

includingGenerativeAIandnewerdevelopmentssuchasAIagents.AnFIwhichispartofaglobalgroup

maytakeguidancefromorleveragetheirGroup’sAIriskmanagementframeworks,aslongasthose

frameworksmeettheexpectationssetoutintheseGuidelines.

1.6.FIsshouldimplementtheseGuidelinesinamannercommensuratewiththesizeandnatureoftheir

activities,andtheextenttowhichtheiruseofAIcouldleadtomaterialriskstothem.AIcanbeapplied

toawiderangeofusecases,andtherisksassociatedwithdifferentuseofAImayvarybasedonthe

scale,scopeandbusinessmodelsofFIs.

4Theseincludelocally-incorporatedFIsfromthebankingandinsurancesectors.

5AsdefinedintheCybersecurityAct2018.

6ThefollowingareillustrativeexamplesofAItechniquesandapplicationsthatwouldgenerallyfallwithinthedefinitionabove.

Thislistisnon-exhaustive,andnewertechniquesandapplicationsnotlistedhereshouldbeassessedagainstthisdefinition.

Currentexamplesincludemachinelearning(includingsupervised,unsupervised,andreinforcementlearning),deeplearning,

naturallanguageprocessing,computervision,generativeAI(includinglargelanguagemodels),andAIagents(includingmulti-

agentsystems).Fortheavoidanceofdoubt,rule-basedsystems,toolswhoseoutputsarefullydeterminedbyexplicitformulae

thatweremanuallyspecified,ratherthanderivedfromdata,androboticprocessautomationthatfollowsfixedprogrammed

instructionswithoutlearningoradaptationwouldnotordinarilybeconsideredAIforthepurposeoftheseGuidelines.

7WhereapointpertainsspecificallytoanAIusecase,AIsystemorAImodel,wewillusetherespectivetermsexplicitlyinthese

Guidelines.

GuidelinesonArtificialIntelligenceRiskManagement

7OCTOBER2026|5

1.7.GiventhepaceofAIdevelopments,MASalsoexpectsFIstoregularlyreviewtheadequacyoftheirAI

riskmanagementeffortsagainstAIdevelopmentsandaddressneworaccentuatedrisksthatmayarise

duetosuchdevelopments.

1.8.TheseGuidelinestakeeffecton7October2027.FIsmaymeettheexpectationssetoutinSections3to

4from7October2027,andSection5and6oftheGuidelinesby7October2028.

Risks

1.9.TheuseofAIcanimproveperformanceacrossbusinessandfunctionalareasbutitscomplexityand

probabilisticnaturecanleadtogreateruncertainty,aswellasunexpectedormorebiasedbehaviour

thatishardertoidentifycomparedtotheuseofsimplermethods8.ThegreatercomplexityofAIalso

leadstochallengesinunderstandingandexplainingitsoutputsthatmaybeinaccurateorbiased.Risks

fromAIuseisoftenanextensionofexistingriskcategories;suchrisksinclude:

(a)Financialrisks,e.g.,whenusedforriskmanagement,thegreateruncertaintyandunexpected

behaviourofAIcouldleadtopoorriskassessmentsandconsequentfinanciallosses.

(b)Operationalrisks,e.g.,unexpectedbehaviourofAIusedtoautomateanFI’soperationscouldlead

tooperationaldisruptionsorerrorsincriticalprocesses.

(c)Conductrisk,e.g.,useofAIcanresultinbiasedoutputs,leadingtounfairtreatmentofcertain

customergroups,abiasforcertaininvestmenttypesoverothers,orconflictsofinterestsbetween

anFIanditscustomers.

(d)Financialcrimerisks,e.g.,whenusedtosupportanti-moneylaunderingefforts,thegreater

uncertaintyandunexpectedbehaviourofAIcouldmeanthatsuspicioustransactionsgo

undetected.

(e)Reputationalrisks,e.g.,customer-facingsystems,suchaschatbots,couldprovideincorrect

informationormakeoffensiveremarksthatleadtonegativemediaattentionandreputational

damage.

1.10.WithGenerativeAI,suchexistingrisksassociatedwithAImaybeamplified.Thegreatercomplexityof

GenerativeAIgivesrisetoevengreateruncertaintyandunexpectedbehaviourcomparedtoAI.The

unstructurednatureofGenerativeAIinputsandoutputs,andalackofestablishedtechniquesinthis

8Suchuncertaintyorbehaviourmayarisefromthenoisethatisinherentintrainingdata,trainingdatathatmaynotbe

representative,orwhenthemodelencountersscenariosthatarenotpresentinitstrainingdata.Itmayalsoariseduetodata

ormodeldriftsovertime.

GuidelinesonArtificialIntelligenceRiskManagement

7OCTOBER2026|6

areaalsomakeithardertoevaluateandtest,aswellasunderstandandexplainGenerativeAI’s

behaviourandoutputs.ThediverseandoftenopaquedatasourcesusedinGenerativeAItraining,

coupledwithdifficultiesinevaluatingbiasofGenerativeAIoutputs,couldalsoresultindecisionsthat

leadtounfaircustomeroutcomes.GenerativeAImayalsoleadtoarangeofotherinter-relatedrisks,

suchas:

(a)Securityrisks,e.g.,arisingfromadversarialattacksonGenerativeAIsystemsviapromptinjection

ordatapoisoning9.

(b)Privacyrisks,e.g.,arisingfromtheleakageofconfidentialorcustomerdataduetotheuseofthird-

partyGenerativeAIservices,ortheinappropriateuseofcustomerdatainGenerativeAIwithout

properconsent.

(c)Legalandintellectualpropertyrisks,e.g.,arisingfromtheuseofGenerativeAItrainedondata

thatinfringesexistingcopyrightsorpatents.

(d)Third-partyAI10risks,e.g.,arisingfromover-relianceonafewdominantGenerativeAIproviders

formissioncriticalareas,orusingopen-sourcemodelswithpoorsecuritycontrols.

(e)Operationalrisks,e.g.,potentialservicedisruptionsduetoGenerativeAIoutagesandproblems

arisingfrominadequatepre-deploymenttesting.

(f)Human-factorrisks,e.g.,useofshadowAI,poorhumanoversightoverGenerativeAIusedin

missioncriticalareas,automationbiasorskilldegradationduetoover-relianceonGenerativeAI.

1.11.Similarly,theuseofnewertechnologiessuchasAIagents,whichmaybegrantedgreaterautonomy

andaccesstotools,couldfurtheramplifytheserisks.Forexample,anAIagentwithaccesstotools

couldautonomouslyexecuteunauthorisedorerroneousactionsthatarenotalignedwithanFI’s

businessobjectivesorinacustomer’sbestinterestsduetoadivergencebetweenpre-definedgoals

andhowtheAIagenttranslatedsuchgoalsintoactions11.CompromisedAIagentswithaccessto

internalsystemsandexternaltoolscouldbeusedtoexfiltratesensitivedataorexecutemalicious

commandsatscale,amplifyingsecurityrisks.

9MoredetailsonsuchrisksarecoveredextensivelyinMAS’InformationPaperonCyberRisksAssociatedwithGenerative

ArtificialIntelligence.Thepapercanbeaccessedat.sg/regulation/circulars/cyber-risks-associated-with-

generative-artificial-intelligence.

10ForthepurposeoftheseGuidelines,third-partyAIreferstoAIsystemsormodels,aswellasservicesortoolsincorporating

orusingAI,thataredeveloped,owned,operatedorprovidedbyanexternalparty,andwhichanFIprocures,subscribesto,

accessesorotherwisereliesuponinsupportofitsbusinessactivities.

11FIsmayalsoreferencerelevantframeworksonspecificconsiderationsofrisksandgovernancepracticesforAgenticAI,such

asIMDA’sModelAIGovernanceFrameworkforAgenticAI.Thepapercanbeaccessedat.sg/-

/media/imda/files/about/emerging-tech-and-research/artificial-intelligence/mgf-for-agentic-ai.pdf.

GuidelinesonArtificialIntelligenceRiskManagement

7OCTOBER2026|7

1.12.MASrecognisesthatAIadoptionanditsassociatedriskswillcontinuetoevolvealongside

advancementsinAItechnologies.TheGuidelineswillbeupdatedoraugmentedasnecessary.

GuidelinesonArtificialIntelligenceRiskManagement

7OCTOBER2026|8

2.ApplicationoftheGuidelines

2.1.TheGuidelinesapplytoallFIsinaproportionatemanner,accordingtotheirsizeandriskprofile.

2.2.Unlessparagraph2.3.applies,anFIshould:

(a)Establishframeworks,policiesandprocedurestooverseeitsuseofAI,includingclear

identificationofAIusecases,robustriskmaterialityassessmentsandanadequateAIinventory,

assetoutinSections3and4oftheseGuidelines.Thescopeofsuchoversight,policiesand

proceduresmaybeproportionatetothesizeandnatureoftheFI’sactivities,itsuseofAIandits

riskprofile;and

(b)Applyrelevantlifecyclecontrols,andestablishadequatecapabilitiesandtechnology

infrastructurefortheuseofAI,assetoutinSections5and6oftheseGuidelines.Suchcontrols

maybecalibratedbasedontheirrelevance12totheAIusecases,systemsormodelsintheFI.

WheresuchaspectsarerelevanttotheAIusecase,systemormodel,theFImayimplementthem

basedontheriskmaterialityoftheAIusecase.

2.3.AnFImayapplybasicAIgovernancepoliciesandprocedures,assetoutinparagraph2.5.,ifthepoor

performanceorunavailabilityoftheAIservicesortoolsusedbytheFIisunlikelytohaveamaterial

adverseimpactontheFI,itscustomersorotherstakeholders.Inassessingthepotentialimpact,theFI

shouldconsider:

(a)thepotentialfinancial,operational,regulatory,legalorreputationalimpactontheFI;and

(b)thepotentialimpactoncustomersorotherstakeholders,includinginrelationtofairness,ethical

conductandconsumerprotection.

2.4.ExamplesofAIuse13thatwouldgenerallyberegardedasmeetingthecriteriainparagraph2.3.are:

(a)UsingAItoassistindrafting,proofreadingorrephrasingemailstocustomers;

(b)UsingAItoassistinsummarisingdocumentsormeetingnotesforinternalreference;

12CertainAIlifecyclecontrols,suchasthoserelatingtotransparency,explainability,andfairnessmaybemorerelevantforAI

usedinareassuchascreditscoring,insuranceunderwriting,provisionoffinancialadvisoryorfundmanagementservices.For

AIusedinlowriskmaterialityareastoassisthumansandnotfordecisionmaking,suchascopilotstoassistinwriting,AIlife

cyclecontrolsrelatingtoselectionoftheAIsystemsormodels,orcertainevaluationandtestingmethodsforAI,e.g.,stress

testing,maybelessrelevant.However,AIlifecyclecontrolsrelatingtodatamanagement,safetyandcybersecuritywouldbe

relevantandshouldbeappliedinaproportionatemanner.

13HumansinvolvedintheseAIusecasesshouldbereviewingandcheckingtheoutputsbeforeusingthem.

GuidelinesonArtificialIntelligenceRiskManagement

7OCTOBER2026|9

(c)UsingAItoassistintheinitialrevieworanalysisofdocumentsforinternalreference;

(d)UsingAItoassistingeneratingformulas,chartsorvisualisationsforinternalreference;

(e)UsingAIimagegeneratorstoassistindesigningmarketingorinternalmaterials;and

(f)UsingAI-poweredchatbotstoassistpersonnelinlocatingrelevantinternalresources,suchas

policiesorprocedures.

2.5.BasicAIgovernancepoliciesandproceduresshouldminimallyincludethefollowing:

(a)clearaccountabilityforAIoversight(e.g.,bydesignatingamemberofseniormanagementas

responsibleforAIoversight);

(b)permittedandprohibitedusesofAI(e.g.,prohibitionsoninputtingconfidential,proprietaryor

clientinformationintopublicAItools),togetherwitheffectivehumanoversight(e.g.,

circumstanceswhenmandatoryhumanreviewandvalidationofAIoutputspriortouseis

required);

(c)maintenanceofanapprovedlistofAItools,andadefinedprocessforrequestingapprovalofnew

AItools;

(d)staffeducationontheFI’sAI-relatedpolicies;

(e)regularcompliancechecks;and

(f)periodicandtrigger-basedreviewofwhethertheFI’sAIusecontinuestomeetthecriteriain

paragraph2.3.

GuidelinesonArtificialIntelligenceRiskManagement

7OCTOBER2026|10

3.AIOversight

3.1.TheboardofdirectorsandseniormanagementofanFIplaycriticalrolesinestablishingandoverseeing

robustframeworks,policiesandprocedurestosupportAIriskmanagementacrosstheFI.

3.2.Theboardandseniormanagementshouldensurethatexistingriskmanagementframeworks,

policies,andpracticesacrosstheorganisation14adequatelyidentify,assess,andaddressrisksposed

byAI.BoardandseniormanagementshouldmaintaineffectiveoversightofrisksfromAIuse,foster

theappropriateriskculturefortheuseofAI,andensurethattheFI’suseofAIwouldnotconflictwith

itsabilitytomeetregulatoryrequirementsorothersupervisoryexpectations15.

3.3.Theboardandseniormanagementshouldensureconsistentstandards,clearaccountability,and

robustcoordinationacrosstheFItomanagerisksfromAIuse.WhiletheFImayadoptvarying

approachestoAIriskmanagement,suchascreatinganewcentralisedfunctiontomanageallrisksfrom

AIuse,ormanagingtheincrementalrisksfromAIuseviaexistingriskmanagementfunctions,theboard

andseniormanagementshouldstillensureconsistentandcoordinatedmanagementofrisksfromAI

useacrossallrelevantfunctions16.

3.4.Theboard,oracommittee17delegatedbyit,isresponsiblefor:

(a)approvingandregularlyreviewingtheoverallgovernanceapproachforAIriskmanagement,

includingthestrategicdirectionforAIuseandkeyframeworks,structures,policiesand

proceduresdesignedtoassessandmanagerisksfromtheFI’suseofAIonanongoingbasis;

(b)ensuringthatrisksfromAIuseareexplicitlyaddressedwithintheFI’sriskappetiteframework,

includingqualitativestatementsandquantitativemeasuresforsuchrisksasappropriate18;

14KeyexistingriskmanagementareaswhererisksfromAIusearerelevantincludebutarenotlimitedtomodel,operational,

reputational,data,technologyandcybersecurity,third-party,legalandcompliance,financial,conduct,andenvironmental

risks.

15Forexample,anFIshouldcontinuetoadheretoMAS’GuidelinesonFairDealingevenifitleveragesAItodeliverproducts

andservices.

16Forexample,byestablishingstructurestocoordinateAIriskmanagementinacross-functionalmanner,suchascross-

functionalcommitteesorlinesofcommunicationbetweenfunctions.

17ForanFIwhichispartofaglobalgroup,thecommitteecouldbeagoverningbodyorcommitteebeyondlocalmanagement

thatisresponsiblefortheoversightoftheFIinSingapore,suchasaregionalorglobalcommitteewhichexercisesoversightof

therisksfromAIuserelevanttotheFIinSingapore.ForanFIwhichisnotpartofaglobalgroup,thisreferstotheboardof

directorsoraboard-levelcommitteewhichisdelegatedbytheboardofdirectors.

18Forexample,theFIcouldestablishaqualitativeriskappetitestatementthatarticulatesthetypesandlevelofrisksfromAI

usethattheFIiswillingtoaccept,and/orprohibitedusecategories.Quantitativeriskappetitemeasurescouldinclude

thresholdsonthenumberorfinancialimpactofAI-relatedincidents,numberofmaterialAIusecaseswithdependenciesona

singleprovider,orthenumberofmaterialAIusecasesinbreachofestablishedperformancethresholds.

GuidelinesonArtificialIntelligenceRiskManagement

7OCTOBER2026|11

(c)settingclearrolesandresponsibilitiesfortheboardandseniormanagementconcerningAIrisk

managementoversight;

(d)ensuringithasanadequateunderstandingofAItoprovideeffectiveoversightandchallenge;and

(e)ensuringthattheFI’sapproach,riskappetiteframework,rolesandresponsibilities,capabilities

andcultureforriskmanagementofAIuseareregularlyreviewedtokeeppacewithnewerAI

developments,aswellaschangesintheFI'sriskprofileandbusinessstrategies.

3.5.Seniormanagementisresponsiblefor:

(a)ensuringtheeffectiveimplementationofAI-relatedriskmanagementframeworks,structures,

policiesandproceduresacrosstheFI,consistentwiththeFI’sriskappetite;

(b)regularlyreviewingtheeffectivenessoftheAI-relatedriskmanagementframeworks,structures,

policiesandprocedures,makingappropriaterevisionstokeeppacewithnewerAIdevelopments

andchangesintheFI’sriskprofileandbusinessstrategies,aswellasrelevantregulatory

requirements;

(c)institutingappropriatestrategiesandcontrolstomanagerisksposedbyAIthroughouttheentire

AIlifecycle;

(d)establishingclearrolesandresponsibilitiesformanagingrisksfromAIuseacrossdifferent

businesslinesandfunctions19,includingcontrolfunctionsresponsibleforsystemsandprocesses

relatingtoAIidentification,inventorisationandriskmaterialityassessment;

(e)establishinganinternalescalationprocessformanagingmaterialrisksandexceptionsfromAIuse,

suchasAIincidents20orbreachesofriskthresholds,andensuringappropriateandtimelyactions

aretaken;

(f)updatingtheboardonmaterialAIriskissuesinatimelymanner;and

19Suchrolesandresponsibilitiesmayleveragethethreelinesofdefencemodelifappropriate.Forexample,firstlinefunctions

couldcomprisemodeldevelopersandusersofAI,andmayberesponsibleforareassuchasassessingrisksfromAIusecases

ortheapplicationofappropriatehumanoversight.Secondlinefunctionscouldprovideeffectiveandindependentchallenge

tofirstlinefunctions,andmayberesponsibleforareassuchasindependentvalidationandoverallcompliancewithapplicable

regulationsandsupervisoryexpectations.Thethirdline(i.e.internalaudit)couldprovideindependentassuranceonthe

effectivenessoftheAIriskmanagementframework.

20ForthepurposeoftheseGuidelines,AIincidentspertaintoincidentsthatinvolveafailure,malfunction,orpoorperformance

oftheunderlyingAIsystem(s)ormodel(s).

GuidelinesonArtificialIntelligenceRiskManagement

7OCTOBER2026|12

(g)ensuringthenecessarycompetenceofpersonnelandallocatingadequateresources(suchas

human,technological,financialresources)foreffectiveAIriskmanagement,includingappropriate

trainingandcapacitybuilding.

3.6.Localseniormanagementremainsaccountableforensuringthatgroupframeworks,ifadoptedfor

Singapore,adequatelyaddresslocalconsiderationsandregulatoryrequirementsspecifictoSingapore.

LocalseniormanagementshouldhaveadequatevisibilityintoandinputonmattersaffectingSingapore

operations,includingaccesstotimelyandrelevantreportsanddatathatinformdecisionsonhowto

managerisksfromAIuse.ThereshouldbeclearescalationpathsforSingapore-specificissuestobe

surfacedtotheresponsiblepartiestoensuretimelydecision-makingandresolutionoflocalconcerns.

LocalseniormanagementshouldalsobeabletodemonstratetoMAShowtheydischargetheir

oversightresponsibilities,evenwhenrelyingongroupframeworks.

GuidelinesonArtificialIntelligenceRiskManagement

7OCTOBER2026|13

4.KeyAIRiskManagementSystems,Policies

andProcedures

4.1.AnFIshouldensurethatitsAIriskmanagementframeworkencompasseskeysystems,policiesand

proceduresfortheidentification,inventorisation,andriskmaterialityassessmentofAI.TheFIshould

applyconsistentandrobustapproachestoidentify,inventoriseanddeterminetheriskmaterialityof

AI,andapplycontrolsproportionatetotheassessedriskmateriality.

AIIdentification

4.2.AnFIshouldestablishsystems,policiesandprocedurestoensuretheconsistentidentificationofAI

useacrossallrelevantbusinessandfunctionalareas.Thisidentificationprocessisacritical

prerequisiteforapplyingtheappropriategovernance,riskmanagementstandards,andcontrols

effectivelytoAIthroughouttheirlifecycle.ClearAIdefinitions,criteriaandprocesses,supportedby

toolsandsystemsasappropriate,shouldbeimplemen